[RH7.3/WinXP] dns resolution met ipchains werkt niet meer

[Verwijderd]

Deze vraag zal vast wel eens gesteld zijn, maar ik kan de search op dit moment niet gebruiken.

Ik heb net redhat 7.3 geinstalleerd en ipchains geconfigureerd zoals ik dat had gedaan op redhat 7.1
Alleen dns resolution werkt niet meer op mijn WinXP pc, dus ik kan niet meer naar www.tweakers.net gaan, het lukt wel met ip.
In /etc/resolv.conf staan wel de goede nameservers (van quicknet).
En zo ziet mijn super simpele rc.firewall eruit

echo 1 > /proc/sys/net/ipv4/ip_forward
/sbin/ipchains -P forward DENY
/sbin/ipchains -A forward -s 192.168.0.0/24 -j MASQ

ip van m'n linux pc is 192.168.0.1 & van m'n windows pc 192.168.0.2
Ik heb de nameservers ook toegevoegd bij mijn voorkeurs-DNS-servers op m'n windows pc.

[ripexx]

Worden de dns request door ipchains geblokt, btw ik zou als ik jouw was voor iptables of netfilter ipv ipchains ( ipchains > 2.4 > iptables/netfilter), Maar dat lijkt me raar, probeer eens van de command line in xp wat te prutsen met ns lookup en het ping command, wil soms ook nog wel eens leuke resultaten geven. BTw zie nu pas je firewall script, ziet er erg eenvoudig uit zonder rare functies, dus alles zou gewoon moeten kunnen werken. Alders ff wat meer info posten over netwerk instelling etc.

[Verwijderd]

Okeej,

/etc/sysconfig/network
NETWORKING=yes
FORWARD_IPV4=yes
HOSTNAME=valhalla

/etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=dhcp
ONBOOT=yes
TYPE=Ethernet
PEERDNS=yes

/etc/sysconfig/network-scripts/ifcfg-eth1
DEVICE=eth1
IPADDR=192.168.0.1
NETMASK=255.255.255.0
BROADCAST=192.168.0.255
NETWORK=192.168.0.0
BOOTPROTO=none
ONBOOT=yes
TYPE=Ethernet

/etc/resolv.conf
nameserver 213.73.255.52
nameserver 213.73.255.53



Hoe zou ik dit dan met iptables kunnen doen?

[Verwijderd]

Hier is mijn rc.firewall:

code:

#!/bin/sh
#
# rc.firewall-2.4
#
#################################################################
#----------------------------------------------------------------
# This is an IPTABLES firewall for 2.4.x kernels.
# 
# This is written by karam.
# 
# Use it the way you want: it's your own risk. 
#----------------------------------------------------------------
#################################################################

echo -e "\n\nLoading rc.firewall...\n"


# The location of the 'iptables' program
#
#   If your Linux distribution came with a copy of iptables, most
#   likely it is located in /sbin.  If you manually compiled 
#   iptables, the default location is in /usr/local/sbin
#
# ** Please use the "whereis iptables" command to figure out 
# ** where your copy is and change the path below to reflect 
# ** your setup
#
IPTABLES=/sbin/iptables


#Setting the EXTERNAL and INTERNAL interfaces for the network
#
#  Each IP Masquerade network needs to have at least one
#  external and one internal network.  The external network
#  is where the natting will occur and the internal network
#  should preferably be addressed with a RFC1918 private address
#  scheme.
#
#  For this example, "eth0" is external and "eth1" is internal"
#
#  NOTE:  If this doesnt EXACTLY fit your configuration, you must 
#         change the EXTIF or INTIF variables above. For example: 
#
#       $EXTERNALIF="ppp0"
#
#            if you are a modem/xDSL user.
#
INTERNALIF="eth1"
INTERNALNET="192.168.0.0/16"
INTERNALBCAST="192.168.0.255"
EXTERNALIF="ppp0"

echo "   External Interface:  $EXTERNALIF"
echo "   Internal Interface:  $INTERNALIF"


#======================================================================
#== No editing beyond this line is required for initial MASQ testing ==


echo -en "   loading modules: "

# Need to verify that all modules have all required dependencies
#
echo "  - Verifying that all kernel modules are ok"
/sbin/depmod -a

echo ".  Done loading modules."

################################################################
#Insert modules- should be done automatically if needed
## Flush everything, start from scratch

# Incoming packets from the outside network
$IPTABLES -F INPUT

# Outgoing packets from the internal network
$IPTABLES -F OUTPUT

# Forwarding/masquerading
$IPTABLES -F FORWARD



##Setup sysctl controls which affect tcp/ip

#
#Disabling IP Spoofing attacks.
echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter

#Don't respond to broadcast pings
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

#Defragment all Packets
#Default now

#Enable forwarding
echo 1 >/proc/sys/net/ipv4/ip_forward

#Block source routing
echo 0 >/proc/sys/net/ipv4/conf/all/accept_source_route

#Kill timestamps.  These have been the subject of a recent bugtraq thread
echo 0 > /proc/sys/net/ipv4/tcp_timestamps

#Enable SYN Cookies
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

#Kill redirects
echo 0 >/proc/sys/net/ipv4/conf/all/accept_redirects

#Enable bad error message protection
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

#Allow dynamic ip addresses
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

#Log martians (packets with impossible addresses)
#RiVaL said that certain NICs don't like this.  Comment out if necessary.
echo 1 >/proc/sys/net/ipv4/conf/all/log_martians

#Set out local port range
echo "32768 61000" >/proc/sys/net/ipv4/ip_local_port_range

#Reduce DoS'ing ability by reducing timeouts
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time
echo 0 > /proc/sys/net/ipv4/tcp_window_scaling
echo 0 > /proc/sys/net/ipv4/tcp_sack



##Set basic rules
#
#Note that unlike ipchains, rules passing through a FORWARD chain do NOT
#also have to pass through an INPUT chain.

#Kill ANY stupid packets, including
#-Packets that are too short to have a full ICMP/UDP/TCP header
#- TCP and UDP packets with zero (illegal) source and destination ports
#-Illegal combinations of TCP flags
#-Zero-length (illegal) or over-length TCP and IP options,
#   or options after the END-OF-OPTIONS option
#-Fragments of illegal length or offset (e.g., Ping of Death).
#Above list ripped from http://www.linux-mag.com/2000-01/bestdefense_02.html

$IPTABLES -A INPUT -m unclean -j DROP
$IPTABLES -A FORWARD -m unclean -j DROP

#Kill invalid packets (illegal combinations of flags)
$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A FORWARD -m state --state INVALID -j DROP

# Allow all connections on the internal interface
#
$IPTABLES -A INPUT -i lo -j ACCEPT

#Kill connections to the local interface from the outside world.
$IPTABLES -A INPUT -d 127.0.0.0/8 -j REJECT

#Allow unlimited traffic from internal network using legit addresses
$IPTABLES -A INPUT -i $INTERNALIF -s $INTERNALNET -j ACCEPT

#Kill anything from outside claiming to be from internal network
$IPTABLES -A INPUT -i $EXTERNALIF -s $INTERNALNET -j REJECT

##########  ICMP  #########

#ping don't forward pings going inside
$IPTABLES -A FORWARD -p icmp --icmp-type echo-request -o $INTERNALIF -j REJECT

#ping flood protection
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j DROP

#Deny icmp to broadcast address
$IPTABLES -A INPUT -p icmp -d $INTERNALBCAST -j DROP

#Allow all other icmp
$IPTABLES -A INPUT -p icmp -j ACCEPT

##Allow established connections
#Unlike ipchains, we don't have to go through the business of allowing
#a local port range- just allow all connections already established.

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#Note that unlike ipchains, the following must be enabled even with masquerading
#Don't forward SMB related traffic

$IPTABLES -A FORWARD -o $EXTERNALIF -p tcp --dport 137 -j REJECT
$IPTABLES -A FORWARD -o $EXTERNALIF -p tcp --dport 138 -j REJECT
$IPTABLES -A FORWARD -o $EXTERNALIF -p tcp --dport 139 -j REJECT
$IPTABLES -A FORWARD -o $EXTERNALIF -p udp --dport 137 -j REJECT
$IPTABLES -A FORWARD -o $EXTERNALIF -p udp --dport 138 -j REJECT
$IPTABLES -A FORWARD -o $EXTERNALIF -p udp --dport 139 -j REJECT

#Allow ALL other forwarding going out
$IPTABLES -A FORWARD -o $EXTERNALIF -i $INTERNALIF -j ACCEPT

#Allow replies coming in
$IPTABLES -A FORWARD -i $EXTERNALIF -m state --state ESTABLISHED,RELATED -j ACCEPT



##################################################################################

#From here on, we're dealing with connection attempts.
#The -m limit is a DoS protection on connects
#First we allow a certain amount of connections per second
#DROP the rest (so we don't DoS ourself with rejections)
#We don't limit normal packets (!syn) by allowing the rest

##Basic services.  Uncomment to allow in.

# ftp-data
$IPTABLES -A INPUT -p tcp  --dport 20 -j ACCEPT

# ftp
$IPTABLES -A INPUT -p tcp  --dport 21 -j ACCEPT

# ssh
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT

#telnet
#$IPTABLES -A INPUT -p tcp --dport 23 -j ACCEPT

# smtp  One per second limt -burst rate of ten
$IPTABLES -A INPUT -p tcp --dport 25 --syn -m limit --limit 1/s --limit-burst 10 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 25 --syn -j DROP
$IPTABLES -A INPUT -p tcp --dport 25 -j ACCEPT

# DNS
$IPTABLES -A INPUT -p tcp --dport 53 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 53 -j ACCEPT

# HTTP
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT

# POP3
$IPTABLES -A INPUT -p tcp --dport 110 -j ACCEPT

# HTTPS
$IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT

# Secure POP3
#$IPTABLES -A INPUT -p tcp --dport 995 -j ACCEPT

# Secure IMAP
$IPTABLES -A INPUT -p tcp --dport 993 -j ACCEPT

# IMAP
$IPTABLES -A INPUT -p tcp --dport 143 -j ACCEPT

# webmin
$IPTABLES -A INPUT -p tcp --dport 10000 -j ACCEPT


################################################################
### Not active, activate if you like
#---------------------------------------------------------------
# identd
#$IPTABLES -A INPUT -p tcp --dport 113 -j ACCEPT
#
# MySQL
#$IPTABLES -A INPUT -p tcp --dport 3306 -j ACCEPT
#---------------------------------------------------------------
################################################################


##DNAT
#Modify addresses and uncomment to allow DNAT (port forwarding)
#Stop anything directly addressing the internal network
$IPTABLES -A PREROUTING -t nat -i $EXTERNALIF -d $INTERNALNET -j DROP



################################################################
### Not active, activate if you like
#---------------------------------------------------------------
#Send web requests to an internal machine
#Send mail to an internal machine
#$IPTABLES -A PREROUTING -t nat -i $EXTERNALIF -p tcp -d $MYADDR --dport 80 \
#                      -j DNAT --to 192.168.0.10:80
#$IPTABLES -A FORWARD -i $EXTERNALIF -p tcp -d 192.168.0.10 --dport 80 -j ACCEPT

#$IPTABLES -A PREROUTING -t nat -i $EXTERNALIF -p tcp -d $MYADDR --dport 25 \
#                      -j DNAT --to 192.168.0.10:25
#$IPTABLES -A FORWARD -i $EXTERNALIF -p tcp -d 192.168.0.10 --dport 25 -j ACCEPT
#
#---------------------------------------------------------------
################################################################



##Some ports should be denied and logged.
$IPTABLES -A INPUT -p tcp --dport 6670 -m limit -j LOG --log-prefix "Deepthroat scan"
$IPTABLES -A INPUT -p tcp --dport 6670 -j DROP
$IPTABLES -A INPUT -p tcp --dport 6711 -m limit -j LOG --log-prefix "Subseven scan"
$IPTABLES -A INPUT -p tcp --dport 6711 -j DROP
$IPTABLES -A INPUT -p tcp --dport 6712 -m limit -j LOG --log-prefix "Subseven scan"
$IPTABLES -A INPUT -p tcp --dport 6712 -j DROP
$IPTABLES -A INPUT -p tcp --dport 6713 -m limit -j LOG --log-prefix "Subseven scan"
$IPTABLES -A INPUT -p tcp --dport 6713 -j DROP
$IPTABLES -A INPUT -p tcp --dport 12345 -m limit -j LOG --log-prefix "Netbus scan"
$IPTABLES -A INPUT -p tcp --dport 12345 -j DROP
$IPTABLES -A INPUT -p tcp --dport 12346 -m limit -j LOG --log-prefix "Netbus scan"
$IPTABLES -A INPUT -p tcp --dport 12346 -j DROP
$IPTABLES -A INPUT -p tcp --dport 20034 -m limit -j LOG --log-prefix "Netbus scan"
$IPTABLES -A INPUT -p tcp --dport 20034 -j DROP
$IPTABLES -A INPUT -p tcp --dport 31337 -m limit -j LOG --log-prefix "Back orifice scan"
$IPTABLES -A INPUT -p tcp --dport 31337 -j DROP
$IPTABLES -A INPUT -p tcp --dport 6000  -m limit -j LOG --log-prefix "X-windows Port"
$IPTABLES -A INPUT -p tcp --dport 6000  -j DROP


#Traceroutes depend on finding a rejected port.  DROP the ones it uses
$IPTABLES -A INPUT -p udp --dport 33434:33523 -j DROP

#Don't log ident because it gets hit all the time eg connecting to an irc server
$IPTABLES -A INPUT -p tcp --dport 113 -j REJECT



##Catch all rules.
#iptables reverts to these if it hasn't matched any of the previous rules.

#Log
$IPTABLES -A INPUT -m limit --limit 5/minute -j LOG  --log-prefix "Firewalled packet:"
$IPTABLES -A FORWARD -m limit --limit 5/minute -j LOG --log-prefix "Firewalled packet:"

#Reject
$IPTABLES -A INPUT -p all -j DROP
$IPTABLES -A FORWARD -p all -j REJECT

#Accept it anyway if it's only output
$IPTABLES -A OUTPUT -j ACCEPT

#Masquerade internal connections going out.
$IPTABLES -A POSTROUTING -t nat -o $EXTERNALIF -j MASQUERADE


echo -e "\nrc.firewall done.\n"

Have fun

[edit]
waar " staat, moet eigenlijk dubbele haakjes staan

[Verwijderd]

Zorgt deze regel

code:

/sbin/ipchains -A forward -s 192.168.0.0/24 -j MASQ

er niet voor dat [em]alleen[/em] de pakketjes vanaf 192.168.0.0/24 geforward worden en deze regel

code:

/sbin/ipchains -P forward DENY

dat de antwoord pakketjes (pakketjes naar 192.168.0.0/24) worden geweigerd?