Server from inside LAN

andrewjjones · 01-09-2005, 06:14 PM

Quote:

Post your complete iptable rules.

These are run each time the machine is turned on:

Code:

iptables -N log_n_drop
iptables -N log_n_pass
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
iptables -A log_n_pass -m limit --limit 6/m --limit-burst 2 -j LOG --log-level info --log-prefix "ACCEPTED:"
iptables -A log_n_pass -j ACCEPT
iptables -A log_n_drop -m limit --limit 12/m --limit-burst 2 -j LOG --log-level info --log-prefix "DROPPED:"
iptables -A log_n_drop -j DROP
iptables -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -i ppp0 -m state --state NEW -j log_n_drop
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i wlan0 -s 192.168.0.0/24 -j log_n_pass
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A FORWARD -i ppp0 -m state --state NEW -j log_n_drop
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i wlan0 -s 192.168.0.0/24 -j log_n_pass

And then I manually enter the ones from this thread.

Quote:

Does your ISP block port 80 traffic?

Not that I know of. I have run a web server before when I had the modem connected directly to my computer.

michaelk · 01-09-2005, 06:57 PM

I'm no expert on this stuff but I see a potential problem.
iptables -A INPUT -i ppp0 -m state --state NEW -j log_n_drop

Anybody trying to access the webserver will be a new connection and therefore will be dropped. Try changing it to log_n_pass.

andrewjjones · 01-14-2005, 05:01 PM

At the moment there is a script that runs when the computer starts up, which executes the iptables commands to set up the network etc. (they are the commands I posted). If I type the 'log_n_pass' line after this script has run, should it work? That is, if I ttype that line, will it replace the old 'log_n_drop' command?

micxz · 01-14-2005, 05:15 PM

What you really should do is configure the firewall script that came with your distro. e.g. shorewall? I think that's the one on Mandrake.

Or if you like the rule set and simply need to delete a rule. go `iptables -L --line-numbers` and the find the line you want to delete and do a 'iptables -D chain rulenum' chain being the chain name and rulenum being the numbered line on that chain. I hope this is clear.

andrewjjones · 01-15-2005, 12:30 PM

This is the output of 'iptables --list --line-numbers':

Code:

Chain INPUT (policy DROP)
num  target     prot opt source               destination         
1    ACCEPT     all  --  localhost            anywhere            
2    DROP       all  --  anywhere             anywhere            state INVALID 
3    log_n_drop  all  --  anywhere             anywhere            state NEW 
4    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
5    log_n_pass  all  --  localnet/24          anywhere            

Chain FORWARD (policy DROP)
num  target     prot opt source               destination         
1    DROP       all  --  anywhere             anywhere            state INVALID 
2    log_n_drop  all  --  anywhere             anywhere            state NEW 
3    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
4    log_n_pass  all  --  localnet/24          anywhere            

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

Chain log_n_drop (2 references)
num  target     prot opt source               destination         
1    LOG        all  --  anywhere             anywhere            limit: avg 12/min burst 2 LOG level info prefix `DROPPED:' 
2    DROP       all  --  anywhere             anywhere            

Chain log_n_pass (2 references)
num  target     prot opt source               destination         
1    LOG        all  --  anywhere             anywhere            limit: avg 6/min burst 2 LOG level info prefix `ACCEPTED:' 
2    ACCEPT     all  --  anywhere             anywhere

What should I delete? I suppose I need to delete INPUT 3 and FORWARD 2, but what about the log_n_drop chains?

andrewjjones · 01-16-2005, 03:00 PM

I have just tried deleting the log_n_drop line (INPUT 3) and then typing in the new iptables commands. But then I can't get on the internet!

andrewjjones · 01-17-2005, 03:40 PM

Right then. I have restarted the computer so it is back to normal. Then I've typed this, in this order:

1. iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 80 -j DNAT --to 192.168.0.1:80
2. iptables -A FORWARD -p tcp -i ppp0 -d 192.168.0.1 --dport 80 -j ACCEPT
3. echo 1 > /proc/sys/net/ipv4/ip_forward
4. iptables --delete INPUT 3 [the 3 log_n_drop all -- anywhere anywhere state NEW line]
5. iptables -A INPUT -i ppp0 -m state --state NEW -j log_n_pass

After this, the internet works okay, but going to the gateway's external ip does not load the page from my web server.

Fle>< · 01-17-2005, 04:14 PM

took me some time to read all your posts

but I think I found something you all haven't looked at: -P DROP
This means each packet will be dropped, if there isn't a rule, which stops that.
My suggestion:
iptables -I INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT
try this line instead of your 5th command ("iptables -A INPUT -i ppp0 -m state --state NEW -j log_n_pass
")
explanation:
With --state NEW you are meaning all packets opening a new connection (see also: 3-way-handshake). After a client has opened a new connection, it send packets without the NEW flag. Now there is no rule matching, so the policy says DROP and the packet is lost.

If it's working please show us the output of 'iptables -L -n' again. thx

andrewjjones · 01-17-2005, 04:23 PM

Thanks, I will try that. Just one thing though - as I have already entered the 5th command, will I have to restart the computer and type everything again, or will your command just replace the old one?

Fle>< · 01-17-2005, 04:27 PM

You can restart and type everything again
or
you should type:

Code:

iptables -D INPUT -i ppp0 -m state --state NEW -j log_n_pass
iptables -I INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT

Suddenly I have a doubt, that this works. What I said shouldn't be wrong, but if PREROUTING is working correctly,
the chain INPUT shouldn't be used for these packets.

Anyway try my tip. If it doesn't work, I will write down the complete firewall configuration..

andrewjjones · 01-17-2005, 04:35 PM

Yes, there are a lot of posts aren't there

I tried what you said. Thanks for trying to help, but it still doesn't do it. I didn't know all this was going to get so complicated

Fle>< · 01-17-2005, 05:08 PM

hoping that's it:
I've written a tiny script. Copy it to a new file an make it executable. Then run it.
This script is deleting all your firewall settings and making new ones. It's only for trying to make your server accessible.
Make sure there are no rules in iptables -t nat. You can do this with iptables -t nat -L.
If you want to reset your configuration, you should restart your computer - I think that is the easiest way, because
your firewall loads a script which (re-)creates all firewallsettings.

Code:

EXTINT=ppp0

#Delete all rules
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT

#Set Policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

#don't accept any new or invalid connections from outside, with one exception:
#only accept NEW packets on port 80 for forwarding
iptables -A INPUT -i "$EXTINT" -m state --state NEW,INVALID -j DROP
iptables -A FORWARD -i "$EXTINT" -p tcp --dport ! 80 -m state --state NEW -j DROP
iptables -A FORWARD -i "$EXTINT" -m state --state INVALID -j DROP

#Allow HTTP-connections from inside the firewall
iptables -A FORWARD -o "$EXTINT" -p tcp --sport 1024:65535 --dport 80 -j ACCEPT
iptables -A FORWARD -i "$EXTINT" -p tcp --dport 1024:65535 --sport 80 ! --syn -j ACCEPT

#Forward connections for your server
iptables -t nat -A PREROUTING -i "$EXTINT" -p tcp --dport 80 -j DNAT --to-destination 192.168.0.1
iptables -A FORWARD -i "$EXTINT" -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -o "$EXTINT" -p tcp --sport 80 -j ACCEPT

#Masquerading
iptables -t nat -A POSTROUTING -o "$EXTINT" -j MASQUERADE

I can not try it. I am only hoping that it works

peter_robb · 01-18-2005, 10:58 AM

It would be a lot tidier to just replace the "$EXTINT" variable with ppp0..
Makes it way more readable..

Also to consider..
The original problem of not connecting to a LAN based server using it's external ip number..

If you send packet from 192.168.0.20 to 222.333.444.555 and it's dnatted to 192.168.0.1,
the server will see a source address of 192.168.0.20, notice it's local, and send it directly back, from 192.168.0.1..
So the original pc sees a packet going to 222.333.444.555 but a reply from 192.168.0.1
and drops it as rubbish..

If you have lots of workstations, the quickest answer is to run a small dns caching server on the firewall that converts all the names possible for the server back to it's internal number.
dnsmasq and dnrd are common..
Otherwise, add this list to everyone's /etc/host file (or lmhosts.sam for M$ )

eg
192.168.0.1 www.myserver.com pages.myserver.com myserver.com test.myserver.com

(You of course could have quite a few vitual domain names in the one server)

andrewjjones · 01-18-2005, 12:49 PM

Quote:

Originally posted by Fle><
I can not try it. I am only hoping that it works

Sorry, it still doesn't do it. It just stops me connecting to the internet...

Quote:

Originally posted by peter_robb
If you send packet from 192.168.0.20 to 222.333.444.555 and it's dnatted to 192.168.0.1,
the server will see a source address of 192.168.0.20, notice it's local, and send it directly back, from 192.168.0.1..
So the original pc sees a packet going to 222.333.444.555 but a reply from 192.168.0.1
and drops it as rubbish.

So this might not work anyway? At the moment I am trying it by going to the gateway's external IP from the web server, as it's the computer I can get to the easiest.

Quote:

Originally posted by peter_robb
If you have lots of workstations, the quickest answer is to run a small dns caching server on the firewall that converts all the names possible for the server back to it's internal number.
dnsmasq and dnrd are common..
Otherwise, add this list to everyone's /etc/host file (or lmhosts.sam for M$ )

eg
192.168.0.1 www.myserver.com pages.myserver.com myserver.com test.myserver.com

(You of course could have quite a few vitual domain names in the one server)

I will look into that then...

andrewjjones · 01-19-2005, 06:11 PM

Thanks for everyone's help, I'm not having a go at you... but is this normally so complicated? I thought that all I would have to do is forward packets coming in on port 80 to my web server, and packets from the server back out again!