[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: iptable in fc5



>> I don't know if the output of tcpdump -nn helps or not:
>> ...
>> 16:02:40.803697 IP 128.252.85.35.22 > 128.252.85.103.2167: P
> <snip />
>
> oooh :(  SSH makes alot of noise.  Not too useful this way.
>
>> Here is iptables-save output:
>>
>> # Generated by iptables-save v1.3.5 on Mon May 15 15:59:18 2006
>> *filter
>> :INPUT ACCEPT [0:0]
>> :FORWARD ACCEPT [0:0]
>> :OUTPUT ACCEPT [0:0]
>> :RH-Firewall-1-INPUT - [0:0]
>> :okay - [0:0]
>> -A INPUT -j RH-Firewall-1-INPUT
>> -A FORWARD -j RH-Firewall-1-INPUT
>> -A OUTPUT -s 127.0.0.1 -j ACCEPT
>> -A OUTPUT -s 128.252.85.35 -j ACCEPT
>> -A RH-Firewall-1-INPUT -s 127.0.0.1 -i lo -j ACCEPT
>> -A RH-Firewall-1-INPUT -s 128.252.85.35 -i lo -j ACCEPT
>> -A RH-Firewall-1-INPUT -i lo -j ACCEPT
>> -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
>> -A RH-Firewall-1-INPUT -p ipv6-crypt -j ACCEPT
>> -A RH-Firewall-1-INPUT -p ipv6-auth -j ACCEPT
>> -A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
>> -A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
>> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
>> tcp
>> --dport 21 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
>> tcp
>> --dport 22 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
>> tcp
>> --dport 25 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
>> tcp
>> --dport 80 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m
>> udp
>> --dport 137 -j ACCEPT
>> -A RH-Firewall-1-INPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m
>> udp
>> --dport 139 -j ACCEPT
>> -A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -p tcp -m state --state
>> NEW,RELATED,ESTABLISHED -m tcp --dport 2049 -j ACCEPT
>> -A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -p udp -m state --state
>> NEW,RELATED,ESTABLISHED -m udp --dport 2049 -j ACCEPT
>> -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
>> -A okay -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
>> -A okay -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
>> COMMIT
>> # Completed on Mon May 15 15:59:18 2006
>>
>> I just added udp for nfs port, but still the same problem.
>>
>
> Ok.  Just looked through your "iptables-save".  There is some
> duplication but nothing that I can see that is wrong.
>
> Since you are hitting the REJECT you are not matching a previous rule.
>  From what I can see, the rules must be failing because
>    a) source address/mask isn't what is being used;
>    b) port number is not the one being used.
>
> If you use "tcpdump -nn port ! ssh" while you try using nfs you should
> receive something more useable.
>

Here it is:

# tcpdump -v -nn port ! ssh
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:44:14.724722 IP (tos 0x0, ttl 128, id 673, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:15.474700 IP (tos 0x0, ttl 128, id 708, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:15.657608 IP (tos 0xc0, ttl   2, id 0, offset 0, flags [none], proto:
UDP (17), length: 48) 128.252.85.250.1985 > 224.0.0.2.1985: HSRPv0-hello 20:
state=active group=85 addr=128.252.85.254 hellotime=3s holdtime=10s
priority=110 auth="cisco^ ^@^@"
16:44:15.673489 IP (tos 0x0, ttl   1, id 17732, offset 0, flags [none], proto:
IGMP (2), length: 40, options ( RA (148) len 4 )) 128.252.85.91 > 224.0.0.22:
igmp v3 report, 1 group record(s) [gaddr 239.255.255.250 to_in, 0 source(s)]
16:44:15.903332 802.1d config 8055.00:0d:65:75:74:80.8006 root
2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15
16:44:16.187422 arp who-has 128.252.85.40 tell 128.252.85.189
16:44:16.215126 arp who-has 128.252.85.88 tell 128.252.85.189
16:44:16.224694 IP (tos 0x0, ttl 128, id 735, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:16.338898 IP (tos 0x0, ttl   1, id 17733, offset 0, flags [none], proto:
IGMP (2), length: 40, options ( RA (148) len 4 )) 128.252.85.91 > 224.0.0.22:
igmp v3 report, 1 group record(s) [gaddr 239.255.255.250 to_in, 0 source(s)]
16:44:17.099723 IP (tos 0x0, ttl 128, id 749, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:17.849770 IP (tos 0x0, ttl 128, id 851, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:17.905851 802.1d config 8055.00:0d:65:75:74:80.8006 root
2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15
16:44:18.569998 IP (tos 0xc0, ttl   2, id 0, offset 0, flags [none], proto:
UDP (17), length: 48) 128.252.85.250.1985 > 224.0.0.2.1985: HSRPv0-hello 20:
state=active group=85 addr=128.252.85.254 hellotime=3s holdtime=10s
priority=110 auth="cisco^ ^@^@"
16:44:18.587619 aarp who-has 85.4.9 tell 85.1.4
16:44:18.599725 IP (tos 0x0, ttl 128, id 873, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:19.009393
16:44:19.903665 802.1d config 8055.00:0d:65:75:74:80.8006 root
2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15
16:44:20.224157 et1 AT 85.4.9.1 > 0.0.1:  at-rtmp 232
16:44:20.225361 IP (tos 0x0, ttl 128, id 19752, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.66.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
...

I want to ask another question -- Why do we need the last line in the file
iptables:
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

If I comment it out, then everything works.  Will that cause firewall actually
not functioning?  In fc3,fc4 I don't see similar line in the default firewall
setting.  Something new in fc5?

Thanks!

Hongwei


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]