iptables chains explanations

[slacker_x]

I am learning about iptables and NAT right now. Please tell me if the following is accurate:


Scenario 1:
- A client on the Internet tries to connect to the ssh server on the firewall.
[PREROUTING]- Nothing happens since the ssh server is on the firewall and not on another computer in the LAN.
[INPUT]- Input rules are checked to see if the connection is allowed. yes, it's allowed.
[OUTPUT]- The firewall replies to the connection attempt providing that the rules in the output chain allow for it.
[POSTROUTING]- Nothing happens again since the reply is coming from the firewall.
- Connection will be allowed...


Scenario 2:
- A client on the Internet tries to connect to the telnet server running on a server behind the firewall.
[PREROUTING]- Since this port is forwarded to a computer other than the firewall, the destination IP is changed and the connection is tracked.
[FORWARD]- If the packet matches the rules in the FORWARD chain, it is allowed to continue on to its destination within the LAN.
[FORWARD]- Telnet server sends reply back out to client if allowed to by rules in FORWARD chain.
[POSTROUTING]- Source IP is rewritten so that the packet appears to originate from the firewall.
- Connection will be allowed...


Scenario 3:
- A client in my LAN directs his browser to http://linuxnewbie.org on tcp port 80 (this sends out a packet with a source port >= 1024 correct?)
[FORWARD]- If external http requests are allowed, packet proceeds.
[POSTROUTING]- Source IP is rewritten to the firewall's IP. Connection is tracked.
- web server replies with packet with destination port >= 1024 (same as above?) and source port of 80.
[PREROUTING]- Since the connection has been tracked, the destination ip is known and rewritten accoringly.
[FORWARD]- If incoming tcp packets are allowed on that port, the packet will continue to the client.
- Client receives data from web server...


Diagram based on my understanding of iptables and NAT:
general flow is in a clockwise direction starting at the top left.
{prer} means the PREROUTING chain
{post} means the POSTROUTING chain
{forw} means the FORWARD chain
{inpu} means the INPUT chain
{outp} means the OUTPUT chain



>--------{forw}-------->[ ]>-->[LAN ]
| [eth1] [Clie]
[Inte]>-->[ ]>-->{prer}>-->{inpu}>-->[ FW ] [ ]<--<[nts ]
[rnet] [eth0] [ ] |
[ ]<--<[ ]<--<{post}<--<{outp}<--<[Apps] |
| |
<--------{forw}-------------<

[jumpedintothefire]

I think that was very well written, you have a good understanding of iptables, and how the
packets work through the rules. Lets see some code. ;)

[slacker_x]

I'm actually still in the process of salvaging hardware for my firewall box, so I won't be doing much for a while :-(

[drstrangelove]

Here's some code...
Any one wanna tell me what's wrong w/it?
Sometimes it works, sometimes it doesn't. When it does work, it's not reliable... for example, I can always ping w/this configuration, but not load www, or ftp sites...
????
Please help....
THanks,
#############################################
#!/bin/bash

#This inserts the modules
echo "Let's insert some modules first..."
insmod ip_tables
insmod ip_conntrack
insmod iptable_nat
insmod ipt_MASQUERADE

#Let's flush the tables first...
echo "Flushing the iptables...."
/sbin/iptables -F

#Only forward packages for our subnets.
/sbin/iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT
/sbin/iptables -A FORWARD -d 192.168.0.0/24 -j ACCEPT
/sbin/iptables -A FORWARD -d ! 192.168.0.0/24 -j ACCEPT

#These are here cuz the damn thing doesn't always work...
/sbin/iptables -A INPUT -d 192.168.0.0/24 -j ACCEPT
/sbin/iptables -A OUTPUT -d 0/0 -j ACCEPT

#Masquerade everything whose destination isn't the local netork.
echo "Masquerading whatever isn't on the local subnet..."
/sbin/iptables -t nat -A POSTROUTING -d ! 192.168.0.0/24 -j MASQUERADE

#This should forward the http ports (80)...hopefully
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.0.5

#This should forward the ftp ports (21)...hopefully
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 21 -j DNAT --to 192.168.0.5

#This enables forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward

[slacker_x]

#Only forward packages for our subnets.
/sbin/iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT
/sbin/iptables -A FORWARD -d 192.168.0.0/24 -j ACCEPT
/sbin/iptables -A FORWARD -d ! 192.168.0.0/24 -j ACCEPT
Wouldn't that forward ALL packets? Since every packet has a destination and you have matched all destinations.

[Morphine]

Check this script out http://www.sentry.net/~obsid/IPTables/rc.scripts.dir/current/rc.firewall.iptables.multi

This is what I use for my current setup at home. It needs tinkering a bit to fit your need, but the author has great descriptions on the script and everything. Backup your current iptables, flush iptables, edit the script to your needs, run the script. Run /etc/iptables-save > /etc/sysconfig/iptables. Edit /etc/sysconfig/iptables, much easier to read and see where things are going. Then /etc/rc.d/rc3.d/S08iptables restart. The script is easy enough to read where you can open whatever ports you want. Got my counterstrike and battle.net games working just fine. :)