topic Re: nat iptables rules in Operating System - Linux

nat iptables rules

linuxtolinux — Wed, 02 Aug 2006 09:19:14 GMT

hi all,
I am trying to test iptables nat chains by matching ping command with LOG target.I am not getting any LOG matching the echo-reply; only i detect the echo-request packet in /var/log/messages.

Does anyone have any idea ?
thanks

Re: nat iptables rules

George Liu_4 — Wed, 02 Aug 2006 11:18:48 GMT

What's the output of iptables -L?

Re: nat iptables rules

Steven E. Protter — Wed, 02 Aug 2006 11:46:14 GMT

Shalom,

Quick fix:

http://www.fs-security.com/

This handy little product sets up iptables with logging. You can steal iptables code from it and I've used it as a firewall router for my supposedly sold business in the US and found it is unbreachable. It is much better than I am at writing iptables code.

SEP

Re: nat iptables rules

linuxtolinux — Thu, 03 Aug 2006 02:26:44 GMT

hi
This is the output of the nat listing:
# /sbin/iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
LOG icmp -- anywhere anywhere icmp echo-request LOG level warning prefix `nat PREROUTING:'
LOG icmp -- anywhere anywhere icmp echo-reply LOG level warning prefix `nat PREROUTING:'

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
LOG icmp -- anywhere anywhere icmp echo-request LOG level warning prefix `nat POSTROUTING:'
LOG icmp -- anywhere anywhere icmp echo-reply LOG level warning prefix `nat POSTROUTING:'

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
LOG icmp -- anywhere anywhere icmp echo-request LOG level warning prefix `nat OUTPUT:'
LOG icmp -- anywhere anywhere

Regards

Re: nat iptables rules

g33k — Thu, 03 Aug 2006 02:30:59 GMT

are you sure that icmp is not drop in any rule before?
afaik NAT rules on the bottom, and iptables are first match wins(so if there is any rule before regarding icmp it's aplaid.)

Re: nat iptables rules

linuxtolinux — Thu, 03 Aug 2006 03:03:19 GMT

hi
I applied only the above nat rules only.
and all the other default policies are ACCEPT.

Re: nat iptables rules

g33k — Thu, 03 Aug 2006 05:04:53 GMT

I supose you'll answer yes but just to be sure that it's problem with iptables...
syslog is running?
packet forwarding is enabled?
ping is OK you are ping form system behind NAT some other system and getting answers?

Re: nat iptables rules

George Georgiev — Thu, 03 Aug 2006 07:24:00 GMT

Hi,

echo-reply packets are not supposed to go into the nat table. I guess you will be able to see them in the INPUT, FORWARD and OUTPUT chains of the main table.

cheers!
George

Re: nat iptables rules

George Liu_4 — Fri, 04 Aug 2006 13:45:42 GMT

I would like you to post

iptable -L
not
iptables -L -t nat

reason: the icmp traffic could be in the earlier rules

Re: nat iptables rules

linuxtolinux — Mon, 07 Aug 2006 02:47:06 GMT

THanks a lot

Re: nat iptables rules

Alexander Samad — Sun, 13 Aug 2006 22:32:07 GMT

If you have you log rule in the -t nat you will only see the initial packet as the reply is considered related and doesn hit the nat table

have a look at
http://l7-filter.sourceforge.net/PacketFlow.png

place your log rule in the input or foward chain of the filter table (the detault one)