iptables blocking eth0 .. why ?
Hi,
I'd appreciate a second opinion why this script is blocking eth0,
confirming or disconfirming the line I've indicated.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
re two interfaces in this server:
#eth0 - <internet-address>
#eth1 - <lan-address>
### Create Chains
iptables -N IN_LO
iptables -N OUT_LO
iptables -N IN_ETH0
iptables -N OUT_ETH0
iptables -N IN_ETH1
iptables -N OUT_ETH1
iptables -N BLOCKED_PACKETS
iptables -N ICMP_PACKETS
### POLICIES
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
### INPUT
iptables -A INPUT -j BLOCKED_PACKETS
iptables -A INPUT -p icmp -j ICMP_PACKETS
iptables -A INPUT -i lo -j IN_LO
iptables -A INPUT -i eth0 -j IN_ETH0
iptables -A INPUT -i eth1 -j IN_ETH1
### FORWARD
iptables -A FORWARD -j BLOCKED_PACKETS
iptables -A FORWARD -p icmp -j ICMP_PACKETS
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
### OUTPUT
iptables -A OUTPUT -j BLOCKED_PACKETS
iptables -A OUTPUT -p icmp -j ICMP_PACKETS
iptables -A OUTPUT -o lo -j OUT_LO
iptables -A OUTPUT -o eth0 -j OUT_ETH0
iptables -A OUTPUT -o eth1 -j OUT_ETH1
### BLOCKING_PACKETS
iptables -A BLOCKED_PACKETS -m state --state INVALID -j DROP
iptables -A BLOCKED_PACKETS -p tcp -m tcp --tcp-flags SYN,ACK \
SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
iptables -A BLOCKED_PACKETS -p tcp ! --syn -m state --state NEW \
-j DROP
iptables -A BLOCKED_PACKETS -d 224.0.0.0/8 -j DROP
# should this be on both interfaces?
#iptables -A BLOCKED_PACKETS -d <internet-broadcast> -i eth0 -p udp \
#--dport 135:139 -j DROP
s the following line why eth0 is blocked on my system ?
iptables -A BLOCKED_PACKETS -d 255.255.255.255 -i eth0 -p udp \
--dport 67:68 -j DROP
### ICMP_PACKETS
# are all of these really needed? Which ones should I not accept?
iptables -A ICMP_PACKETS -p icmp --icmp-type 0 -j ACCEPT
iptables -A ICMP_PACKETS -p icmp --icmp-type 3 -j ACCEPT
iptables -A ICMP_PACKETS -p icmp --icmp-type 4 -j ACCEPT
iptables -A ICMP_PACKETS -p icmp --icmp-type 8 -j ACCEPT
iptables -A ICMP_PACKETS -p icmp --icmp-type 11 -j ACCEPT
iptables -A ICMP_PACKETS -p icmp --icmp-type 12 -j ACCEPT
### IN_LO (localhost)
# are these really needed? Why?
iptables -A IN_LO -s 127.0.0.1 -i lo -j ACCEPT
#iptables -A IN_LO -s <lan-address> -i lo -j ACCEPT
#iptables -A IN_LO -s <internet-address> -i lo -j ACCEPT
### IN_ETH0 (Internet)
#iptables -A IN_ETH0 -d <internet-address> -i eth0 -m state \
#--state RELATED,ESTABLISHED -j ACCEPT
### IN_ETH1 (LAN)
#iptables -A IN_ETH1 -d <lan-address> -i eth1 -m state \
#--state RELATED,ESTABLISHED -j ACCEPT
### OUT_LO (Localhost)
# are these really needed? Why?
iptables -A OUT_LO -d 127.0.0.1 -o lo -j ACCEPT
#iptables -A OUT_LO -d <lan-address> -o lo -j ACCEPT
#iptables -A OUT_LO -d <internet-address> -o lo -j ACCEPT
### OUT_ETH0 (Internet)
#iptables -A OUT_ETH0 -s <internet-address> -o eth0 -m state \
#--state RELATED,ESTABLISHED -j ACCEPT
### OUT_ETH1 (LAN)
#iptables -A OUT_ETH1 -s <lan-address> -o eth1 -m state \
#--state RELATED,ESTABLISHED -j ACCEPT
#save this setup for next use
iptables-save
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Reply to: