Hola a todos los linuxeros, soy nuevo en la lista; escribo desde la ciudad de Puebla en Mexico, desde aqui les envio un saludo. Esta es la primera molestia q doy sobre el tema: Tengo 2 tarjetas de red en una maquina con Linux, una tiene una ip valida (esta es eth0 y salgo a la internet con ella) y a la otra le asigne el ip 192.168.1.1 (esta es eth1): ifconfig eth1 198.168.1.1, bueno, despues de eso, levante los modulos necesarios para el ip-masquerade: depmod -a, insmod modulo1, insmod modulo2,, etc, en general hice lo q me indica en el How-To de Ip-masquared para poder dar salida a la internet a unas maquinas q tengo aca. Pues ya hice de todo (hasta le hable bonito a la chompu) y nada, ni siquiera prenden los mentados foquitos de eth1 para indicarme q hay red. Si bajo y levanto la interfaz eth1 me aparece esto: [root@maxplus /root]# ifdown eth1 [root@maxplus /root]# ifup eth1 SIOCADDRT: La red es inaccesible Anexo al mail envio un script q me encontre en la pagina de RedHat (por si a alguien le sirve) para poner un firewall antes del proxy, decia ahi q primero se encargaba de levantar el proxy y depues firewalearlo. Pues aqui me envia unas mensajes bien curisosos en el /var/log/messages: De entrada lo levanto: [root@maxplus /root]# /etc/rc.d/init.d/firewallss start EXTDEV: eth0 on 148.228.y.x INTDEV: eth1 on 192.168.1.1 Starting firewall: Setting masq timeouts Setting new forward rules forward...input...Setting new input rules Setting new output rules output...Done with the firewall rulesets acct...ipchains: Chain already exists ipchains: Chain already exists done y en el /var/log/message me sale: Oct 24 13:23:44 maxplus kernel: Packet log: input DENY eth0 PROTO=88 148.228.20.1:65535 224.0.0.10:65535 L=60 S=0x00 I=0 F=0x000$ Oct 24 13:23:45 maxplus kernel: Packet log: input DENY eth0 PROTO=17 148.228.20.1:520 224.0.0.9:520 L=72 S=0x00 I=0 F=0x0000 T=2$ Oct 24 13:23:48 maxplus kernel: Packet log: input DENY eth0 PROTO=17 148.228.20.212:138 148.228.20.255:138 L=229 S=0x00 I=20315 $ Oct 24 13:23:50 maxplus kernel: Packet log: input DENY eth0 PROTO=88 148.228.20.1:65535 224.0.0.10:65535 L=60 S=0x00 I=0 F=0x000$ Oct 24 13:23:51 maxplus kernel: Packet log: input DENY eth0 PROTO=17 148.228.20.251:137 148.228.20.255:137 L=78 S=0x00 I=64852 F$ Oct 24 13:23:53 maxplus kernel: Packet log: input DENY eth0 PROTO=17 148.228.21.222:137 148.228.21.255:137 L=78 S=0x00 I=57633 F$ Oct 24 13:23:55 maxplus kernel: Packet log: input DENY eth0 PROTO=88 148.228.20.1:65535 224.0.0.10:65535 L=60 S=0x00 I=0 F=0x000$ Oct 24 13:23:56 maxplus kernel: Packet log: input DENY eth0 PROTO=17 148.228.20.251:137 148.228.20.255:137 L=78 S=0x00 I=64854 F$ Oct 24 13:23:56 maxplus kernel: Packet log: input DENY eth0 PROTO=17 148.228.20.251:137 148.228.20.255:137 L=78 S=0x00 I=64855 F$ Bueno espero q alguien me pueda ayudar a configurar mi maquina para poder dar salida a la red a las otras maquina; perdon por lo extenso o grande q llegue a ser el mail (asi como las molestias q ocacione), pero quizas si alguien ve lo q este pasando pueda ayudarme. Graxias Salu2 P.D. Si existe un alma piadosa q me ayude con esto (a configurar) le estare muy agradecido. _________________________________________________________________ Hector Lopez Rguez.<[EMAIL PROTECTED]> http://www.cs.buap.mx/~jolopez/ icq: 42579364 Lab. de Arquitectura de Procesadores FCC -BUAP Puebla Puebla
#!/bin/sh # # chkconfig: 2345 11 89 # description: sets up a basic firewall ruleset # # This script is setup to use IPCHAINS to protect a small network. It is # considered to be 'medium-light' secure. # # This script should be saved as /etc/rc.d/init.d/firewallss # # to enable the system to run this script at system start and stop, issue # the command # chkconfig --add firewallss --level 2345 # Make sure the script's executable bits are set. This can be done with # chmod u+x firewallss # # Thanks go to various people around the office as well as the Trinity OS # author, David A. Ranch. To see a more comprehensive firewall example as # well as other security related topics, please see David's TrinityOS # document at: # http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html # # There are three user-configurable sections. The first is for the network # values for the firewall. The second is for CIPE configuration. The third # consists of the ipchains commands themselves. The only thing that should # need to be changed for the third section is uncommenting the cipe rulesets # if needed (they are deactivated by default). # # Things to watch out for when using this script: # a. When starting it by hand it tends to like the network already up. # This includes both interfaces. (When started automatically by # init it is started pretty early, there is minimal time for the # window to be open. This is medium security, afterall. # b. pump, which controls dhcp under Red Hat, isn't very good at picking # up a change in address for the interface. So if the IP addy of the # interface changes, the script might need to be start/stopped by hand. # You'll loose connectivity and a lot of messages about UDP errors will # be logged to /var/log/messages when this happens. # c. This script is an example. It is targeted for a small LAN (a single # subnet) and would require work for a more complex network. It is # also not guaranteed to be secure, though it is reasonable. # # NO WARRANTY # This script is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY, without even the implied warranty of MERCHANTABILITY # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License # (http://www.gnu.org/copyleft/gpl.html) for more details. # # ###### SCRIPT START ######## # ---- these are for the function calls so the script will run as a service # only change this if the location on your system is different. It # shouldn't be. # Source function library. . /etc/rc.d/init.d/functions # Source networking configuration. # only change this if the location on your system is different. It # shouldn't be. . /etc/sysconfig/network . /etc/sysconfig/cipe # ---- Basic sanity check. This makes sure that networking is up. If it # isn't, why continue? # Check that networking is up. [ ${NETWORKING} = "no" ] && exit 0 ###### USER CONFIGURATION START ######################################### # ---- The device name for the external network interface (in this case "eth1" # Change this to match the interface that is your external (WAN) inter- # face. (PPP users would use ppp0, for example). EXTDEV=eth1 # ---- Don't change the code below. It uses the ifconfig command and # cuts the relevant information out of the display (the IP address) and # configures it. Replacing the code segment with the IP address would # result in the same information anyway. The advantage of using the # code below is for DHCP or other dynamic networks. EXTERNALIP=`ifconfig $EXTDEV | grep "inet addr:" | \ awk -F: {'print $2'} | cut -d\ -f 1` if [ -z "${EXTERNALIP}" ]; then exit 1 fi # ---- The device name for the internal network interface (in this case "eth0" # See comments above. INTDEV=eth0 # See comments above. INTERNALIP=`ifconfig $INTDEV | grep "inet addr:" | \ awk -F: {'print $2'} | cut -d\ -f 1` if [ -z "${INTERNALIP}" ]; then exit 1 fi # ---- The network value for the internal network, in this case it is the # reserved block of 192.168.20.xxx Chance it to match the internal net- # work you are using. INTNET="192.168.20.0" # ===== End of the first configuration section # CIPE Configuration section. # ---- If running CIPE, uncomment these lines. If you are not running CIPE # DON'T mess with any of these. #CIPEDEV=cipcb0 #CIPE_INET=`ifconfig $CIPEDEV | grep "inet addr:" | \ # awk -F: {'print $2'} | cut -d\ -f 1` #if [ -z "${INTERNALIP}" ]; then # exit 1 #fi # #CIPE_PTP=`ifconfig $CIPEDEV | grep "P-t-P:" | \ # awk -F: {'print $3'} | cut -d\ -f 1` #if [ -z "${INTERNALIP}" ]; then # exit 1 # fi # # # The internal IPs used for the destination network. # CIPEINTNET="xxx.xxx.xxx.xxx" # The real IP network used for Red Hat # CIPEREALNET="xxx.xxx.xxx.xxx" # The IP Tunnel Box's IP Addy # TUNNEL="xxx.xxx.xxx.xxx" # IMPORTANT NOTE: If using CIPE then the sections below with the same # variables will need to be uncommented. If you don't # know what CIPE is or don't know how to configure it, # leave it alone. VAriable list: TUNNEL, CIPEREALNET, # CIPEINTNET # ===== End of CIPE configuration section echo "EXTDEV: ${EXTDEV} on ${EXTERNALIP}" echo "INTDEV: ${INTDEV} on ${INTERNALIP}" # See how we were called. case "$1" in start) # Start firewall. echo -n "Starting firewall: " modprobe ip_masq_ftp.o modprobe ip_masq_irc.o modprobe ip_masq_raudio.o # ---- Begin of firewall/ipchain rules. # NOTE: If you have your own firewall script you would rather use, you # can replace the below section with it. Replace everything until the *** # Don't mess with these unless you know what you are doing. # MASQ timeouts. Change these only if the timeouts are causing # problems. # 2 hrs timeout for TCP session timeouts (7200 seconds) # 10 sec timeout for traffic after the TCP/IP "FIN" packet is # received # 60 sec timeout for UDP traffic (MASQ'ed ICQ users must enable # a 30sec firewal # echo "Setting masq timeouts" ipchains -M -S 7200 10 60 ################################################################## # Forwarding, flush and set default policy of deny. Actually the # default policy is irrelevant because there is a catch all rule # with deny and log. echo "Setting new forward rules" echo -n "forward..." # This makes sure that IP forwarding is turned on for networking. echo 1 > /proc/sys/net/ipv4/ip_forward # This does the flush ipchains -F forward # This sets the default to DENY ipchains -P forward DENY # Masquerade from local net on local interface to anywhere. The # 255.255.255.0 netmasks out to the last section. Using the above # internal network example, it makes it everything in the # 192.168.20.xxx range to be legal on this interface. ipchains -A forward -s $INTNET/255.255.255.0 -j MASQ # Masquerade from local net on local interface to anywhere. Like the # above rule, this one says that anything that has the source of the # internal network should be forwarded to the external device and # all these packets are to be masquared. The -d 0.0.0.0/0 indicates # that the destination of the traffic can be to anywhere. ipchains -A forward -i $EXTDEV -s $INTNET/24 -d 0.0.0.0/0 -j MASQ # Backup Rule. Try this out if forwarding doesn't seem to work with # the above rule (make sure to comment out the above). It says that # any packets are to be masq'd and forwarded to the external device. # ipchains -A forward -i $EXTDEV -j MASQ # CIPE Forwarding. Ignore this unless you need it. # ipchains -A forward -d $CIPEINTNET/255.255.255.0 # ipchains -A forward -d $CIPEREALNET/255.255.254.0 # catch all rule, all other forwarding is denied and logged. pity # there is no log option on the policy but this does the job instead. ipchains -A forward -s 0.0.0.0/0 -d 0.0.0.0/0 -l -j DENY # These are variations of the uncommented rule above. #ipchains -A forward -j DENY -l #ipchains -A forward -j DENY ### Port Forwarding Operations ################################# # Uncomment these commands only if port forwarding is needed. # this one # echo "Enabling IPPORTFW Redirection on the external LAN..." # this one # /usr/sbin/ipmasqadm portfw -f # # You probably don't have the ipmasqadm package installed. If # not, go to http://juanjox.kernelnotes.org/ for the binaries. # before trying to run these commands. "rpm -q ipmasqadm" can # be used to check for the package. # #### ---- These Are Examples of Port Forwards ## This one forwards the httpd port from the firewall and ## points it to another machine on the LAN with the IP address of ## 192.168.100.100 # /usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTERNALIP 80 -R 192.168.100.100 80 ## This one forwards a specilized port from the firewall and ## points it at a machine on the LAN with the IP address of ## 192.168.100.100 at port 7000. # /usr/sbin/ipmasqadm portfw -a -P tcp -L $EXTERNALIP 7000 -R 192.168.100.100 7000 ################################################################ # Incoming, flush and set default policy of deny. Actually the # default policy is irrelevant because there is a catch all rule # with deny and log. echo -n "input..." echo "Setting new input rules" # Incoming, flush and set default policy of deny. ipchains -F input ipchains -P input DENY # local interface, local machines, going anywhere is valid ipchains -A input -i $INTDEV -s $INTNET/24 -d 0.0.0.0/0 -j ACCEPT # multicasting is valid (xntpd) ipchains -A input -i $EXTDEV -s $EXTERNALIP/32 -d 224.0.0.0/8 -j ACCEPT # remote interface, claiming to be local machines, IP spoofing, # the rule tells to get lost ipchains -A input -i $EXTDEV -s $INTNET/24 -d 0.0.0.0/0 -j DENY # loopback interface is valid. ipchains -A input -i lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT # The following are ports that could not be configured to only # listen on the internal network, thus we firewall the external side. # Deny access to the backup software port # These lines are read as "Add to Input, Protocol "tcp", source "all" # with the destentation ipchains -A input -p tcp -s 0.0.0.0/0 -d $EXTERNALIP 617 -j DENY # Deny access to the firewall auth port ipchains -A input -p tcp -s 0.0.0.0/0 -d $EXTERNALIP 7777 -j DENY # Deny access to the echo port (used by squid/junkbuster) ipchains -A input -p udp -s 0.0.0.0/0 -d $EXTERNALIP 7 -j DENY # Deny access to syslog ipchains -A input -p udp -s 0.0.0.0/0 -d $EXTERNALIP 514 -j DENY # remote interface, any source, going to external address is valid ipchains -A input -i $EXTDEV -s 0.0.0.0/0 -d $EXTERNALIP/32 -j ACCEPT # IP-IP tunnel. Use these only if you need them. # FIXME: limit this to a device (EXTDEV OR CIPEDEV) # ipchains -A input -p udp -s $TUNNEL $PORT -j ACCEPT # ipchains -A input -i $CIPEDEV -j ACCEPT # catch all rule, all other incoming is denied. # ipchains -A input -j DENY -l # ipchains -A input -j DENY ipchains -A input -s 0.0.0.0/0 -d 0.0.0.0/0 -l -j DENY ################################################################## # Outgoing, flush and set default policy of reject. Actually the # default policy is irrelevant because there is a catch all rule # with deny and log. echo "Setting new output rules" echo -n "output..." # Outgoing, flush and set default policy of deny. ipchains -F output ipchains -P output DENY # local interface, any source going to local net is valid #ipchains -A output -i $INTDEV -s 0.0.0.0/0 -d $INTNET/24 -j ACCEPT ipchains -A output -i $INTDEV -s 0.0.0.0/0 -d $INTNET/24 -j ACCEPT # loopback interface is valid. # ipchains -A output -i lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT ipchains -A output -i lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT # outgoing to local net on remote interface: stuffed routing, deny ipchains -A output -i $EXTDEV -s 0.0.0.0/0 -d $INTNET/24 -j DENY # outgoing from local net on remote interface: stuffed masq, deny ipchains -A output -i $EXTDEV -s $INTNET/24 -d 0.0.0.0/0 -j DENY # anything else outgoing on remote interface is valid #ipchains -A output -i $EXTDEV -d 0.0.0.0/0 -j ACCEPT ipchains -A output -i $EXTDEV -s $EXTERNALIP/32 -d 0.0.0.0/0 -j ACCEPT # outgoing to IP-IP tunnel for CIPE server is valid. Use these # Only if you need them. # ipchains -A output -i $CIPEDEV -s $CIPE_INET -d $CIPE_PTP/32 -j ACCEPT # ipchains -A output -i $CIPEDEV -s $CIPE_INET -d $CIPEREALNET/23 -j ACCEPT # ipchains -A output -i $CIPEDEV -s $EXTERNALIP -d $CIPEREALNET/23 -j ACCEPT # ipchains -A output -i $CIPEDEV -s $CIPE_INET -d 0.0.0.0/0 -j ACCEPT # catch all rule, all other outgoing is denied. # ipchains -A output -j DENY -l # ipchains -A output -j DENY ipchains -A output -s 0.0.0.0/0 -d 0.0.0.0/0 -l -j DENY echo "Done with the firewall rulesets" echo -n "acct..." # Accounting, flush all entries ipchains -N acctin ipchains -N acctout ipchains -N acctio # Track traffic just to network, not individual hosts ipchains -I input -j acctio ipchains -I input -j acctin ipchains -I output -j acctio ipchains -I output -j acctout ipchains -I forward -j acctout echo "done" touch /var/lock/subsys/firewall ;; stop) # Stop firewall. echo -n "Shutting down firewall: " ipchains -F input ipchains -A input -j ACCEPT ipchains -F output ipchains -A output -j ACCEPT ipchains -F forward ipchains -A forward -j ACCEPT ipchains -X acctio ipchains -X acctin ipchains -X acctout rmmod ip_masq_raudio rmmod ip_masq_irc rmmod ip_masq_ftp echo "done" rm -f /var/lock/subsys/firewall ;; restart) $0 stop $0 start ;; status) status firewall ;; *) echo "Usage: firewall {start|stop|restart|status}" exit 1 esac exit 0
