Re: custom rule applied but resulting iptables are strange
"Tsaousis, Costa" <[email protected]> Mon, 28 Mar 2016 22:34:49 +0300
| Newsgroups | gmane.comp.security.firewalls.firehol.user |
|---|---|
| Message-ID | <CANL+VpaopEA_KaMbB-dfcRrVAty7ZtqidUJ2yJc4jLpuXxMBNA@mail.gmail.com> |
Hi, Try running: iptables -nxvL or firehol status These statements have additional parameters which are not shown by default. Also, run: firehol explain and then issue the configuration commands one by one. FireHOL will show you the commands it generates (with comments about each and every one). Costa On Mon, Mar 28, 2016 at 10:04 PM, Wojtek Swiatek <[email protected]> wrote: > Hello > > I wanted to try a custom rule on my firehol setup: > > router EVERYTHING > # LAN > server all accept inface lan0 outface int0 custom '-m time > --timestart 6:00 --timestop 19:00' > server all accept inface lan0 outface br1 > server all accept inface lan0 outface br2 > # Minecraft > server minecraft accept inface int0 outface br2 > server minecraft accept inface lan0 outface br2 > server all accept inface br2 outface int0 > # openvpn container, only via openvpn > server openvpn accept inface br1 outface int0 > # openvpn server > server all accept inface tun0 outface lan0 > server all accept inface tun0 outface int0 > > The idea was that traffic from lan0 to int0 should be restricted to the day > > The restriction did not work (it finally worked - it was my mistake, I > forgot that I should have used UTC which is 2 hours behind my location) and > I had a look at iptables -L, the result is quite surprising. Doesn't it > mean that all traffic is allowed, no matter the interface? > As an example the line > ACCEPT all -- anywhere anywhere ctstate > NEW,ESTABLISHED > is repeated several times, without any information on the interface. Is > this normal? > Where is the information about which interface filters which traffic? > > Chain in_EVERYTHING (1 references) > target prot opt source destination > ACCEPT all -- anywhere anywhere ctstate > NEW,ESTABLISHED TIME from 06:00:00 to 19:00:00 UTC > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED TIME from 06:00:00 to 19:00:00 UTC helper match "ftp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED TIME from 06:00:00 to 19:00:00 UTC helper match "irc" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED TIME from 06:00:00 to 19:00:00 UTC helper match "sip" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED TIME from 06:00:00 to 19:00:00 UTC helper match "pptp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED TIME from 06:00:00 to 19:00:00 UTC helper match > "proto_gre" > ACCEPT all -- anywhere anywhere ctstate > NEW,ESTABLISHED > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "ftp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "irc" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "sip" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "pptp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "proto_gre" > ACCEPT all -- anywhere anywhere ctstate > NEW,ESTABLISHED > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "ftp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "irc" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "sip" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "pptp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "proto_gre" > ACCEPT tcp -- anywhere anywhere tcp > spts:1024:65535 multiport dports 9000,25565 ctstate NEW,ESTABLISHED > ACCEPT tcp -- anywhere anywhere tcp > spts:1024:65535 multiport dports 9000,25565 ctstate NEW,ESTABLISHED > ACCEPT all -- anywhere anywhere ctstate > NEW,ESTABLISHED > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "ftp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "irc" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "sip" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "pptp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "proto_gre" > ACCEPT tcp -- anywhere anywhere tcp > spts:1024:65535 dpt:openvpn ctstate NEW,ESTABLISHED > ACCEPT udp -- anywhere anywhere udp > spts:1024:65535 dpt:openvpn ctstate NEW,ESTABLISHED > ACCEPT all -- anywhere anywhere ctstate > NEW,ESTABLISHED > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "ftp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "irc" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "sip" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "pptp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "proto_gre" > ACCEPT all -- anywhere anywhere ctstate > NEW,ESTABLISHED > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "ftp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "irc" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "sip" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "pptp" > ACCEPT all -- anywhere anywhere ctstate > RELATED,ESTABLISHED helper match "proto_gre" > ACCEPT icmp -- anywhere anywhere ctstate > RELATED > ACCEPT tcp -- anywhere anywhere ctstate > RELATED tcp flags:FIN,SYN,RST,PSH,ACK,URG/RST,ACK > _______________________________________________ > Firehol-support mailing list > [email protected] > http://lists.firehol.org/mailman/listinfo/firehol-support _______________________________________________ Firehol-support mailing list [email protected] http://lists.firehol.org/mailman/listinfo/firehol-support