nat iptables rules

[linuxtolinux]

hi all,
I am trying to test iptables nat chains by matching ping command with LOG target.I am not getting any LOG matching the echo-reply; only i detect the echo-request packet in /var/log/messages.

Does anyone have any idea ?
thanks

[George Liu_4]

What's the output of iptables -L?

[Steven E. Protter · Accepted solution]

Shalom,

Quick fix:

http://www.fs-security.com/

This handy little product sets up iptables with logging. You can steal iptables code from it and I've used it as a firewall router for my supposedly sold business in the US and found it is unbreachable. It is much better than I am at writing iptables code.

SEP

[linuxtolinux]

hi
This is the output of the nat listing:
# /sbin/iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
LOG icmp -- anywhere anywhere icmp echo-request LOG level warning prefix `nat PREROUTING:'
LOG icmp -- anywhere anywhere icmp echo-reply LOG level warning prefix `nat PREROUTING:'

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
LOG icmp -- anywhere anywhere icmp echo-request LOG level warning prefix `nat POSTROUTING:'
LOG icmp -- anywhere anywhere icmp echo-reply LOG level warning prefix `nat POSTROUTING:'

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
LOG icmp -- anywhere anywhere icmp echo-request LOG level warning prefix `nat OUTPUT:'
LOG icmp -- anywhere anywhere


Regards

[g33k]

are you sure that icmp is not drop in any rule before?
afaik NAT rules on the bottom, and iptables are first match wins(so if there is any rule before regarding icmp it's aplaid.)

[linuxtolinux]

hi
I applied only the above nat rules only.
and all the other default policies are ACCEPT.

[g33k]

I supose you'll answer yes but just to be sure that it's problem with iptables...
syslog is running?
packet forwarding is enabled?
ping is OK you are ping form system behind NAT some other system and getting answers?

[George Georgiev]

Hi,

echo-reply packets are not supposed to go into the nat table. I guess you will be able to see them in the INPUT, FORWARD and OUTPUT chains of the main table.


cheers!
George

[George Liu_4]

I would like you to post

iptable -L
not
iptables -L -t nat

reason: the icmp traffic could be in the earlier rules

[linuxtolinux]

THanks a lot

[Alexander Samad]

If you have you log rule in the -t nat you will only see the initial packet as the reply is considered related and doesn hit the nat table

have a look at
http://l7-filter.sourceforge.net/PacketFlow.png

place your log rule in the input or foward chain of the filter table (the detault one)