Topic: Converting a rule from ipfwadm to iptables

[Franco]

Here's one to the iptables experts:
I need to convert the following rule, which comes from a debian installation, to iptables on the SME box:

ipfwadm -F -i accept -m -P tcp -S 10.0.0.0/8 1024:65535 -D 200.201.174.0/24) 80

Any help is appreciated.

[Franco]

Correct me if I'm wrong:
- I created a custom template in:
/etc/e-smith/templates-custom/etc/rc.d/init.d/masq/
and named it :
41AllowEstablishedin:

/sbin/iptables -A INPUT -p tcp --dport 80 -s 200.201.174.0/24 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -m tcp --dport 80 -j ACCEPT

then:
expanded the template:
/sbin/e-smith/expand-template /etc/rc.d/init.d/masq

Then restarted it:
service masq restart

[Franco]

Anyone?!
 

[arne]

Will not say anything about the other problems, without testing, but the iptabels rules:

/sbin/iptables -A INPUT -p tcp --dport 80 -s 200.201.174.0/24 -j ACCEPT

OK this seems to be a iptables rule that will accept http clients from the 200.201.174.0 network only.


/sbin/iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -m tcp --dport 80 -j ACCEPT

This last rule does not give any sence at all. It will open for return trafick on port 80 for internal clients, but there is no clients that will require return to port 80.

If the rule 2 was ment to play together with rule 1, you should rather set the output chain open. (Dont know how this is set as default at the sme server.)

You does not say anything if it is a firewall gateway installation or a server only.

Explain eventually what the iptables rule no 2 is ment to do.

[Franco]

Thanks for the reply arne,
I'm by no means an expert, so forgive me on the mistakes.
I'm using server-gateway mode and I need to create a rule where the clients behind the SME server will freely communicate with the IP range 200.201.174.0/24.
 This range is from a bank and they're using an Applet called PrivateWire. When computers behind SME try the connection, it does not work. If I plug the system directly to the ADSL, everything works fine.
When I researched about the problem, I discovered that this rule (used on Debian distribution) works:

ipfwadm -F -i accept -m -P tcp -S 10.0.0.0/8 1024:65535 -D 200.201.174.0/24) 80

.
So I'm trying to accomplish the same, and took this thread as example:
http://forums.contribs.org/index.php?topic=26920.msg110373#msg110373

Thank for the help,
Regards,

[CharlieBrady]

Correct me if I'm wrong:
- I created a custom template in:
/etc/e-smith/templates-custom/etc/rc.d/init.d/masq/
and named it :
41AllowEstablishedin:

/sbin/iptables -A INPUT -p tcp --dport 80 -s 200.201.174.0/24 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -m tcp --dport 80 -j ACCEPT

Two problems here:

1. TCP access to port 80 is already permitted from all addresses.

2. There is already a rule to allow all ESTABLISHED,RELATED packets.

If you can fully explain your problem, then someone might be able to help you diagnose the problem and find the best fix. I suspect it might have something to do with squid acting as a transparent proxy. You could test that theory by disabling the transparent proxy - there's instructions here on how to do it (you'll need to search).

[arne]

First of all, let me mention that I have no idea at all how the sme firewall is configured, even though I have used the sme server for some years. Reason - I never use preconfigured firewall rules on the sme or any other Linux, I like to know how they work, so I like to set up the configuration myself. (Even though I'm quite sure many of the preconfigured firewalls has a bether configuration than I can make. At least I know the weaknesses when I make them my self and I have the fun of making it.)

Generally, I think it is not a good idea to try to modify an existing firewall when you dont know how it work as a whole. This is much like modifying a window in a house you have not seen yet. Wery often the result will be something else than you expected, and generally - "something else" works bad for secyrity. In the best case it don't work at all.

Don't know much about the earlier generations of Linux firewall than IPTABLES, but could still try to translate a little bit, as things seems to be a little bit like the IPTABLES (Kernel 2.4.x and 2.6.x)

http://man.he.net/man8/ipfwadm

ipfwadm -F -i accept -m -P tcp -S 10.0.0.0/8 1024:65535 -D 200.201.174.0/24) 80

ipfwadmin
-F forwarding chain
-i insert, set the rule at the top of the stack.
accept
-m match
-P protocoll
tcp
-S source
10.0.0.0/8 networknumber
1024:65535 specifying portnumber for trafic from that network
-D destignation
200.201.174.0/24 that network
80 portnumber

Look like a little bit strange rule because it looks like it restricts the trafic out from the lan to only one certain network (200.201.174.0/24) Can this be right ? (Unless there is some other rules that does something else.)

By the way these rules:

/sbin/iptables -A INPUT -p tcp --dport 80 -s 200.201.174.0/24 -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -m tcp --dport 80 -j ACCEPT

Has absolutely nothing to do with the trafick between lan clients and Internet, they will open for trafick to and from internal processes on the gateway server only.

As mentioned, I have no idea how the sme firewall works or how it is configurated, but the "usual way" to configure a Linux gateway is to allow all trafic out. If it is set up as a transparent proxy, I think it is likely to believe that a communcation problem out from the lan to some external internet located server is related to this proxy.

Personally I am not so happy with the "transparent proxy prinsipple" because of this potensial issue. I think that you should allways have the oportunity of turning a proxy off. (Can it eventuelly be turned off at the sme server ?, I don't know.)

Please conform if there really should be a rule that restricts the trafic out to only one network like the ipfwadm rule seems to do .. or if it only a question of opening for some certain trafic out to this server (in addition to all other trafic.

By the way the -A append optin in iptables set a new rule at the end of a chain where it will often not work. -I set a new rule at the top of a chain where it will work, but not neccessarly like expected.

To make changes of a firewall you shoul know all about it, and if the problem should happen to be a proxy problem and not really a firewall problem, it should be solved like that.

Arne.

[Franco]

Thank you both Charlie and Arne, disabling the proxy did the trick!
The only thing is that I cannot disable it for an specific IP within the LAN only, I have to do for the entire network  
# /sbin/e-smith/db configuration setprop squid Transparent no
# /sbin/e-smith/signal-event console-save
# /sbin/e-smith/expand-template /etc/rc.d/init.d/masq
# /sbin/e-smith/expand-template /etc/squid/squid.conf
# service masq restart

[arne]

If you have enabled it for all by disabling the proxy it should be possible to disable it for individual pc's using a filtering rule at the top of the top of the forward rule stack.

I have not tested this with the default sme server firewall, but it sholud be possible to make some experiments on that.

The principples should be described in this question:
http://forums.contribs.org/index.php?topic=27299.0

Arne.

[arne]

The filtering must eventuelly be done trough the forwarding and not the input or the output chain, for example like this:

iptables -I FORWARD -i eth1 -p tcp --dport 80 -s 10.0.0.54/24 -j DROP

eth1 is in this case the network card connected to the LAN. 10.0.0.54 is the ip of the PC that should be blocked.

It's not for shure that it will work because it depends on the firewall design as a whole, but it could be tried.

If you try it out as shell commands you can just reboot and the new rule will be gone.

To get some impressin if the new rule is adapted:

iptables -t nat -L

iptables -L


Arne.