Re: iptables and pptp server problem [Long Post]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Am Mi, den 28.07.2004 schrieb Trevor um 21:48:

> No, it's not smoothwall.  Here is the current output of my firewall.  Can
> you see if there is something else blocking my PPTP GRE forwarding.  BTW,
> sorry for hijacking the thread.  I won't do it again. :-)
> 
> $ service masq status

Where does this masq service come from? Is it your own iptables init
script?

> Table: filter
> Chain INPUT (policy DROP)
> target     prot opt source               destination
> ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Is this first rule there only for testing? The rest is simply ignored
because of the first ACCEPT rule.

> ACCEPT     all  --  224.0.0.0/4          0.0.0.0/0
> ACCEPT     all  --  0.0.0.0/0            224.0.0.0/4
> DROP       all  --  224.0.0.0/4          0.0.0.0/0
> DROP       all  --  0.0.0.0/0            224.0.0.0/4
> ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0          state
> RELATED,ESTABLISHED
> icmpIn     icmp --  0.0.0.0/0            0.0.0.0/0
> InputAllowIPSEC  all  --  0.0.0.0/0            0.0.0.0/0
> InputAllowLocals  all  --  0.0.0.0/0            0.0.0.0/0
> InboundTCP  tcp  --  0.0.0.0/0            0.0.0.0/0          tcp
> flags:0x16/0x02
> denylog    tcp  --  0.0.0.0/0            0.0.0.0/0          tcp
> flags:0x16/0x02
> InboundUDP  udp  --  0.0.0.0/0            0.0.0.0/0
> denylog    udp  --  0.0.0.0/0            0.0.0.0/0
> esp-in     esp  --  0.0.0.0/0            0.0.0.0/0
> denylog    esp  --  0.0.0.0/0            0.0.0.0/0
> gre-in     47   --  0.0.0.0/0            0.0.0.0/0
> denylog    47   --  0.0.0.0/0            0.0.0.0/0
> denylog    all  --  0.0.0.0/0            0.0.0.0/0

A bunch of rules which never take place. Looks weird.

> Chain FORWARD (policy DROP)
> target     prot opt source               destination
> ForwardAllowIPSEC  all  --  0.0.0.0/0            0.0.0.0/0
> ForwardAllowLocals  all  --  0.0.0.0/0            0.0.0.0/0
> denylog    all  --  0.0.0.0/0            0.0.0.0/0
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Again a match all rule which catches all traffic. Rest is bypassed.

[ snipped a bunch of too much to understand without hours of reverse
engineering ]

> #!/bin/sh

> echo "Usage: masq {start|stop|restart|...}"

Ah! Answers my first question: its your own script.

Sorry, I don't want to go through that all - maybe someone else. I just
can comment that you will have to review it completely as you seem to
not understood that the created rule chains are checked one by one, from
first to last. The first rule which matches is used and the packets are
going to the jump target. Without having a loop created the further
rules from the same chain are not checked any more.

Alexander


-- 
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 2 (Tettnang) kernel 2.6.6-1.435.2.3.ad.umlsmp 
Serendipity 21:57:04 up 2 days, 7:03, load average: 1.03, 1.13, 1.13 

Attachment: signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux