firewall e adsl

[alessandro]

Ciao a tutti ! Ho un problema con il firewall e l' adsl :mi spiego meglio ,
ho un pc con sl 10.2 con connessione adsl che fa da gw per una rete : con eth0 per la rete interna e una scheda eth1 in dhcp con modem collegato
per internet .tutto funziona correttamente i pc della lan vanno in internet , il problema nasce quando attivo il firewall con GUARDDOG (precedentemente non e attivato nessun firewall ),e i pc della rete interna non vanno piu' in rete : qualcuno mi sa mica dire come si configura guarddog quando si utilizza una connessione adsl ? (se attivo rc.firewall senza aver fatto la connessione con l'adsl va tutto regolare in rete , attivando pppoe-start i pc della rete non vanno in internet).
ciao

[alessandro]

Non so come impostare in garddog che deve "uscire " in internet da eth1 quindi dal modem ,come si fa ' ? nessuno puo aiutarmi?

[gallows]

Forse hai bloccato l'ip forwarding...?

Codice: Seleziona tutto

# echo 1 > /proc/sys/net/ipv4/ip_forward

[alessandro]

ciao . no ip forwarding attivo
utilizzavo la configurazione di guarddog (rc.firewall) con una connessione a 56k con modem seriale e andava bene , ora con modem collegato a una seconda scheda di rete eth1 con adsl , se attivo firewall non va in internet ,sicuramente e un problema di configurazione, ma non so come . ogni consiglio e ben accetto.

[Paoletta]

per me devi far passare sulla catena di FORWARD i pacchetti relativi alle connessioni già stabilite dai pc della rete...prova ad aggiungere al file generato da guarddog la riga seguente:

Codice: Seleziona tutto

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

per maggiori info,man iptables

[alessandro]

Ciao . Ho aggiunto la riga dopo aver attivato firewall
ma non cambia niente .
ping http://www.google.it non risponde mente risponde ping ip rete interna
....HO dato IPTABLES -F per cancellare tutto
poi IPTABLES -L ma e apparito tante scritte e non va niente .

[gallows]

Prova a postare un iptables -L

[alessandro]

ecco cosa da iptables -L


Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- bombetta.bombetta.ale 10.0.80.255
ACCEPT all -- 192.168.1.13 255.255.255.255
logaborted tcp -- anywhere anywhere state RELATED,ESTABLISHED tcp flags:RST/RST
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
nicfilt all -- anywhere anywhere
srcfilt all -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
srcfilt all -- anywhere anywhere

Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
s1 all -- anywhere anywhere

Chain f0to1 (6 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:auth state NEW
ACCEPT udp -- anywhere anywhere udp dpt:auth
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:1863 state NEW
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpts5999
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
logdrop all -- anywhere anywhere

Chain f0to2 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:smtp state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:auth state NEW
ACCEPT udp -- anywhere anywhere udp dpt:auth
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:pop3s state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:pop3 state NEW
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpts65535
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
logdrop all -- anywhere anywhere

Chain f1to0 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:http state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:8080 state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:8008 state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:8000 state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:8888 state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:ftp state NEW
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:https state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:domain state NEW
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:1863 state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ns state NEW
ACCEPT udp -- anywhere anywhere udp spts5999 dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spts5999 dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ssn state NEW
ACCEPT udp -- anywhere anywhere udp spts5999 dpt:netbios-ssn
logdrop all -- anywhere anywhere

Chain f1to2 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:http state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:8080 state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:8008 state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:8000 state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:8888 state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:ftp state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:ssh state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:0:1023 dpt:ssh state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpts:5900:5903 state NEW
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:5800 state NEW
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:https state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:domain state NEW
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp sptscvsup dpt:631 state NEW
ACCEPT udp -- anywhere anywhere udp dpt:631
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ns state NEW
ACCEPT udp -- anywhere anywhere udp spts5999 dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spts5999 dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ssn state NEW
ACCEPT udp -- anywhere anywhere udp spts5999 dpt:netbios-ssn
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpts65535
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
logdrop all -- anywhere anywhere

Chain f2to0 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:smtp state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:http state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:8080 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:8008 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:8000 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:8888 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:ftp state NEW
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:pop3s state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:pop3 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:https state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:domain state NEW
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ns state NEW
ACCEPT udp -- anywhere anywhere udp spts65535 dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spts65535 dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ssn state NEW
ACCEPT udp -- anywhere anywhere udp spts65535 dpt:netbios-ssn
logdrop all -- anywhere anywhere

Chain f2to1 (6 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpts5999
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:http state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:8080 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:8008 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:8000 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:8888 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:ftp state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:ssh state NEW
ACCEPT tcp -- anywhere anywhere tcp spts:0:1023 dpt:ssh state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpts:5900:5903 state NEW
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:5800 state NEW
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:https state NEW
ACCEPT tcp -- anywhere anywhere tcp dpt:domain state NEW
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp spts65535 dpt:631 state NEW
ACCEPT udp -- anywhere anywhere udp dpt:631
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ns state NEW
ACCEPT udp -- anywhere anywhere udp spts65535 dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spts65535 dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ssn state NEW
ACCEPT udp -- anywhere anywhere udp spts65535 dpt:netbios-ssn
logdrop all -- anywhere anywhere

Chain logaborted (1 references)
target prot opt source destination
logaborted2 all -- anywhere anywhere limit: avg 1/sec burst 10
LOG all -- anywhere anywhere limit: avg 2/min burst 1 LOG level warning prefix `LIMITED '

Chain logaborted2 (1 references)
target prot opt source destination
LOG all -- anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `ABORTED '
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

Chain logdrop (8 references)
target prot opt source destination
logdrop2 all -- anywhere anywhere limit: avg 1/sec burst 10
LOG all -- anywhere anywhere limit: avg 2/min burst 1 LOG level warning prefix `LIMITED '
DROP all -- anywhere anywhere

Chain logdrop2 (1 references)
target prot opt source destination
LOG all -- anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `DROPPED '
DROP all -- anywhere anywhere

Chain logreject (0 references)
target prot opt source destination
logreject2 all -- anywhere anywhere limit: avg 1/sec burst 10
LOG all -- anywhere anywhere limit: avg 2/min burst 1 LOG level warning prefix `LIMITED '
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
DROP all -- anywhere anywhere

Chain logreject2 (1 references)
target prot opt source destination
LOG all -- anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `REJECTED '
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
DROP all -- anywhere anywhere

Chain nicfilt (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
logdrop all -- anywhere anywhere

Chain s0 (1 references)
target prot opt source destination
f0to1 all -- anywhere bombetta.bombetta.ale
f0to1 all -- anywhere 10.0.80.255
f0to1 all -- anywhere 192.168.1.13
f0to1 all -- anywhere 255.255.255.255
f0to1 all -- anywhere localhost
f0to1 all -- anywhere 87.6.206.197
f0to2 all -- anywhere localnet/24
logdrop all -- anywhere anywhere

Chain s1 (1 references)
target prot opt source destination
f1to2 all -- anywhere localnet/24
f1to0 all -- anywhere anywhere

Chain s2 (1 references)
target prot opt source destination
f2to1 all -- anywhere bombetta.bombetta.ale
f2to1 all -- anywhere 10.0.80.255
f2to1 all -- anywhere 192.168.1.13
f2to1 all -- anywhere 255.255.255.255
f2to1 all -- anywhere localhost
f2to1 all -- anywhere 87.6.206.197
f2to0 all -- anywhere anywhere

Chain srcfilt (2 references)
target prot opt source destination
s2 all -- localnet/24 anywhere
s0 all -- anywhere anywhere

[alessandro]

Ciao !
c'e qualcuno che puo' aiutarmi?

[alessandro]

Ciao ! c'e qualche buona anima lassu?

[MR.F]

non ce la faccio fisicamente a leggermi tutte quelle regole da te prese da IPTABLES -L

mi dispiace ma ti consiglio di cancellarle tutte e rifare una per una le regole a mano da shell con il caro amico iptables & company!

in bocca a lupo!

[alessandro]

Crepi il lupo !
mi sa tanto che mi mettero' l'anima in pace,e poi vai con iptables !!! e chissa' cosa verra' fuori!!!
ciao a tutti !