Subj : iptables and forwarding woes
To   : comp.os.linux
From : jblackb
Date : Thu Jun 17 2004 08:38 am

hello!

i'm having a problem with getting port 5000 to forward to the same
port on another linux machine.  here is my set-up as best i can
describe it (i'm an intern and still struggling to learn linux,
iptables, vpn, etc etc etc etc)

remote comp => internet => firewall1 (linux sandbox) => firewall2
(main linux box) => network

i'm trying to create a vpn tunnel and had it up and working before we
put the sandbox in place.  but now i cant gett the main linux box to
communicate with the remote because of having to go through the linux
sandbox.  both ends of my vpn are  just hanging waiting for a
response.  so i think im problem lies somewhere in firewall1.  i cant
figure out just the right combo to get the info to flow through. 
could anyone take a look at my conf files and see if they can discover
the problem?  many many thanks in advance!

*the girl that knows nothing of linux but is trying to learn*  ~jess


iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t mangle
iptables -F -t nat
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
#
# 1.1 Internet Configuration.
#
 
INET_IP="68.76.9.20"
INET_IFACE="eth1"
INET_BROADCAST="68.76.9.255"
 
LAN_IP="10.x.x.x"
LAN_IP_RANGE="10.255.x.x/x"
LAN_IFACE="eth0"

 
LO_IFACE="lo"
LO_IP="127.0.0.1"
 

 
IPTABLES="/sbin/iptables"

/sbin/depmod -a
 
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state

 
echo "1" > /proc/sys/net/ipv4/ip_forward

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

$IPTABLES -N bad_tcp_packets
 
$IPTABLES -N allowed
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets
 
 
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \-m
state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j
LOG \--log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j
DROP
  
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j
ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
 
 
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed
 
$IPTABLES -A tcp_packets -p TCP -s 0/0 --destination-port 80 -j
allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed
 

 
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 2074 -j
ACCEPT
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 4000 -j
ACCEPT
 

 
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d $INET_BROADCAST
--destination-port 135:139 -j DROP
 
 
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
 

$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
 
 
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT

 
#$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j
ACCEPT
 
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
 
 
$IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP
 
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG
\--log-level DEBUG --log-prefix "IPT INPUT packet died: "
 
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
$IPTABLES -A FORWARD -p tcp --source-port 3000 -j DROP
$IPTABLES -A FORWARD -p tcp --destination-port 3000 -j DROP
$IPTABLES -A FORWARD -p tcp --source-port 4899 -j DROP
$IPTABLES -A FORWARD -p tcp --destination-port 4899 -j DROP
$IPTABLES -A FORWARD -p tcp -i eth1  --destination-port 5000 -j ACCEPT
 
 
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
 

$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG
\--log-level DEBUG --log-prefix "IPT FORWARD packet died: "

 
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
 
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT
 
 
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG
\--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
 
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source
$INET_IP
# 
iptables -t nat -A POSTROUTING -s 10.1.50.0/255.255.255.0 -o eth1 -j
MASQUERADE
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 5000 -j DNAT --to
10.1.1.245:5000
 
 
# Keep state of connections from local machine and private subnets
iptables -A OUTPUT -m state --state NEW -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
 
# Firewall settings for VPN
#$IPTABLES -A INPUT -i eth1 -d 0/0 -p tcp --dport 5000 -j ACCEPT
#$IPTABLES -t nat -A PREROUTING -i eth1 -p tcp --dport 5000 -j DNAT
--to 10.1.1.245
##$IPTABLES -A tcp_packets -p TCP -i eth1 -s 0/0 --dport 5000 -j
ACCEPT
##$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 5000 -j
ACCEPT

.