Re: iptables forwarding and dns problem
On Thu 24 Nov 2005, Markus B. wrote:
> i configured a router on debian, but i have some serious problems
> 1. i can not ping google.com or any other side if my INPUT OUTPUT
> Policities are on DROP because of unknown host, if i turn the firewall
> off i can ping them so i think there must be a problem with my ports.
> But i dunno wich port I still need to open cause i already did it with
> 53 and 80.
Ping is ICMP...
> 2. some of my friends who want to be forwarded via the router can just
> load some pages. google.com, heise.de and some others dont work. On the
> other hand they are able to connect to ICQ, or Skype.
So what error do they get? Timeout?
> iptables -t nat -A POSTROUTING -o ppp0 -s 141.28.227.0/16 -j MASQUERADE
> iptables -A FORWARD -i ppp0 -d 141.28.227.178 -j ACCEPT
> iptables -A FORWARD -i ppp0 -d 141.28.227.177 -j ACCEPT
> iptables -A FORWARD -i ppp0 -d 141.28.227.223 -j ACCEPT
You're doing a MASQUERADE on the outgoing ppp0 interface;
it's not likely that packets will arrive at ppp0 from the outside with
one of the 141.28.227.0/24 addresses you show (although it's possible,
you don't tell what IP address you may have on the ppp0 interface).
Best do something like this:
iptables -A FORWARD -i ppp0 -o eth0 -j ACCEPT
The masquerading should take care of the rest.
> iptables -A FORWARD -o ppp0 -s 141.28.227.178 -j ACCEPT
> iptables -A FORWARD -o ppp0 -s 141.28.227.177 -j ACCEPT
> iptables -A FORWARD -o ppp0 -s 141.28.227.223 -j ACCEPT
Similarly, you won't have packets leaving ppp0 with those source
addresses with the MASQUERADE rule...
> # router rules
> iptables -A INPUT -i ppp0 -p tcp --dport 53 -j ACCEPT
> iptables -A OUTPUT -o ppp0 -p tcp --sport 53 -j ACCEPT
>
> iptables -A INPUT -i ppp0 -p udp --dport 53 -j ACCEPT
> iptables -A OUTPUT -o ppp0 -p udp --sport 53 -j ACCEPT
You should probably consider having something like this:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
and just allow outgoing packets to port 53, the above rule will allow
incoming responses.
> iptables -A INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT
> iptables -A OUTPUT -o ppp0 -p tcp --sport 80 -j ACCEPT
Same here.
Paul Slootman
Reply to: