Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have Ubuntu 12.04 x64 installed in my laptop.

I'm quite new to linux, and I wanted to specify certain rules for the iptables firewall.

This is the saved config of my iptables:


*mangle

:PREROUTING ACCEPT [0:0]

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

COMMIT


*nat

:PREROUTING ACCEPT [0:0]

:INPUT ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

-A PREROUTING -p tcp -m tcp --dport 3306 -j DNAT --to-destination 192.168.1.100:3306

-A PREROUTING -p tcp -m tcp --dport 11002 -j DNAT --to-destination 192.168.1.100:11002

-A PREROUTING -p tcp -m tcp --dport 13000 -j DNAT --to-destination 192.168.1.100:13000

-A PREROUTING -p tcp -m tcp --dport 13001 -j DNAT --to-destination 192.168.1.100:13001

-A PREROUTING -p tcp -m tcp --dport 13002 -j DNAT --to-destination 192.168.1.100:13002

-A PREROUTING -p tcp -m tcp --dport 13003 -j DNAT --to-destination 192.168.1.100:13003

-A PREROUTING -p tcp -m tcp --dport 13004 -j DNAT --to-destination 192.168.1.100:13004

-A PREROUTING -p tcp -m tcp --dport 13061 -j DNAT --to-destination 192.168.1.100:13061

-A PREROUTING -p tcp -m tcp --dport 13099 -j DNAT --to-destination 192.168.1.100:13099

-A POSTROUTING -j MASQUERADE

COMMIT


*filter

:INPUT DROP [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -i eth0 -p tcp -m tcp --dport 3306 -j ACCEPT


-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
COMMIT

In theory, what it does is to drop all connections in all ports except for http, mysql and few other ports.

Moreover, it redirects all mysql and 13000-13004..etc port connections to a specific local ip in the same port, which is 192.168.1.100.

But what I find strange is that when my firewall is active, it blocks absolutely all the input connections, even those which must not block (http, mysql). In fact, I'm literally blocked and I can't establish any external connection.

What am I doing wrong?

PS: I tested the firewall without those redirections, and it still block all inputs, so I suppose it's not the problem.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

first and for all you need to check if forwarding packets is allowed on your system:

cat /proc/sys/net/ipv4/ip_forward

or

sysctl ipv4_forward

This should have the value of '1'. if not (sudo or as root):

echo '1' > /proc/sys/net/ipv4/ip_forward

and to make the change permanent you can uncomment net.ipv4.ip_forward=1 in /etc/sysctl.conf. Once this has been done you can further test your iptables settings (I presume that it will work after that minor change ;-)). Since you said that you where new to this I've placed a description of the rule under each rule hoping it all makes a bit sense to you.

iptables -P INPUT DROP
iptables -A OUTPUT ACCEPT
iptables -A FORWARD ACCEPT

This will drop all traffic except traffic that matches the rules that are defined. -P INPUT DROP can be stated as the first rule whereas -A INPUT DROP has to be the last. The next 2 rules will allow outgoing connections and forwarding.

iptables -A INPUT -i lo -j ACCEPT

Allow loopback (127.0.0.1) traffic

iptables -A INPUT -m state --state RELEATED,ESTABLISHED -j ACCEPT

This will allow all packets that have state RELATED (A new secondary connection f.e. FTP) or ESTABLISHED (packets for this connection has been seen in both directions f.e. HTTP traffic).

iptables -t nat -A POSTROUTING -o ethx -j MASQUERADE

nat because you probably are natting , masquerade the packet going OUT of interface ethx. F.e.: WAN side is on eth1 and lan on eth0 so ethx would be eth0. This is on the POSTROUTING.

iptables -t nat -A PREROUTING -p tcp --dport 3306 -j DNAT --to-destination 192.168.1.100:3306

this is the actual forwarding.

So basicly your iptables rules where OK, you probably just forgot the ip_forward setting.

share|improve this answer
    
Thank you very much Goez, that was the problem. The reason I didn't check it was because I did change it to 1 the day before. What I didn't know is the fact that this setting became 0 again after rebooting. Now I've made a script that does it for me each time I boot. Thanks again! –  user109985 Nov 23 '12 at 13:12
    
@user109985 A common approach would be putting net.ipv4.ip_forward=1 in /etc/sysctl.conf so that it survives after rebooting. –  Terry Wang Aug 30 '13 at 1:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.