Quote:> I don't need to stay with ipchains, but I do understand them - If you have
a
> good example of iptables that gets me working until I can get a handle on
> tables that would be great
> Stephen
Stephen, I am not completely clear what you are trying to do and understand,
that I am unfamiliar with Microsoft's VPN. I am making some assumptions
from this point forward which may not be accurate, so reply with another
post for clarification.
Disable ipchains then verify iptables is enabled. From your shell:
chkconfig --level 2345 ipchains off
chkconfig --list iptables
should already be enabled (2345), however if not
chkconfig --level 2345 iptables on
Restart the system to have the changes take effect. There may be another
way of doing this but restarting the network services does not do it. By
default, iptables is accepting all chains. You may start building rules
either from the shell or from a script. Initially, I test from the shell,
but you will save time if you create a script file that can be edited and
executed after a flush. Lets begin with a very simple example. If you are
already familiar with ipchains, this will look very familiar.
This example with setup a network to refuse traffic unless explicitly stated
otherwise and masquerade local network, 192.168.0.0, traffic when the
destination is not the local network. The box in question has three
interfaces lo, eth0, and eth1. Eth0 is the external interface. There is
also a ftp server at 192.168.0.5 that we want to direct external traffic to
on ports 20 and 21.
# modules
modprobe ip_tables
modprobe iptable_nat
modprobe ip_conntrack_ftp
# enable
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
# policies
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP
# flush
iptables -F
iptables -F -t nat
# masquerade; note that we do not use masq as with ipchains, but
'masquerade'
iptables -t nat -A POSTROUTING \
-s 192.168.0.0/24 \
-d ! 192.168.0.0/24 -j MASQUERADE
# allow all traffic on lo and eth1.
iptables -A FORWARD -i ! eth0 -j ACCEPT
iptables -A FORWARD -o ! eth0 -j ACCEPT # is this even needed?
iptables -A INPUT -i ! eth0 -j ACCEPT
iptables -A OUTPUT -i ! eth0 -j ACCEPT
# distination network address translation
# data-ftp
iptables -t nat -A PREROUTING -p tcp \
-s ! 192.168.0.0/24 \
--dport 20 -i eth0 -j dnat \
--to 192.168.0.5:20
# ftp
iptables -t nat -A PREROUTING -p tcp \
-s ! 192.168.0.0/24 \
--dport 21 -i eth0 -j dnat \
--to 192.168.0.5:21
There is a great deal more you can do but this is a start. Verify it works.
If you have typed each non-commented line at the shell you will loose all
your hard work at the next reboot. Use iptables-save to view then save the
current rules.
View the current iptables rules using less.
iptables-save | less
Save to /etc/sysconfig/iptables. If one already exists, cp to another
filename as a backup.
iptables-save > /etc/sysconfig/iptables
Done! When you reboot, this file will be read on boot.
I hope this helps and hope I did not make too many typos. Anyone else have
any suggestions, criticism? Jump in.
Richard Harmonson, RHCE
by