Re: iptables not forwarding certain ports

Rob D wrote:

> Hi there guys,
>
> I have setup a router box as per an article in atomicmpc and 
> everything is working fine bar one thing. I am trying to forward on 
> port 113 from eth1 (external) to eth0 (internal) but it just wont 
> carry through, no matter what i try. Below i will post the script i am 
> using, if you see whats wrong coul you please let me know.

G'day Rob,
To hazard a guess, I would imagine that the order of rules is the 
problem. You first define forwarding as to only ESTABLISHED, RELATED and 
then try to allow NEW packets but they have already been dropped by the 
first rule. Either move the 113 port rule above the initial rule in the 
script or use the -I (insert switch) INPUT 1 in the 113 port rule to 
make it the first rule in the chain...

>
> Thanks,
> Rob
> #!/bin/sh
> #
> # Atomic IPTables firewall script v1.2
> #
> # Simple but effective firewall written for
> # the Atomic Uber Linux box guide,
> # Issue 21, Oct 2002
> #
> # Updated May 2003 for bandwidth shaping
> #
> # Ashton Mills
> # [email protected]
>
> # Environment variables, change these values accordingly
>
> EXT_IF=eth1
> INT_IF=eth0
> INT_NET=192.168.1.0/24
>
> ANY=0.0.0.0/0
>
> IPTABLES=/sbin/iptables
> MODPROBE=/sbin/modprobe
>
> #
> ## You shouldn't need to touch anything below here
> #
>
> # Load appropriate iptables modules, others will be loaded dynamically 
> on demand
>
> $MODPROBE ip_tables
> $MODPROBE iptable_filter
> $MODPROBE ip_nat_ftp
> $MODPROBE ip_conntrack
> $MODPROBE ip_conntrack_ftp
>
> # Set proc values for TCP/IP. In order:
> #
> # Disable IP spoofing attacks
> # Ignore broadcast pings
> # Block source routing
> # Kill redirects
> # Set acceptable local port range
> # Allow dynamic IP addresses
> # Enable forwarding (gateway)
>
> echo "2" > /proc/sys/net/ipv4/conf/all/rp_filter
> echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
> echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
> echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
> echo "32768 61000" > /proc/sys/net/ipv4/ip_local_port_range
> echo "1" > /proc/sys/net/ipv4/ip_dynaddr
> echo "1" > /proc/sys/net/ipv4/ip_forward
>
> # Flush everything
>
> $IPTABLES -F INPUT
> $IPTABLES -F OUTPUT
> $IPTABLES -F FORWARD
> $IPTABLES -t nat -F
> $IPTABLES -t mangle -F
>
> #
> ## --- DEFAULT POLICY --- ##
> #
>
> # Drop everything on INPUT and FORWARD chains, accept OUTPUT
>
> $IPTABLES -P INPUT DROP
> $IPTABLES -P FORWARD DROP
> $IPTABLES -P OUTPUT ACCEPT
>
> #
> ## --- INPUT CHAIN --- ##
> #
>
> # Allow Telstra hearbeat -- BPA users uncomment this
>
> # $IPTABLES -A INPUT -p udp --sport 5050 -j ACCEPT
> # $IPTABLES -A INPUT -p udp --sport 5051 -j ACCEPT
>
>
> # Allow bootp port -- Optus and some ADSL users need this
>
> $IPTABLES -A INPUT -p udp -d 255.255.255.255 --dport 68 -j ACCEPT
>
>
> # Allow access to services on this (the gateway) machine
>
> # SSH
> $IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
>
> # Teamspeak
> # $IPTABLES -A INPUT -p udp --dport 8767 -j ACCEPT
>
> # Half Life server
> # $IPTABLES -A INPUT -p udp --dport 27015 -j ACCEPT
> # $IPTABLES -A INPUT -p udp --dport 27010 -j ACCEPT
>
> # FTP
> # $IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT
> # $IPTABLES -A INPUT -p tcp --dport 20 -j ACCEPT
>
> # Bittorrent
> # $IPTABLES -A INPUT -p tcp --dport 6881 -j ACCEPT
>
>
> # Accept all connections on local and internal interfaces
>
> $IPTABLES -A INPUT -i lo -j ACCEPT
> $IPTABLES -A INPUT -i $INT_IF -j ACCEPT
>
>
> # Stateful inspection -- Allow packets in from connections already 
> established
>
> $IPTABLES -A INPUT -i $EXT_IF -m state --state ESTABLISHED,RELATED -j 
> ACCEPT
>
>
> # Drop packets from invalid sources (reserved networks and localhost)
>
> $IPTABLES -A INPUT -i $EXT_IF -s 10.0.0.0/8 -j DROP
> $IPTABLES -A INPUT -i $EXT_IF -s 172.16.0.0/12 -j DROP
> $IPTABLES -A INPUT -i $EXT_IF -s 192.168.0.0/16 -j DROP
> $IPTABLES -A INPUT -i $EXT_IF -s 169.254.0.0/16 -j DROP
> $IPTABLES -A INPUT -d 127.0.0.0/8 -j DROP
>
>
> # Don't log igmp, web or ssl. More noise we don't need to log.
>
> $IPTABLES -A INPUT -p igmp -j DROP
> $IPTABLES -A INPUT -p tcp --dport 80 -j DROP
> $IPTABLES -A INPUT -p tcp --dport 443 -j DROP
>
>
> # Log everything else
>
> $IPTABLES -A INPUT -i $EXT_IF -j LOG --log-prefix "|iptables -- "
>
> #
> ## -- BANDWIDTH SHAPING  -- ##
> #
>
> #
> # EGRESS (upstream)
> #
>
> # TOS marked packets (we'll just work with minimise-delay and 
> maximise-throughput)
> $IPTABLES -t mangle -A POSTROUTING -m tos --tos Minimize-Delay -j MARK 
> --set-mark 10
> $IPTABLES -t mangle -A POSTROUTING -m tos --tos Maximize-Throughput -j 
> MARK --set-mark 30
>
> # UDP (most games, including all Half Life mods as well as DNS, IM 
> clients and more)
> $IPTABLES -t mangle -A POSTROUTING -p udp -j MARK --set-mark 10
>
> # Games that use DirectPlay from DirectX (note UDP traffic already 
> matched above)
> $IPTABLES -t mangle -A POSTROUTING -p tcp --dport 47624 -j MARK 
> --set-mark 10
> $IPTABLES -t mangle -A POSTROUTING -p tcp --dport 2300:2400 -j MARK 
> --set-mark 10
> $IPTABLES -t mangle -A POSTROUTING -p tcp --dport 2300:2400 -j MARK 
> --set-mark 10
>
> # Place other games here
> # EVE online
> # $IPTABLES -t mangle -A POSTROUTING -p tcp --dport 26000 -j MARK 
> --set-mark 10
>
> # ICMP (ping)
> $IPTABLES -t mangle -A POSTROUTING -p icmp -j MARK --set-mark 10
>
> # SSH
> $IPTABLES -t mangle -A POSTROUTING -p tcp --dport 22 -j MARK 
> --set-mark 10
>
> # Web, SSL
> $IPTABLES -t mangle -A POSTROUTING -p tcp --dport 80 -j MARK 
> --set-mark 20
> $IPTABLES -t mangle -A POSTROUTING -p tcp --dport 443 -j MARK 
> --set-mark 20
>
> # ACKs
> $IPTABLES -t mangle -A POSTROUTING -p tcp -m length --length :64 -j 
> MARK --set-mark 20
>
> #
> # No need for catchall for class 30, handled by HTB root qdisc 
> initilisation
> #
>
> #
> # INGRESS (downstream)
> #
>
> # Only prioritise class 10 traffic
>
> # Don't police high priority UDP, game, ping and SSH packets
> $IPTABLES -t mangle -A PREROUTING -p udp -j MARK --set-mark 10
> $IPTABLES -t mangle -A PREROUTING -p tcp --sport 47624 -j MARK 
> --set-mark 10
> $IPTABLES -t mangle -A PREROUTING -p tcp --sport 2300:2400 -j MARK 
> --set-mark 10
> $IPTABLES -t mangle -A PREROUTING -p tcp --sport 2300:2400 -j MARK 
> --set-mark 10
> $IPTABLES -t mangle -A PREROUTING -p icmp -j MARK --set-mark 10
> $IPTABLES -t mangle -A PREROUTING -p tcp --sport 22 -j MARK --set-mark 10
>
> # Place other games here
> # EVE online
> # $IPTABLES -t mangle -A PREROUTING -p tcp --sport 26000 -j MARK 
> --set-mark 10
>
> # Catchall, police everything else
> $IPTABLES -t mangle -A PREROUTING -m mark --mark 0 -j MARK --set-mark 30
>
> #
> # NOTE: It's a good idea -not- to add HTTP to be let through the 
> police filter even
> # for browsing as many P2P programs, not to mention your HTTP file 
> downloads, will
> # flood the link unpoliced, causing delays with high priority (class 
> 10) packets.
> # Shape HTTP going out, but let it be bulk coming in.
> #
> # Read the note at the end of the atomic.shaper script for more on 
> INGRESS shaping.
> #
>
> #
> ## --- FORWARD CHAIN --- ##
> #
>
> # Stateful inspection -- Forward in connections already established
>
> $IPTABLES -A FORWARD -i $EXT_IF -o $INT_IF -s $ANY -d $INT_NET -m 
> state --state ESTABLISHED,RELATED -j ACCEPT
>
>
> # Forwards for software running on Windows/Linux machines behind the 
> firewall
>
> # Kazaa Lite (change destination IP accordingly)
>
> # $IPTABLES -t nat -A PREROUTING -i $EXT_IF -p tcp --dport 1214 -j 
> DNAT --to-dest 192.168.1.10
> # $IPTABLES -A FORWARD -p tcp -i $EXT_IF --dport 1214 -d 192.168.1.10 
> -j ACCEPT
>
> # Bittorrent
>
> # $IPTABLES -t nat -A PREROUTING -i $EXT_IF -p tcp --dport 6881 -j 
> DNAT --to-dest 192.168.1.10
> # $IPTABLES -A FORWARD -p tcp -i $EXT_IF --dport 6881 -d 192.168.1.10 
> -j ACCEPT
> #        $IPTABLES -t nat -A PREROUTING -i $EXT_IF -p tcp --dport 113 
> -j DNAT --to-dest 192.168.1.3
> # $IPTABLES -A FORWARD -p tcp -i $EXT_IF --dport 113 -d 192.168.1.3 -j 
> ACCEPT
> # Forwards for hosting DirectPlay games
>
>        iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 113 -m state 
> --state NEW,ESTABLISHED -j ACCEPT
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 113 -j DNAT 
> --to-destination 192.168.1.3:113
> # iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 47624 -m state 
> --state NEW,ESTABLISHED -j ACCEPT
> # iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 47624 -j DNAT 
> --to-destination 192.168.1.10:47624
> # iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 2300:2400 -m 
> state --state NEW,ESTABLISHED -j ACCEPT
> # iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2300:2400 -j 
> DNAT --to-destination 192.168.1.10:2300-2400
> # iptables -A FORWARD -i eth0 -o eth1 -p udp --dport 2300:2400 -m 
> state --state NEW,ESTABLISHED -j ACCEPT
> # iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2300:2400 -j 
> DNAT --to-destination 192.168.1.10:2300-2400
>
>
> # Forward out all traffic
>
> $IPTABLES -A FORWARD -i $INT_IF -d $ANY -j ACCEPT
>
> #
> ## --- OUTPUT CHAIN --- ##
> #
>
> # Follows policy
>
> #
> ## --- NAT --- ##
> #
>
> # Enable masquerade
>
> $IPTABLES -A POSTROUTING -t nat -o $EXT_IF -j MASQUERADE
>
> #
> ## -- Transparent proxy to Squid --- ##
> #
>
> $IPTABLES -t nat -A PREROUTING -i $INT_IF -p tcp --dport 80 -j 
> REDIRECT --to-port 3128
>
>
>
>
> _______________________________________________
> Melbourne Linux Users Group (Australia)
> Edit your settings: http://lists.mlug.org.au
> Are you an Open Source Developer? Look at:
> Oracle SPACE Sweepstakes - http://www.mlug.org.au/oracle.php
>