Shorewall users - Jun 2002 - Port forwarding...

Hi all

Is it possible to just forward port to local computer
but not give open access for that port? 
If I''ve understood right that this rule does give
ACCESS from net to loc too:
DNAT net loc:192.168.1.5 udp 7777

What I''m trying to say is that it would work so that 
everything that''s coming from net to that local
computers port is DROPed or REJECTed if it''s not
requested by local computer.

About that shorewall 1.3.1 it''s great and easy to use.
I''m happy that norfc1918 file is implemented now...
Excellent job. :)

Any help greatly appreciated

-Vesa Vestman




__________________________________________________
Do You Yahoo!?
Everything you''ll ever need on one web page
from News and Sport to Email and Music Charts
http://uk.my.yahoo.com

> Is it possible to just forward port to local computer
> but not give open access for that port?=20
> If I''ve understood right that this rule does give
> ACCESS from net to loc too:
> DNAT net loc:192.168.1.5 udp 7777
This DNAT rule allows Internet hosts to initiate an inbound session. If I
understand your next paragraph correctly, you don''t want that.
> What I''m trying to say is that it would work so that=20
> everything that''s coming from net to that local
> computers port is DROPed or REJECTed if it''s not
> requested by local computer.
All you should need is the default stateful inspection policy and suggested
minimal NAT setup (set eth0 ---- eth1, in the masq file) which will allow the
internal server to initiate outbound sessions on any port and allow inbound
response traffic on the same port for those sessions via stateful inspection. If
you also want to limit the internal server''s outbound traffic to _only_
udp port 7777, you''ll need to add more rules. Unless you have trojan
horse programs taking over your server and hitting outside machines, you
probably don''t need or want to restrict outbound requests that much.

BTW, I should not have referred to your internal machine as a
"server". You just called it a "local computer". Contrary to
the implication of "server", I understood you to mean your local
computer is _not_ intended to be a public server at all, and should not respond
to requests initiated from the Internet.

Sorry for any confusion I might have added with that.

--------------------------------------------------------
>  > Is it possible to just forward port to local computer
> > but not give open access for that port?=20
> > If I''ve understood right that this rule does give
> > ACCESS from net to loc too:
> > DNAT net loc:192.168.1.5 udp 7777
>=20
> This DNAT rule allows Internet hosts to initiate an inbound=20
> session. If I understand your next paragraph correctly, you=20
> don''t want that.
>=20
> > What I''m trying to say is that it would work so that=20
> > everything that''s coming from net to that local
> > computers port is DROPed or REJECTed if it''s not
> > requested by local computer.
>=20
> All you should need is the default stateful inspection policy=20
> and suggested minimal NAT setup (set eth0 ---- eth1, in the=20
> masq file) which will allow the internal server to initiate=20
> outbound sessions on any port and allow inbound response=20
> traffic on the same port for those sessions via stateful=20
> inspection. If you also want to limit the internal server''s=20
> outbound traffic to _only_  udp port 7777, you''ll need to add=20
> more rules. Unless you have trojan horse programs taking over=20
> your server and hitting outside machines, you probably don''t=20
> need or want to restrict outbound requests that much.
> _______________________________________________
> Shorewall-users mailing list
> Shorewall-users@shorewall.net
> http://www.shorewall.net/mailman/listinfo/shorewall-users
>=20

On Tue, 4 Jun 2002, Vesa Vestman wrote:
> Is it possible to just forward port to local computer
> but not give open access for that port? 
> If I''ve understood right that this rule does give
> ACCESS from net to loc too:
> DNAT net loc:192.168.1.5 udp 7777
> 
> What I''m trying to say is that it would work so that 
> everything that''s coming from net to that local
> computers port is DROPed or REJECTed if it''s not
> requested by local computer.
>
  
What problem are you trying to solve? Normally, your local host would send
a UDP request packet to a well-known port at some host on the net and that
host would reply with a reply packet containing a source port = <the
well-known port> and the destination port = <local port from original
request>. Netfilter connection tracking together with ESTABLISHED rules
(which Shorewall creates automatically) would be enough to avoid having to
include any inbound rules to accomodate the reply packets.

If the application that you are running follows some other convention,
then either custom connection-tracking and nat modules are required for
that application (FTP is a classic example) or you are going to have to
use the type of port forwarding rule that you have shown above (I have
such a rule to handle ICQ chat and file transfer requests).
 
> About that shorewall 1.3.1 it''s great and easy to use.
> I''m happy that norfc1918 file is implemented now...
> Excellent job. :)
> 
Thanks,
-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net