|
Hey ppl,
In Rusty Russell's packet filtering HOWTO there is
an introduction, (to make short), "This HOWTO flips between a gentle
introduction (which will leave you feeling warm and fuzzy now, but unprotected
in the real world) and raw full-disclosure (which would leave all but the
hardiest souls confused, paranoid and seeking heavy weaponry)."
I feel like the latter, seeking heavy weaponry, I
must be missing (obviously, since I'm writing to the list) something in my
configuration of either the script or the box itself. This is what my script
looks like:
#!/bin/bash
# # This is my first attempt at a personalized iptables script # # ## Variables ## LOOPBACK="lo" ## Loopback Interface EXTERNAL_NET="eth0" ## External Interface DMZ_NET="eth1" ## DMZ Interface INTERNAL_NET="eth2" ## Internal Interface # # INTERNAL="192.168.1.0/24" ## Network address for internal network DMZ="172.16.1.0/24" ## Network address for the DMZ EXTERNAL="192.168.2.0/24" ## Network address for external network # # ##INT_IP="192.168.1.11" ## IP address of Internal Interface INT_IP=`ifconfig $INTERNAL_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1` # ##DMZ_IP="172.16.1.1" ## IP address of DMZ Interface DMZ_IP=`ifconfig $DMZ_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1` # ##EXT_IP="192.168.2.1" ## IP address of External Interface EXT_IP=`ifconfig $EXTERNAL_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1` # LOG_LEVEL="notice" ## Default log level: kern.notice: # ## Routing packets (traffic) between interfaces echo 1 > /proc/sys/net/ipv4/ip_forward # # echo "[---Flushing the chains---]" iptables -F iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD # # # echo "[--Setting Policies--]" iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD ACCEPT # # ## Allow inside traffic to get to the DMZ and back iptables -A FORWARD -i $INTERNAL_NET -o $DMZ_NET -j ACCEPT iptables -A FORWARD -i $DMZ_NET -o $INTERNAL_NET -j ACCEPT iptables -A INPUT -i $INTERNAL_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp -j ACCEPT iptables -A OUTPUT -o $DMZ_NET -s 172.16.1.0/24 -d 192.168.1.0/24 -p icmp -j ACCEPT iptables -A INPUT -i $DMZ_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp -j ACCEPT iptables -A OUTPUT -o $INTERNAL_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp -j ACCEPT # # After I loaded the script and verified with the
command iptables -L I go to one of my internal machines and attempt to ping one
of the two machines on the DMZ to no avail. I checked that the machine I'm
pinging from has a default gateway...this would be the address of eth2. The
command to allow ip_forwarding is on the script and I get no errors when I load
the script or do I need to set the default gateways for each of the NICs on the
firewall machine? I have tried this both ways ..... there is also a setting in
the network configuration utility that will allow me to enable ip
forwarding....I have also tried it with this. Hence, "seeking heavy weaponry", I
generally understand the concept, however putting it into action is another
story, which I'm sure some of you might have witnessed yourselves.
This is the output of the command iptables -L -n -v
after I performed the ping from an internal machine to one of the DMZ
machines.
Chain INPUT (policy DROP 2 packets, 310
bytes)
pkts bytes target prot opt in out source destination 0 0 ACCEPT icmp -- eth2 * 192.168.1.0/24 172.16.1.0/24 0 0 ACCEPT icmp -- eth1 * 192.168.1.0/24 172.16.1.0/24 Chain FORWARD (policy ACCEPT 0 packets, 0
bytes)
pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- eth2 eth1 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- eth1 eth2 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy DROP 0 packets, 0
bytes)
pkts bytes target prot opt in out source destination 0 0 ACCEPT icmp -- * eth1 172.16.1.0/24 192.168.1.0/24 0 0 ACCEPT icmp -- * eth2 192.168.1.0/24 172.16.1.0/24 As you can see the packets are making it to the
INPUT chain but it is either being dropped at the INPUT chain because of
incorrect rule structure or it is not being forwarded out through the FORWARD
chain.....routing ??? Any insights will be gratefully appreciated. I dislike
violence, so any input into a resolution and/or pointer to documentation will
keep me from seeking any need for heavy weaponry.
Tim Rodriguez-- Mia/Fla.
Network Security Student --
90% of networking problems are routing
problems.
9 of the remaining 10% are routing problems, but in the other direction. The final 1% might not be routing, but check it anyway. --
|
- Re: seeking heavy weaponry !! Tim
- Re: seeking heavy weaponry !! Antony Stone
