Router-firewall problem

[Zdenek SUTR Kaminski]

On Thu, 19 Dec 2002, Petr Hřebíček wrote:

> > > Ne, NAT nepouzivam.
> > > PC v LAN maji verejne adresy.
> > > Petr
> > 
> > Poslete vypis iptables -n -L; iptables -t nat -n -L; iptables 
> > -t mangle -n 
> > -L a pak uvidime :-) I kdyz to bude mozna dlouhe.
> > 
> > -- 
> > Bc. Zdenek Kaminski <xkaminsk at fi.muni.cz>
> > 
> 
> Ok, tady to je:
> adresa .131 je eht0 - Internet
> adresa .225 je eth1 - LAN
> LAN je podsit 62.168.40.224/255.255.255.224
> 
> 
> Chain FORWARD (policy DROP)
> target     prot opt source               destination         
> bad_packets  tcp  --  0.0.0.0/0            62.168.40.224/27   

takze tady si nejrpve zkontrolujete, co vam leze do vnitrni site. Tady
mozna bude pech. Viz nize...


> ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0          state
> RELATED,ESTABLISHED 

jasne 


> ACCEPT     tcp  --  62.168.40.227        0.0.0.0/0          tcp dpt:80 

jasne, jen tato IP adresa muze primo na web...

> REJECT     tcp  --  62.168.40.224/27     0.0.0.0/0          tcp dpt:80
> reject-with icmp-port-unreachable 

...zrejme

> ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0          icmp type 0 
> ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0          icmp type 3 
> ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0          icmp type 8 
> ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0          icmp type 11

zrejme

> 
> LOG        icmp --  0.0.0.0/0            0.0.0.0/0          icmp type 9
> LOG flags 0 level 4 prefix ` _! ICMP Type 9: ' 
> REJECT     icmp --  0.0.0.0/0            0.0.0.0/0          icmp type 9
> reject-with icmp-port-unreachable 
> ACCEPT     all  --  62.168.40.224/27     0.0.0.0/0          

jasne, tady rikate, ze vsichni z vnitrni site mohou posilat pakety ven. 
Tohle je, zda se mi, spravne.

> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination         
> ACCEPT     tcp  --  0.0.0.0/0            62.168.40.224/27   
no, proc tam mate toto pravidlo, kdyz v nasledujicim

> ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0          

delate toto. Asi by to chtelo vypis iptables -v ... pro lepsi pochopeni.
Mozna asi proto, aby veskery OUTPUT z routeru mohl do vnitrni i do vnejsi 
site.

> 
> Chain bad_packets (2 references)
> target     prot opt source               destination         
> LOG        tcp  --  0.0.0.0/0            0.0.0.0/0          tcp
> flags:!0x16/0x02 state NEW LOG flags 0 level 4 prefix `New not syn,DROP:
> ' 
> DROP       tcp  --  0.0.0.0/0            0.0.0.0/0          tcp
> flags:!0x16/0x02 state NEW  

Tak, tady asi bude zakopany pes. Zrovna nejsem ve stavu hodneho cteni 
manualove stranky, protoze mame vanocni besidku s dvema peknyma kozatyma 
cerkama. Damy prominou, panove jsou zvykli...

Kdyz by pravidlo bad_packets bylo:

iptables -N bad_packets
iptables -A bad_packets -j ACCEPT

tak spojeni z vnitrku ven projde?

Nedavno jsem tady v konferenci vypenil pri reseni kvot a XFS. Snad 
nevypenite pri mem emailu. Ale treba Vam to pomuze. Za vypeneni se 
omlouvam.

Preji hezky zbytek dne a pekne Vanoce.


-- 
Bc. Zdenek Kaminski <xkaminsk at fi.muni.cz>

homepage: http://www.fi.muni.cz/~xkaminsk/
IPv6 router homepage: http://www.openrouter.net/
Key: 0xD7315488
Key fingerprint: 3CB0 8108 CB76 446E 2895 AF33 9B3A 851B D731 5488