Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm a newbie at ubuntu's administration although I've been using linux for a while just at user level. Let's show my problem.

This is my network (only static IP addresses are used, for both private and public ones):

LAN1: 128.100.100.0/24

|

|

L_____128.100.100.30

Router

L_____192.168.110.1

|

|

LAN2: 192.168.110.0/24

|

|

L__ Linux box ubuntu server 14.04 named atlas: 2 Ethernet interfaces

L__ eth0: Internet 193.144.186.15/24 (default gateway is 193.144.186.1)

L__ eth1: LAN 192.168.110.11/24

Iptables are used to configure atlas's firewall. All communications between LAN2 and atlas or LAN2 and Internet work out fine. No routes are defined via the route command.

The issue is as follows:

A single ping sent from host 128.100.100.1 (remote1) to 192.168.110.11 (atlas's eth1) doesn't work. Actually, the ICMP request correctly arrives atlas's eth1 interface (I checked with wireshark at eth1), but no ICMP reply is sent from atlas to remote1.

However, if one route is added in atlas, the ping request is correctly replied. Here is the route (informing about which is the router to reach the inner 128.100.100.0 network from atlas):

route add -net 128.100.100.0/24 gw 192.168.110.1 dev eth1

You may say that, if it works, it all is ok, but my challenge is not to use the routecommand, but to use only iptables rules to make things work between both LANs (128.100.100.0 and 192.168.110.0 network). My iptables rules are based on an example by Oskar Andreasson at https://www.frozentux.net/iptables-t...c.firewall.txt

My question is: is it possible to achieve what I want using only iptables? Or is it impossible and Imust use route command?

Here it is the iptables script executed on boot.

Thank you.

Rober

# Reset tables/chains/rules
$IPTABLES -F
$IPTABLES -X
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES -t mangle -F
$IPTABLES -t mangle -X

# 4.1.1 Set policies

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

# 4.1.2 Create userspecified chains

$IPTABLES -N bad_tcp_packets
$IPTABLES -N allowed
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets

# 4.1.3 Create content in userspecified chains

# bad_tcp_packets chain
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset 
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

# allowed chain
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP

# TCP rules

#FTP
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed
#SSH
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed
#HTTP
#$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed
#WebMin
$IPTABLES -A tcp_packets -p TCP -s 192.168.0.0/16 --dport 10000 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 193.144.201.0/24 --dport 10000 -j allowed
# Samba TCP ports: 139, 445 (from inner LAN)
$IPTABLES -A tcp_packets -m state --state NEW -m tcp -p TCP -s 192.168.0.0/16 --dport 139 -j ACCEPT
$IPTABLES -A tcp_packets -m state --state NEW -m tcp -p TCP -s 192.168.0.0/16 --dport 445 -j ACCEPT
# Samba TCP ports: 139, 445 (from Internet)
$IPTABLES -A tcp_packets -m state --state NEW -m tcp -p TCP -s 193.144.201.0/24 --dport 139 -j ACCEPT
$IPTABLES -A tcp_packets -m state --state NEW -m tcp -p TCP -s 193.144.201.0/24 --dport 445 -j ACCEPT

# UDP ports

# Samba UDP ports: 137, 138 (from inner LAN)
$IPTABLES -A udp_packets -p UDP -m udp -s 192.168.0.0/16 --dport 137 -j ACCEPT
$IPTABLES -A udp_packets -p UDP -m udp -s 192.168.0.0/16 --dport 138 -j ACCEPT
# Samba UDP ports: 137, 138 (from Internet)
$IPTABLES -A udp_packets -p UDP -m udp -s 193.144.201.0/24 --dport 137 -j ACCEPT
$IPTABLES -A udp_packets -p UDP -m udp -s 193.144.201.0/24 --dport 138 -j ACCEPT

# Accept echo request
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
# Accept TTL Exceeded
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

# 4.1.4 INPUT chain
# Bad TCP packets we don't want.$IPTABLES -A INPUT -p tcp -j bad_tcp_packets

# Rules for special networks not part of the Internet
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN1_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN2_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT

# Special rule for DHCP requests from LAN, which are not caught properly
# otherwise.
$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT

# Rules for incoming packets from the internet.
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets

# Log weird packets that don't match the above.
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level 7 --log-prefix "IPT INPUT packet died: "

# 4.1.5 FORWARD chain

# Bad TCP packets we don't want
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets

# Accept the packets we actually want to forward
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Log weird packets that don't match the above.
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level 7 --log-prefix "IPT FORWARD packet died: "

# 4.1.6 OUTPUT chain

# Bad TCP packets we don't want.
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets

# Special OUTPUT rules to decide which IP's to allow.#$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT

# Log weird packets that don't match the above.
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level 7 --log-prefix "IPT OUTPUT packet died: "

# 4.2 nat table

# 4.2.4 PREROUTING chain

# DNS (from 192.168.0.0/16 or 128.100.100.0/24)
$IPTABLES -t nat -A PREROUTING -i $LAN_IFACE -p UDP -s 0/0 --destination-port 53 -j DNAT --to-destination $DNS_SERVER

# 4.2.5 POSTROUTING chain

# Enable simple IP Forwarding and Network Address Translation
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP
share|improve this question
    
may be this would help. [link]help.ubuntu.com/community/IptablesHowTo –  Tingrammer Jun 12 at 13:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.