Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Red Hat Software Businesses

IPChains and Firewalling 20

Posted by Cliff from the tunneling-through-the-firewall dept.
Vertigo1 asks: &nbsp "I have a Cable Modem with RoadRunner. I have a Dual Pentium 200 machine (w/two NIC's), running Red Hat 6.0 w/the latest errata updates. I am going to setup a firewall w/ipchains. I have a Citrix (ie Terminal Server) behind the firewall I want to connect to from the Internet and an FTP server also. How do I set up IPChains to forward to the Citrix server (which uses tcp port 1494) and then to an internal FTP server (tcp port 21 and ftp-data). I understand how ipchains works and have read thoroughly the IPChains-HOWTO, but I still cannot connect to the Citrix server from the Internet. Please help!" This is a common misconception. IPChains are good for configuring what gets in and out of your network on a packet level, but this is a redirection problem. Anyone know where you can find a a good port redirection program on the 'net?
This discussion has been archived. No new comments can be posted.

IPChains and Firewalling More

IPChains and Firewalling

Comments Filter:
  • One problem i had with ipchains, was the documentation. (IMHO) The offical how-to is geared for people who have previously used IPFWADM.
    I resorted to trial and error and finally gor what i needed from it.

    How about a how-to that has less emphisis on the differences between the 2 and just has information reguarding IPCHAINS.
  • RPM package is somwhere here [stuba.sk]. the only bad thing (right now) is that server is being reinstalled and i do not know when it'll be running again.

    but Vertigol can search for this package on (for example) http://rufus.w3.org/linux/RPM/ [w3.org].

  • There's a VERY simple program, called tcpbridge (do a websearch on tcpbridge.c), which does simple forwarding of TCP/IP sockets. It has a few problems, though; for example, under certain circumstances (such as a socket unexpectedly closing or whatever), it goes into a CPU-thrashing state. Also, it has no logging facilities, and any connection will look like it came from the bridge box (this actually caused me some grief, when someone caused some general mischeif and I had no idea where it came from). Something at the protocol/packet level would be much nicer than such an inelegant solution.

    Now, I have seen references to IPchains being used for forwarding, but they didn't go into detail and so I don't know if they're just spread misconceptions (which I am guilty of perpetrating, myself, as is anyone else who reads too much into the description of IPchains).


    ---
    "'Is not a quine' is not a quine" is a quine.


  • yeah, check the above threads. redir kicks arse. i spent like three hours trying to read the "english" docs to ipmasqadm and dorking around with ipportfw, found redir and had an Exchange box doing SMTP and POP behind a Linux firewall in all of 20 minutes.

    follow the path of least resistance, grasshoppah...

  • I have used redir and it works well..

    Pretty simple to configure, here's a sample line:

    $redir --bind_addr=$myip --laddr=$myip --lport=2346 --caddr 192.168.2.4 --cport=2346 -
    -transproxy 2>> /var/log/redir.log &

    $redir = variable I set for my redir binary (/usr/local/sbin/redir)


    $myip = My external IP

    I redirect stderr to a log to find out if things are funky and then send it to the background.

    This particular redirect of port 2346 is for a game that I play (rainbow 6) so I can host games from my workstation inside the firewall.

    I'm assuming your IPChains is configured to let the allowed port in. Here's my IP chain line to let the allowed port in:

    $ipchains -A eth0-in -p TCP -s 0.0.0.0/0 -d $myip 1024:5999 -j ACCEPT

    I basically accept most traffic at unprivvied ports. Again myip = my external nic. $ipchains is my ip chains binary.

    Most of my rules I got from the IPCHains-HOWTO examples. I modified from there..
  • I wonder if its possible to use redir with TCPWrappers. Generally you still want to control who is allowed to connect to your system.

    I use a 2.0.36 Linux box that acts as a firewall and IPMasq (NAT) router. In order to play any cool game that requires a connection be made from the game server back to the client (StarCraft etc) I have to create a port forward using `ipautofw`.

    Example of my IPMasq and forwarding setup.

    # Permit IP masquerading for the 192.168.1.* network
    /sbin/ipfwadm -F -p deny
    /sbin/ipfwadm -F -a m -S 192.168.1.0/24 -D 0.0.0.0/0
    # set up auto forward for StarCraft
    ipautofw -A -r tcp 6112 6112 -h 192.168.1.12
    ipautofw -A -r udp 6112 6112 -h 192.168.1.12
     ipautofw

    -A (add)

    -r tcp 6112 6112 (using PROTOCOL forward ports LOW to HIGH)
    -h 192.168.1.12 (Host to receive forwarded packets)
    I have also used redir. Which is extremely easy to set up on any linux machine. I don't think it requires any special kernel mods.

    Also consider checking out the Linux Router Project [linuxrouter.org]. You can download a 1440Kb disk image that contains a complete Linux system already setup with everything you need sans redir. If you compile redir and copy it to the disk, you can mount the disk and back up the root.lrp with redir included. LRP will save you alot of time in building out your own NAT router. Its a really cool tool!

    Chase

  • I spent weeks dinking around with ipmasqadm and never gotten it to do anything I wanted. Redir fixed the problem in about 15 minutes. Sometimes I guess simplicity wins...
  • i have an old machine connected to my cablemodem and this old machine isn't enough powerful to handle internet services then i set up another box (192.168.0.250) to handle web traffic. i once used "redir" but all connections appeared to come from the firewalling machine and no logging was correct. i then found "ipmasqadm portfw" and re-compiled my kernel with port forwarding enabled. it all works grrrrreat!
    the command i'm using in my init script is:

    ipmasqadm portfw -a -P tcp -L YOUR.EXTERNAL.IP.ADDRESS 80 -R 192.168.0.250 80

    excuse my bad english... i'm just trying to help! :-)
  • Try changing it to:

    ipmasqadm portfw -a -P tcp -L 47624 -R 192.168.0.3 47624

    in my scripts, I source /etc/dhcpc/hostinfo-eth0 to get the local IP, so it looks like:

    . /etc/dhcpc/hostinfo-eth0
    ipmasqadm portfw -a -P tcp -L $IPADDR 47624 -R 192.168.0.3 47624

    Good luck.
  • I cannot see the problem and why you should need any other software than ipchains. Enabling masquerading would solve half the problem like wham... ("ipchains -A forward -j MASQ") Then, still using ipchains, redirect connections on certain ports to certain machines. I don't remember exactly, but something like "ipchains -A forward -p 80 -d 10.0.0.1/255.255.255.0 -j MASQ" would forward port 80 to 10.0.0.1...
  • The 2.2.x Linux Kernel series has a networking option called "PORTFW" (in Networking, just below the masquerading drivers, I believe). That, coupled with the ipmasqadm utility, allows you to redirect ports to other machines from the kernel level.

    PORTFW needs to be compiled into your kernel, and may still be listed as experimental (it does work, though). With that done, just grab ipmasqadm (probably comes with RH 6.0) and use:
    "ipmasqadm portfw --help" for usage.

    Cheers,
    -Irian
  • something like
    "ipchains -A forward -p 80 -d 10.0.0.1/255.255.255.0 -j MASQ" would forward port 80 to 10.0.0.1

    I don't think that will work...

    According to the ipchains man page, that command will masquerade all traffic destined to 10.0.0.x using protocol 80 (unknown protocol, my /etc/services goes from AH (51) to OSPF(89)..) since ipchains only works with TCP(6), UDP(17), and ICMP(1), my guess is that the command would error out.

    In any case, ipchains won't do what you're trying here... some sort of redirection program is necessary.
  • try loading module ip_masq_ftp

    cheers
    vanne
  • I haven't used it personally, but I've heard good things about redir.
    Check it out here [qual.net].
  • Thank Ghu! I'm using a linux 2.2.5 box (debian) to route my cablemodem as well, and would *like* to play a game or two on the internet. (Yes, compiled with proper options. Nutscrape, Quake, and Roger-Wilco all work fine, ICQ *mostly* works)

    Checking documentation for the apps in question, I get these answers : 'open port 47624' and 'open ports 2000-2020'

    OK. Hmm, neat. The HOWTOs are all about 2.0.x, ipchains documentation seems kinda minimal.
    I *have* located the ipmasqadm utility and installed it. Trying to *use* it however...

    ipmasqadm portfw -a -P tcp -L 47624 -R 192.168.0.3 47624

    ...which seems to be the apropo cmdline (off of the top of my head anyway, it's been a few days) throws an error message and dies.

    Who has gotten this to work, or is there something better than ipmasqadm?

    AdvTHANKSance

    ----
    It is often easer to gain forgiveness than permission
  • portfw: setsockopt failed: Invalid argument

    Why do I suspect this has not so much to do with the command line as a misconfiguration elsewhere?

    ----
    It is often easer to gain forgiveness than permission
  • I don't firewall with my RH 6.0 box, but I do use it to give internet access to some Macs on my LAN.

    I have a DSL connection to static IP address, which is the RH 6.0 box, with a second NIC setup for LAN. On the LAN email clients, web browsing, telnet, and ftp to the RH 6.0 box works, but ftping to outside ftp servers results in bad port errors.

    Any clues, ipchains and ipmasquarading seem to be set up to

Slashdot Top Deals

I tell them to turn to the study of mathematics, for it is only there that they might escape the lusts of the flesh. -- Thomas Mann, "The Magic Mountain"

Close