Firewall issues

Trey Gruel <[email protected]>
Newsgroups gmane.linux.redhat.release.enigma
Message-ID <[email protected]>
I've set up a iptables firewall on my RH7.2 box, but I'm running into an 
odd problem.  After I set up the firewall, everything works fine for a 
few hours.  But after a while (not sure the exact amount of time), the 
computer stops responding to requests on the open ports.  Looking at the 
output from iptables -vL, I can see the requests coming in and passing 
the appropriate rule, but then nothing happens (almost as if the packet 
is dropped).  Here is the firewall as I have it set up:

iptables -P INPUT DROP

# create our own chains
iptables -N allow
iptables -N block
iptables -N logdrop

# what to allow
iptables -A allow -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A allow -m state --state NEW -i ! eth0 -j ACCEPT  # allow lan
iptables -A allow -p icmp -j ACCEPT                     # pings, 
traceroute, etc
iptables -A allow -p tcp --dport ssh -j ACCEPT          # ssh
iptables -A allow -p tcp --dport ftp -j ACCEPT          # ftp
iptables -A allow -p tcp --dport 62000:64000 -j ACCEPT  # passive ftp

# explicit blocks
# netbios broadcasts..  no point in filling the logs with them
iptables -A block -p tcp -i eth0 --dport 137:139 -j DROP
iptables -A block -p udp -i eth0 --dport 137:139 -j DROP

# log and drop
iptables -A logdrop -p tcp -m limit --limit 3/s -j LOG --log-level 6 
--log-prefix "TCP Dropped: "
iptables -A logdrop -p udp -m limit --limit 3/s -j LOG --log-level 6 
--log-prefix "UDP Dropped: "
iptables -A logdrop -p icmp -m limit --limit 3/s -j LOG --log-level 6 
--log-prefix "ICMP Dropped: "
iptables -A logdrop -f -m limit --limit 3/s -j LOG --log-level 6 
--log-prefix "FRAGMENT Dropped: "
iptables -A logdrop -j DROP

# set the user defined in INPUT
iptables -A INPUT -j allow
iptables -A INPUT -j block
iptables -A INPUT -j logdrop

The machine has 3 ethernet cards (one not being used).  eth0 is the 
connection to the outside world and eth1 is on the local lan.  I set up 
the block chain because I was getting so many NETBIOS hits it was 
rediculous.  I have tried changing the INPUT tables policy to ACCEPT, 
but it still doesn't work..

Any help would be greatly appreciated.

-- 
Trey Gruel
[email protected]
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.