[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: firewall question



On Tue, Sep 11, 2001, Ira Abramov wrote about "Re: firewall question":
> On Tue, 11 Sep 2001, Nadav Har'El wrote:
> 
> > In iptables (the newer 2.4 firewall mechaism) this is not so: the same
> > rule with the necessary syntax changes,
> > 	-A OUTPUT -p TCP --dport whois --sport 1024: -j ACCEPT
> > 	-A INPUT -p TCP ! --syn --sport whois --dport 1024: -j ACCEPT
> > will not be applied to forwarded packets at all.
> 
> then what's the point in stateful inspection? :-))))
> 
> I'm sure you meant well, but the above example would have flunked you in
> iptables 101.

Ira, thanks for the evalution of my technical skills. Next time I'm looking
for a job I'll make sure not to list you as a reference ;)

I wasn't trying to imply that simple translations of ipchains to iptables
is the way to go when designing an iptables rule set. I don't know where
you got this idea... All I said was that the rules for the firewall machine
and the network behind it are different, because INPUT/OUTPUT rules are not
run on FORWARD packets, and then I gave a silly example which can be given
for both ipchains and iptables.

If an example with stateful inspection will make you happy, here's one.
Please don't grade it - it's just a quick-and-dirty example...

:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
*nat
-A POSTROUTING -o ppp0 -j MASQUERADE
*filter
-A FORWARD -o ppp0 -j ACCEPT
-A FORWARD -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT

These will apply the most straight-forward "stateful inspection" to forwarded
(and masqueraded) packets coming in to the ppp0 connection: only packets
that are part of established connections (or "related" packets) are allowed
to return.

You can have a similar rule for the INPUT/OUTPUT chains, or you can have
a completely different set of rules. your choice. But what I said was that
in iptables the rules for forwarded are completely seperate from the ones
affecting packets for this machine.

-- 
Nadav Har'El                        |       Tuesday, Sep 11 2001, 23 Elul 5761
nyh@math.technion.ac.il             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |This box was intentionally left blank.
http://nadav.harel.org.il           |

=================================================================
To unsubscribe, send mail to linux-il-request@linux.org.il with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail linux-il-request@linux.org.il