Re: iptables & port redirects

From: Micheal Robert Zium (mrozium_at_XSPAMX-yahoo.com)
Date: 05/13/04 

Date: 13 May 2004 00:24:29 -0500

Michael wrote:

>"Micheal Robert Zium" <mrozium@XSPAMX-yahoo.com> wrote in message
>news:1100931096.41fd41d0@spam-sucks...
>>
>> What is your default FORWARD policy?
>> How are you testing your rules?
>> Is there any other rules before these that may match incoming http
>> requests?
>> What do your logs show?
>
>My default forward rule is drop
>
>yeah i have a cpl rules, my firewall script is below, any ideas greatly
>appreciated :) thanks

I'm not really sure where to begin. Let me give you an example from
one of my firewalls:

iptables -A PREROUTING -t nat -p tcp -i eth0 -d $extip --dport 80 \
-j DNAT --to 192.168.112.221:80
iptables -A FORWARD -d 192.168.112.221 -p tcp --dport 80 -j LOG \
--log-prefix "http " --log-level debug
iptables -A FORWARD -p tcp -d 192.168.112.221 --dport 80 -j ACCEPT

You also need a final drop rule for your forward chain, and log those
hits. Then, by testing with an external (not on your LAN or firewall)
host, you can tell what is and isn't working. You can even "cheat" a
bit by using a so-called online security scanner that probes port 80.

I hope you don't get offended, but IMHO, your rules really need a
complete re-write. There are a few things that are there that
shouldn't be, and a few things you need that aren't there. I wish I
had time to help you sort it all out.

Relevant Pages

  • Re: [fw-wiz] Firewall policy generator, capture based - Any idea?
    ... I want to capture my Data Center traffic, with a NAM or Sniffer. ... Basically a packetflow capture based firewall rules generator. ... Put the firewall in place with a policy that allows all traffic to ... Analyze logs. ...
    (Firewall-Wizards)
  • Re: Strange WAN Activity
    ... > firewall logs for a possible TCP FIN scan that keeps ... > company's intranet server IP and its port 80 across our ... > My firewall is a Sonicwall Pro 200 and I'm running W2K ... It's difficult to be sure without inspecting the web server for signs of ...
    (microsoft.public.win2000.security)
  • Re: Winvnc hack! [25 KB]
    ... came in from a service such as IIS that logs IP address. ... Check your IIS ... Some firewall software such as ... You can also use the NETSTAT -A command that comes with Windows to look at ...
    (microsoft.public.win2000.security)
  • Re: [fw-wiz] httport 3snf
    ... > Having worked in the Firewall support role at several companies, ... I had my CIO approve my security policy. ... time educating him about Internet risk. ... There's also a very good "at what point is the firewall now useless" ...
    (Firewall-Wizards)
  • RE: Sandboxing
    ... the 3Com Embedded Firewall would be extremely useful and enabling (in ... your case) when you look at it in a VPN context. ... This security policy will accomplish quite a few things: ... During the Policy Server installation, ...
    (Focus-IDS)