Re: 2.02 and src with multiple IPs - syntax change?

"Tsaousis, Costa" <[email protected]> Fri, 20 Mar 2015 01:12:00 +0200
Newsgroups	gmane.comp.security.firewalls.firehol.user
Message-ID	<CANL+VpaSS=sDGJeOrVbq0A0f6R0evQ_Ka+05APv8Vx=eCjxg-A@mail.gmail.com>
Phil I tried it on a fully updated gentoo in explain mode:

(check the generated commands and the errors)


box firehol-2.0.2 # ./sbin/firehol.in explain

FireHOL 2.0.2
(C) Copyright 2003-2014 Costa Tsaousis <[email protected]>
(C) Copyright 2012-2014 Phil Whineray <[email protected]>
FireHOL is distributed under the GPL v2+.
Home Page: http://firehol.org

-------------------------------------------------------------------------
Get notified of new FireHOL releases by subscribing to the mailing list:
    http://lists.firehol.org/mailman/listinfo/firehol-support/
-------------------------------------------------------------------------

You can now start typing firehol configuration directives.
Special interactive commands: help, show, quit

# FireHOL [:] > interface4 eth0 internet

# \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
# Cmd Line : 1
# Command  : interface4 eth0 internet

# Creating chain 'in_internet' under 'INPUT' in table 'filter'
/sbin/iptables -t filter -N in_internet
/sbin/iptables -t filter -A INPUT -i eth0 -j in_internet

# Creating chain 'out_internet' under 'OUTPUT' in table 'filter'
/sbin/iptables -t filter -N out_internet
/sbin/iptables -t filter -A OUTPUT -o eth0 -j out_internet

# > OK <
# FireHOL [interface:internet] > server ssh accept src
1.2.3.4,5.6.7.8,192.168.1.0/24

# \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
# Cmd Line : 2
# Command  : server ssh accept src 1.2.3.4,5.6.7.8,192.168.1.0/24

# Preparing for service 'ssh' of type 'server' under interface 'internet'

# Creating chain 'in_internet_ssh_s1' under 'in_internet' in table 'filter'
/sbin/iptables -t filter -N in_internet_ssh_s1
/sbin/iptables -t filter -A in_internet -j in_internet_ssh_s1

# Creating chain 'out_internet_ssh_s1' under 'out_internet' in table 'filter'
/sbin/iptables -t filter -N out_internet_ssh_s1
/sbin/iptables -t filter -A out_internet -j out_internet_ssh_s1

# Running simple rules for  server 'ssh'

# Rules for ssh server, with server port(s) 'tcp/22' and client
port(s) 'default'
/sbin/iptables -t filter -A in_internet_ssh_s1 -p tcp -s
1.2.3.4\,5.6.7.8\,192.168.1.0/24 --sport 1024:65535 --dport 22 -m
conntrack --ctstate NEW\,ESTABLISHED -j ACCEPT
/sbin/iptables -t filter -A out_internet_ssh_s1 -p tcp --sport 22 -d
1.2.3.4\,5.6.7.8\,192.168.1.0/24 --dport 1024:65535 -m conntrack
--ctstate ESTABLISHED -j ACCEPT

# > OK <



This is now v3:

box # firehol explain

FireHOL $Id: fbd64e9ef9e9a1a383ba09cc3d9a93a408b9abb7 $
(C) Copyright 2003-2015 Costa Tsaousis <[email protected]>
(C) Copyright 2012-2015 Phil Whineray <[email protected]>
FireHOL is distributed under the GPL v2+.
Home Page: http://firehol.org

-------------------------------------------------------------------------
Get notified of new FireHOL releases by subscribing to the mailing list:
    http://lists.firehol.org/mailman/listinfo/firehol-support/
-------------------------------------------------------------------------

You can now start typing firehol configuration directives.
Special interactive commands: help, show, quit

# FireHOL [:] > in4
# \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
# Cmd Line : 1@Interactive User Input
# Command  : interface4 eth0 world

# Creating chain 'in_world' under 'INPUT' in table 'filter'
/sbin/iptables -t filter -N in_world
/sbin/iptables -t filter -A INPUT -i eth0 -j in_world

# Creating chain 'out_world' under 'OUTPUT' in table 'filter'
/sbin/iptables -t filter -N out_world
/sbin/iptables -t filter -A OUTPUT -o eth0 -j out_world

# > OK <
# FireHOL [interface:world] > server ssh accept src
1.2.3.4,5.6.7.8,192.168.1.0/24
# \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
# Cmd Line : 2@Interactive User Input
# Command  : server ssh accept src 1.2.3.4,5.6.7.8,192.168.1.0/24

# Preparing for service 'ssh' of type 'server' under interface 'world'

# Creating chain 'in_world_ssh_s1' under 'in_world' in table 'filter'

# Creating chain 'out_world_ssh_s1' under 'out_world' in table 'filter'

# Simple rules for  server 'ssh'

# Rules for ssh server, with server port(s) 'tcp/ 22' and client
port(s) '1024:65535'
/sbin/iptables -t filter -A in_world -p tcp -s 1.2.3.4 --sport
1024:65535 --dport 22 -m conntrack --ctstate NEW\,ESTABLISHED -j
ACCEPT
/sbin/iptables -t filter -A in_world -p tcp -s 5.6.7.8 --sport
1024:65535 --dport 22 -m conntrack --ctstate NEW\,ESTABLISHED -j
ACCEPT
/sbin/iptables -t filter -A in_world -p tcp -s 192.168.1.0/24 --sport
1024:65535 --dport 22 -m conntrack --ctstate NEW\,ESTABLISHED -j
ACCEPT
/sbin/iptables -t filter -A out_world -p tcp --sport 22 -d 1.2.3.4
--dport 1024:65535 -m conntrack --ctstate ESTABLISHED -j ACCEPT
/sbin/iptables -t filter -A out_world -p tcp --sport 22 -d 5.6.7.8
--dport 1024:65535 -m conntrack --ctstate ESTABLISHED -j ACCEPT
/sbin/iptables -t filter -A out_world -p tcp --sport 22 -d
192.168.1.0/24 --dport 1024:65535 -m conntrack --ctstate ESTABLISHED
-j ACCEPT

# > OK <


On Thu, Mar 19, 2015 at 10:51 PM, Whit Blauvelt <[email protected]> wrote:
> Hi Phil,
>
> On further testing it looks like this is specific to something about the
> older Ubuntu 10.04 system (with iptables 1.4.4) I was putting it on. On
> 12.04 there's no such problem. Since 10.04 is going out of support the end
> of next month anyway, probably not something worth worrying about. I have
> FireHOL on a variety of systems, but this may be the only time I've put it
> on 10.04.
>
> Best,
>
> Whit
>
> On Thu, Mar 19, 2015 at 07:04:20PM +0000, Phil Whineray wrote:
>> On Thu, Mar 19, 2015 at 12:07:24PM -0400, Whit Blauvelt wrote:
>> > Also, the comma separator worked in 2.0.0-rc.2.
>>
>> Sorry about this but I don's seem to be able to reproduce it, can
>> you give a complete minimal config?
>>
>> I tried this:
>>
>> interface any any
>>       client all accept
>>       server4 ssh accept src 1.2.3.4,5.6.7.8,192.168.1.0/24
>>
>> but it worked just fine:
>>
>> $ sudo ./sbin/firehol.in | head
>>
>> FireHOL 2.0.2
>> (C) Copyright 2003-2014 Costa Tsaousis <[email protected]>
>> (C) Copyright 2012-2014 Phil Whineray <[email protected]>
>> FireHOL is distributed under the GPL v2+.
>> Home Page: http://firehol.org
>>
>> -------------------------------------------------------------------------
>> Get notified of new FireHOL releases by subscribing to the mailing list:
>>     http://lists.firehol.org/mailman/listinfo/firehol-support/
>>
>> $ sudo ./sbin/firehol.in x.conf
>> FireHOL: Saving your old firewall to a temporary file: OK
>> FireHOL: Processing file x.conf: OK
>> FireHOL: Activating new firewall (52 rules): OK
>> Keep the firewall? (type 'commit' to accept - 30 seconds timeout) : ^C
>>
>> If I make it server instead of server4, I get an error but from
>> ip6tables as expected, not from iptables as your error shows:
>>
>> 2$ sudo ./sbin/firehol.in x.conf
>> FireHOL: Saving your old firewall to a temporary file: OK
>> FireHOL: Processing file x.conf: OK
>> FireHOL: Activating new firewall (52 rules):
>>
>> --------------------------------------------------------------------------------
>> ERROR   : # 1.
>> WHAT    : A runtime command failed to execute (returned error 2).
>> SOURCE  : line 3 of x.conf
>> COMMAND : /sbin/ip6tables -t filter -A in_any_ssh_s4 -p tcp -s
>> 1.2.3.4\,5.6.7.8\,192.168.1.0/24 --sport 1024:65535 --dport 22 -m
>> conntrack --ctstate NEW\,ESTABLISHED -j ACCEPT
>> OUTPUT  :
>>
>> ip6tables v1.4.14: host/network `1.2.3.4' not found
>> Try `ip6tables -h' or 'ip6tables --help' for more information.
>>
>>
>>
>> --------------------------------------------------------------------------------
>> ERROR   : # 2.
>> WHAT    : A runtime command failed to execute (returned error 2).
>> SOURCE  : line 3 of x.conf
>> COMMAND : /sbin/ip6tables -t filter -A out_any_ssh_s4 -p tcp --sport 22
>> -d 1.2.3.4\,5.6.7.8\,192.168.1.0/24 --dport 1024:65535 -m conntrack
>> --ctstate ESTABLISHED -j ACCEPT
>> OUTPUT  :
>>
>> ip6tables v1.4.14: host/network `1.2.3.4' not found
>> Try `ip6tables -h' or 'ip6tables --help' for more information.
>>
>>  FAILED
>>
>>
>> FireHOL: Restoring old firewall: OK
>>
>> Is there some weird character after your 192.168.1.0/24? There is also
>> an extra backslash in the error command that you showed:
>>
>> > ERROR   : # 1.
>> > WHAT    : A runtime command failed to execute (returned error 2).
>> > SOURCE  : line 16 of /etc/firehol/firehol.conf
>> > COMMAND : /sbin/iptables -t filter -A in_world_ssh_s2 -p tcp -s 1.2.3.4\,5.6.7.8\,192.168.1.0/24\ --sport 1024:65535 --dport 22 -m conntrack --ctstate NEW\,ESTABLISHED -j ACCEPT
>> > OUTPUT  :
>>
>> > iptables v1.4.4: host/network `1.2.3.4,5.6.7.8,192.168.1.0/24' not found
>> > Try `iptables -h' or 'iptables --help' for more information.
>>
>>
>> Cheers
>> Phil
_______________________________________________
Firehol-support mailing list
[email protected]
http://lists.firehol.org/mailman/listinfo/firehol-support