Hello again
I hope I can ask for some more help.
I can now communicate between loc and net after sorting out my previous
typos.
I now am having problems with my loc dmz communications and I think it is to
do with my understanding of the route flag
in the proxyarp file.
This is my iptables -L output now
Chain INPUT (policy DROP)
target prot opt source destination
rfc1918 all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
net2fw all -- 0.0.0.0/0 0.0.0.0/0
loc2fw all -- 10.0.0.0/24 0.0.0.0/0
dmz2fw all -- 212.19.75.0/24 0.0.0.0/0
common all -- 0.0.0.0/0 0.0.0.0/0
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg
10/hour burst 5 LOG flags 0 level 6 prefix `Shorewall:all2all:REJECT:''
reject all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP)
target prot opt source destination
rfc1918 all -- 0.0.0.0/0 0.0.0.0/0
net2loc all -- 0.0.0.0/0 10.0.0.0/24
net2dmz all -- 0.0.0.0/0 212.19.75.0/24
loc2net all -- 10.0.0.0/24 0.0.0.0/0
loc2dmz all -- 10.0.0.0/24 212.19.75.0/24
dmz2net all -- 212.19.75.0/24 0.0.0.0/0
dmz2loc all -- 212.19.75.0/24 10.0.0.0/24
common all -- 0.0.0.0/0 0.0.0.0/0
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg
10/hour burst 5 LOG flags 0 level 6 prefix `Shorewall:all2all:REJECT:''
reject all -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
fw2net all -- 0.0.0.0/0 0.0.0.0/0
fw2loc all -- 0.0.0.0/0 10.0.0.0/24
fw2dmz all -- 0.0.0.0/0 212.19.75.0/24
common all -- 0.0.0.0/0 0.0.0.0/0
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg
10/hour burst 5 LOG flags 0 level 6 prefix `Shorewall:all2all:REJECT:''
reject all -- 0.0.0.0/0 0.0.0.0/0
Chain all2all (6 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
common all -- 0.0.0.0/0 0.0.0.0/0
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg
10/hour burst 5 LOG flags 0 level 6 prefix `Shorewall:all2all:REJECT:''
reject all -- 0.0.0.0/0 0.0.0.0/0
Chain common (5 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp
flags:0x10/0x10
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp
flags:0x04/0x04
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpts:137:139
REJECT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:445
reject-with icmp-port-unreachable
REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:135
reject-with icmp-port-unreachable
DROP all -- 0.0.0.0/0 255.255.255.255
DROP all -- 0.0.0.0/0 224.0.0.0/4
DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53 state
NEW
DROP all -- 0.0.0.0/0 212.19.72.255
DROP all -- 0.0.0.0/0 10.0.0.255
DROP all -- 0.0.0.0/0 212.19.75.255
Chain dmz2fw (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
reject tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:113
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
all2all all -- 0.0.0.0/0 0.0.0.0/0
Chain dmz2loc (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:25
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:113
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
all2all all -- 0.0.0.0/0 0.0.0.0/0
Chain dmz2net (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:25
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:113
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp
dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp
dpt:123
all2all all -- 0.0.0.0/0 0.0.0.0/0
Chain fw2dmz (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:21
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp
dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp
dpts:137:139
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
all2all all -- 0.0.0.0/0 0.0.0.0/0
Chain fw2loc (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain fw2net (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp
dpt:123
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp
dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:1723
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:43
ACCEPT 47 -- 0.0.0.0/0 0.0.0.0/0 state NEW
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
all2all all -- 0.0.0.0/0 0.0.0.0/0
Chain icmpdef (0 references)
target prot opt source destination
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 4
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 3
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 11
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 12
Chain loc2dmz (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp
dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:25
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:113
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:21
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:110
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
all2all all -- 0.0.0.0/0 0.0.0.0/0
Chain loc2fw (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:901
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:135
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpts:137:139
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:445
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:37
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp
dpts:137:139
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp
dpt:161
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain loc2net (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:6667 limit: avg 10/hour burst 5 LOG flags 0 level 6 prefix
`Shorewall:loc2net:REJECT:''
reject tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:6667
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain logdrop (7 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0
level 6 prefix `Shorewall:rfc1918:DROP:''
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain net2all (3 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
common all -- 0.0.0.0/0 0.0.0.0/0
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg
10/hour burst 5 LOG flags 0 level 6 prefix `Shorewall:net2all:DROP:''
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain net2dmz (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:21
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:25
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp
dpt:53
ACCEPT tcp -- 212.19.64.2 0.0.0.0/0 state NEW tcp
dpt:53
reject tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:113
net2all all -- 0.0.0.0/0 0.0.0.0/0
Chain net2fw (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:1723
ACCEPT 47 -- 0.0.0.0/0 0.0.0.0/0 state NEW
reject tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:113
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
net2all all -- 0.0.0.0/0 0.0.0.0/0
Chain net2loc (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 10.0.0.50 state NEW tcp
dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp
dpt:113
net2all all -- 0.0.0.0/0 0.0.0.0/0
Chain reject (8 references)
target prot opt source destination
REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 reject-with
tcp-reset
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with
icmp-port-unreachable
Chain rfc1918 (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 255.255.255.255
DROP all -- 169.254.0.0/16 0.0.0.0/0
logdrop all -- 0.0.0.0/8 0.0.0.0/0
logdrop all -- 10.0.0.0/8 0.0.0.0/0
logdrop all -- 127.0.0.0/8 0.0.0.0/0
logdrop all -- 192.0.2.0/24 0.0.0.0/0
logdrop all -- 192.168.0.0/16 0.0.0.0/0
logdrop all -- 172.16.0.0/12 0.0.0.0/0
logdrop all -- 240.0.0.0/4 0.0.0.0/0
Chain shorewall (0 references)
target prot opt source destination
This is my output from route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use
Iface
redfire * 255.255.255.255 UH 0 0 0 eth2
212.19.75.138 * 255.255.255.255 UH 0 0 0 eth2
212.19.75.0 * 255.255.255.0 U 0 0 0 eth2
212.19.72.0 * 255.255.255.0 U 0 0 0 eth1
10.0.0.0 * 255.255.255.0 U 0 0 0 eth0
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default j1-rg7.tele2.ne 0.0.0.0 UG 0 0 0 eth1
This is my proxyarp file
#ADDRESS INTERFACE EXTERNAL HAVEROUTE
212.19.75.138 eth2 eth1 Yes
212.19.75.138 eth2 eth0 Yes
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
My interfaces file
#ZONE INTERFACE BROADCAST OPTIONS
net eth1 212.19.72.255 routefilter,norfc1918
loc eth0 10.0.0.255
dmz eth2 212.19.75.255 routestopped
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
My rules
############################################################################
##
#RESULT CLIENT(S) SERVER(S) PROTO PORT(S) CLIENT PORT(S)
ADDRESS
#
#
# Local network to Internet - Reject attempts by trojans to call home using
IRC
#
REJECT:info loc net tcp 6667
#
# Local network to Firewall
#
ACCEPT loc fw tcp
ssh,swat,135,137:139,445,time
ACCEPT loc fw udp 137:139,snmp
#
# Local network to DMZ
#
ACCEPT loc dmz udp domain
ACCEPT loc dmz tcp domain,smtp,ssh,auth
ACCEPT loc dmz tcp www,ftp,pop3
ACCEPT loc dmz icmp echo-request
#
# Internet to DMZ
#
ACCEPT net dmz tcp www,ftp,smtp
ACCEPT net dmz udp domain
ACCEPT net:212.19.64.2 dmz tcp domain
REJECT net dmz tcp auth
#
# Net to Local
#
ACCEPT net loc:10.0.0.50 tcp www
ACCEPT net loc tcp auth
#
# DMZ to Internet
#
ACCEPT dmz net icmp echo-request
ACCEPT dmz net tcp smtp,auth,domain
ACCEPT dmz net udp domain
ACCEPT dmz net udp ntp
#
# DMZ to Firewall
#
REJECT dmz fw tcp auth
#
# DMZ to Local
#
ACCEPT dmz loc tcp smtp,auth
ACCEPT dmz loc icmp echo-request
#
# Internet to Firewall
#
ACCEPT net fw tcp ssh,1723
ACCEPT net fw gre
REJECT net fw tcp auth
#
# Firewall to Internet
#
ACCEPT fw net udp ntp
ACCEPT fw net udp domain
ACCEPT fw net tcp domain,www,ssh,1723,whois
ACCEPT fw net gre
ACCEPT fw net icmp echo-request
#
# Firewall to DMZ
#
ACCEPT fw dmz tcp ftp
ACCEPT fw dmz udp domain
ACCEPT fw dmz udp 137:139
#
# People whine if ping doesn''t work
#
ACCEPT fw loc icmp 8
ACCEPT loc fw icmp 8
ACCEPT loc dmz icmp 8
ACCEPT dmz loc icmp 8
ACCEPT dmz fw icmp 8
ACCEPT fw dmz icmp 8
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
I cannot ping or use www access to 212.19.75.138 in the dmz
I have compiled and run tcpdump and this is the output for http
12:47:06.144638 10.0.0.104.ilss > 212.19.75.138.http: S
3202021396:3202021396(0) win 8192 <mss 1460> (DF)
12:47:06.339580 802.1d config 8000.00:05:9b:d6:ca:40.800d root
8000.00:05:9b:d6:ca:40 pathcost 0 age 0 max 20 hello 2 fdelay 15
I am on 10.0.0.104
One question.
I am using one of my real ip addresses for the dmz interface on the fw. Do I
need to
do this?
This is my ifconfig
eth0 Link encap:Ethernet HWaddr 00:01:03:33:1B:99
inet addr:10.0.0.221 Bcast:10.0.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2968023 errors:1349 dropped:0 overruns:226 frame:2056
TX packets:2364912 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:383206109 (365.4 Mb) TX bytes:1424262908 (1358.2 Mb)
Interrupt:9 Base address:0x1000
eth1 Link encap:Ethernet HWaddr 00:01:02:25:50:8F
inet addr:212.19.72.112 Bcast:212.19.72.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2552682 errors:163 dropped:0 overruns:8 frame:166
TX packets:2253467 errors:0 dropped:0 overruns:0 carrier:0
collisions:112 txqueuelen:100
RX bytes:1425610497 (1359.5 Mb) TX bytes:307714076 (293.4 Mb)
Interrupt:3 Base address:0x1080
eth2 Link encap:Ethernet HWaddr 00:01:03:33:1E:49
inet addr:212.19.75.137 Bcast:212.19.75.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1553 errors:0 dropped:0 overruns:0 frame:0
TX packets:17230 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:325164 (317.5 Kb) TX bytes:1639223 (1.5 Mb)
Interrupt:9 Base address:0x1400
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:830 errors:0 dropped:0 overruns:0 frame:0
TX packets:830 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:81045 (79.1 Kb) TX bytes:81045 (79.1 Kb)
Any help or guidance would be wonderful.
John Lodge
> John Lodge
> Software Engineer
> Redwood Technologies Limited
> T +[44] (0)1344 304 344
> F +[44] (0)1344 304 345
> M +[44] (0)794 122 1422
> E jml@redwoodtech.com
> W www.redwoodtech.com
>
Email Disclaimer
The information in this email is confidential and may be legally privileged.
It is intended solely for the addressee. Access to this email by anyone else
is unauthorised. If you are not the intended recipient, any disclosure,
copying, distribution or any action taken or omitted to be taken in reliance
on it is prohibited and may be unlawful. When addressed to our clients any
opinions or advice contained in this email are subject to the limitations of
Redwood Technologies Limited''s standard terms and conditions of
contract.