Strange iptables behavior

[Stiven Andre]

>From: "Stiven Andre" <stiven_a@hotmail.com>
>To: linux-il@linux.org.il
>Subject: Strange iptables behavior
>Date: Wed, 27 Nov 2002 17:28:05 +0200
>
>Hi List.
>
>I have my home network being masqueraded by linux router(RH8.0).
>Network topology:
>Linux router(192.168.1.1): eth0 to LAN, eth1 to adsl modem.
>LAN = 192.168.1.*
>
>I wrote iptables script that masquerades my network, but the problem is 
>when I run the script from the first time from /etc/rc.d/rc.local it works. 
>But if I then rerun it manualy (by root of couse) it stops working. Inside 
>hosts don't have access to the internet. My script does clear all old rules 
>at the start of it but it doesn't help or else...
>I tryed to clear all old rules manualy and then run the script, no luck 
>still not working. I tryed to unload all iptables modules then "insmod 
>ip_tables" and after that to run the script again, nothing it doesn't help 
>too... Can someone understand what is going on ? Why it works only the 
>first time ? After the second excution the rules are seem to be the same 
>but inside hosts can't ping internet.
>There is 2 LOG targets in the script, first with prefix "FORWARD PACKET" 
>and second with prefix "MASQ RULE MATCHED", after the first excution of the 
>script. I see 2 logs for each packet, first "FORWARD PACKET" and then "MASQ 
>RULE MATCHED" but after the second excution, when the NAT doesn't work the 
>logs doesn't show "MASQ RULE MATCHED"...
>
>Best Regards.
>S.A.
>
>The script:
>
>
>#!/bin/sh
>IPTABLES="/sbin/iptables"
>
># Reset all.
>$IPTABLES -P INPUT ACCEPT
>$IPTABLES -P OUTPUT ACCEPT
>$IPTABLES -P FORWARD ACCEPT
>$IPTABLES -F
>$IPTABLES -X
>$IPTABLES -t nat -F
>
># Modules and targets:
>/sbin/modprobe ipt_LOG
>/sbin/modprobe ipt_REJECT
>/sbin/modprobe ipt_MASQUERADE
>/sbin/modprobe ip_nat_ftp
>/sbin/modprobe ip_nat_irc
>/sbin/modprobe ip_conntrack_ftp
>/sbin/modprobe ip_conntrack_irc
>
># IP Forwarding And Dynamic IP support:
>echo "1" > /proc/sys/net/ipv4/ip_forward
>echo "1" > /proc/sys/net/ipv4/ip_dynaddr
>
># Create chains for packet types:
>$IPTABLES -N tcp_packets
>$IPTABLES -N udp_packets
>$IPTABLES -N icmp_packets
>
># INPUT TABLE:
># Permit ADSL, gre Tunnel (Protocol 47), loopback and a broadcast.
>$IPTABLES -A INPUT -p 47 -s 10.0.0.138 -j ACCEPT
>$IPTABLES -A INPUT -p tcp -s 10.0.0.138 --sport 1723 -j ACCEPT
>$IPTABLES -A INPUT -s 127.0.0.1 -j ACCEPT
>$IPTABLES -A INPUT -p ALL -d 192.168.1.255 -j ACCEPT
># Ensure that established sessions will not die
>$IPTABLES -A INPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT
># Allow FTP active and passive port commands:
>#$IPTABLES -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j 
>ACCEPT
>#$IPTABLES -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED 
>-j ACCEPT
># Send all other traffic to it's chain:
>$IPTABLES -A INPUT -p tcp -j tcp_packets
>$IPTABLES -A INPUT -p udp -j udp_packets
>$IPTABLES -A INPUT -p icmp -j icmp_packets
>
># OUTPUT TABLE:
># Permit all.
>$IPTABLES -A OUTPUT -j ACCEPT
>
># FORWARD TABLE:
>$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
>
># tcp_packets TABLE:
># World accessible services:
>#$IPTABLES -A tcp_packets -p tcp --dport 21 --syn -j ACCEPT # FTP
>#$IPTABLES -A tcp_packets -p tcp --dport 80 --syn -j ACCEPT # HTTP
># Private services:
>$IPTABLES -A tcp_packets -s 192.168.1.10/32 -p tcp --dport 23 --syn -j 
>ACCEPT # Telnet
>$IPTABLES -A tcp_packets -s 192.168.1.10/24 -p tcp --dport 139 --syn -j 
>ACCEPT # NetBIOS-ssn
>
># udp_packets TABLE:
># Private services:
>$IPTABLES -A udp_packets -s 192.168.1.10/24 -p udp --dport 137 -j ACCEPT # 
>NetBIOS-sn
>$IPTABLES -A udp_packets -s 192.168.1.10/24 -p udp --dport 138 -j ACCEPT # 
>NetBIOS-dgm
>
># MASQUERADING:
>$IPTABLES -t nat -A POSTROUTING -o ppp0 -j LOG --log-level DEBUG 
>--log-prefix "matched MASQ RULE: "
>$IPTABLES -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
>
># Set defaults to drop:
>$IPTABLES -P INPUT ACCEPT
>$IPTABLES -P OUTPUT ACCEPT
>$IPTABLES -P FORWARD ACCEPT
>
># Debug
>$IPTABLES -A FORWARD -j LOG --log-level DEBUG --log-prefix "FORWARD PACKET: 
>"
>$IPTABLES -A INPUT -j LOG --log-level DEBUG --log-prefix "INPUT PACKET: "
>$IPTABLES -A OUTPUT -j LOG --log-level DEBUG --log-prefix "OUTPUT PACKET: "
>
>_________________________________________________________________
>STOP MORE SPAM with the new MSN 8 and get 2 months FREE* 
>http://join.msn.com/?page=features/junkmail
>
>
>=================================================================
>To unsubscribe, send mail to linux-il-request@linux.org.il with
>the word "unsubscribe" in the message body, e.g., run the command
>echo unsubscribe | mail linux-il-request@linux.org.il


_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE* 
http://join.msn.com/?page=features/junkmail