IPTABLES

[Stuart Browne]

What's your OUTPUT chain look like?

[Steven E. Protter]

Shalom,

This is tough to learn, espcially in a hurry. It literally took me years to learn the subtlties here. Take a look at my past questions.

Firestarter has a GUI, you point you click you have a firewall. I really recommend it for beginners.

SEP

[Piotr Kirklewski]

The server is in remote location.
I don't have graphic environment.

I've partialy solved the problem.

The thing is you have to spicify the interface -i eth0 (but the rea server has eth0 + eth0:0). Then on testng machine everythink works fine.But not at the real server. Problem with eth0:0?

real server iptables - webpage blocked,ssh-ok,ping-ok
==========================================
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 state NEW
ACCEPT tcp -- 81.xxx.xxx.xxx 217.xxx.xxx.xxx tcp dpt:22 state RELATED,ESTABLISHED
ACCEPT tcp -- 81.xxx.xxx.xxx 217.xxx.xxx.xxx tcp dpt:22 state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 state NEW
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53 state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53 state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 state NEW
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:123 state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:123 state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306 state NEW
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:3306 state RELATED,ESTABLISHED
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:3306 state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:5555 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:5555 state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8002 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8002 state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9001 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9001 state NEW
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW

==========================================
On the testing machine I have apache instaled and several rules in iptables:

testing machine - everything works fine
==========================================
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 state NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state RELATED,ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state NEW
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW

Everythink works fine.
The only one difference betwen those machines is the virtual (eth0:0) interface on the web server.

I can ping it,ssh is working but I can't open the webpage.

I have to do that with iptables

Thanks

[Piotr Kirklewski]

Chain OUTPUT (policy ACCEPT 181 packets, 13459 bytes)
pkts bytes target prot opt in out source destination
987K 522M ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
96M 131G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED

[Piotr Kirklewski]

Finaly it works:

Chain INPUT (policy DROP 443 packets, 52393 bytes)
num pkts bytes target prot opt in out source destination
1 5009 1448K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
2 1685 365K ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
3 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 state RELATED,ESTABLISHED
4 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 state NEW
5 2083 161K ACCEPT tcp -- eth0 * 81.150.xxx.xxx 217.174.xxx.xxx tcp dpt:22 state RELATED,ESTABLISHED
6 4 192 ACCEPT tcp -- eth0 * 81.150.xxx.xxx 217.174.xxx.xxx tcp dpt:22 state NEW
7 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 state RELATED,ESTABLISHED
8 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 state NEW
9 0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 state RELATED,ESTABLISHED
10 1 71 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 state NEW
11 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 state RELATED,ESTABLISHED
12 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 state NEW
13 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 state RELATED,ESTABLISHED
14 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 state NEW
15 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 state RELATED,ESTABLISHED
16 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 state NEW
17 17 1292 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:123 state RELATED,ESTABLISHED
18 0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:123 state NEW
19 188K 12M ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306 state RELATED,ESTABLISHED
20 356 21360 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306 state NEW
21 0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:3306 state RELATED,ESTABLISHED
22 0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:3306 state NEW
23 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:5555 state RELATED,ESTABLISHED
24 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:5555 state NEW
25 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8002 state RELATED,ESTABLISHED
26 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8002 state NEW
27 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9001 state RELATED,ESTABLISHED
28 0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9001 state NEW
29 0 0 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
30 4527 272K ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW
31 0 0 ACCEPT tcp -- eth0 * 217.xxx.xxx.xxx 217.xxx.xxx.xxx tcp dpt:22 state RELATED,ESTABLISHED
32 0 0 ACCEPT tcp -- eth0 * 217.xxx.xxx.xxx 217.xxx.xxx.xxx tcp dpt:22 state NEW

[Piotr Kirklewski]

closed