Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

when trying to open the ports 110 and 25 in my iptables for outlook-only users, i cant do it except by forwarding as such:

-I FORWARD -i eth0 -s 192.168.1.0/24 -j ACCEPT
-I FORWARD -i eth1 -d 192.168.1.0/24 -j ACCEPT

but doing so allows the rest of the users in my lan to bypass my squid proxy. whats the proper syntax for these forwarding commands to just pen ports 110 and 25?

EDIT:

this is my current iptables file that im directly configuring. it works for now but im sure its far from perfect. currently users with no explicit proxy server cannot connect to the internet. outlook ports are working.

# Generated by iptables-save v1.3.5 on Fri Mar  9 13:59:24 2012
*nat
:PREROUTING ACCEPT [25448:1902369]
:POSTROUTING ACCEPT [29:1625]
:OUTPUT ACCEPT [786:56571]
-A POSTROUTING -o eth1 -j MASQUERADE 
COMMIT
# Completed on Fri Mar  9 13:59:24 2012
# Generated by iptables-save v1.3.5 on Fri Mar  9 13:59:24 2012
*filter
:INPUT DROP [0:0]
:FORWARD DROP [1:68]
:OUTPUT DROP [0:0]
:LOGDROP - [0:0]
-A INPUT -i lo -j ACCEPT 
-A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT 
-A INPUT -i eth0 -p tcp -m tcp --dport 3128 -m state --state NEW -j ACCEPT 
-A INPUT -i eth1 -p tcp -m tcp --dport 110 -m state --state NEW -j ACCEPT
-A INPUT -i eth1 -p tcp -m tcp --dport 25 -m state --state NEW -j ACCEPT
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -j LOGDROP 
-A OUTPUT -o lo -j ACCEPT 
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -o eth1 -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT 
-A OUTPUT -o eth1 -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m udp --dport 123 -m state --state NEW -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT 
-A OUTPUT -o eth1 -p tcp -m tcp --dport 21 -m state --state NEW -j ACCEPT 
-A OUTPUT -o eth1 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT 
-A OUTPUT -o eth1 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT 
-A OUTPUT -o eth1 -p tcp -m tcp --dport 5190 -m state --state NEW -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --dport 110 -m state --state NEW -j ACCEPT
-A OUTPUT -o eth1 -p tcp -m tcp --dport 25 -m state --state NEW -j ACCEPT
-I FORWARD -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-I FORWARD -i eth0 -s 192.168.1.0/24 -p tcp --dport 110 -j ACCEPT
-I FORWARD -i eth0 -s 192.168.1.0/24 -p tcp --dport 25 -j ACCEPT
-A LOGDROP -j LOG 
-A LOGDROP -j DROP 
COMMIT
# Completed on Fri Mar  9 13:59:24 2012
share|improve this question
add comment

2 Answers 2

Ok, let's start it again from the beginning.

Set your FORWARD chaing to ACCEPT (just in case)

iptables -P FORWARD ACCEPT

Clear your FORWARD chain

iptables -F FORWARD

Allow out your users to check smtp and pop

iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -s 192.168.1.0/24 -p tcp --dport 110 -j ACCEPT

DO NOT add -d 192.168.1.0/24 -j ACCEPT as this is unsecure.

Let the responses in for these questions

iptables -A FORWARD -m state --state RELATED, ESTABLISHED -j ACCEPT

set your FORWARD chain policy back to DROP

iptables -P FORWARD DROP

Now, the first part should work. If not, then ip_forward is not enables.

echo 1 > /proc/sys/net/ipv4/ip_forward

Regarding the reboot problem. Iptables commands are not persistent, so you have to use a script, or use your Linux distribution built-in iptables administration script.

The easiest and less elegant way is to run this command when you are ok with your configuration and working.

iptables-save >/etc/myfirewall_config

And hook up and initscript which loads it back when booting up

iptables-restore </etc/myfirewall_config

Done.

If you still havve problems after all of these, post your NAT table (iptables -t nat -vnL)

share|improve this answer
    
i see. if i were to add the stateful rule and add the forwarding rules for ports pop3 and smtp ports only to specified ip addresses as Jiri below suggested, would that still be insecure? –  3a2roub Mar 9 '12 at 16:22
    
If you add Jiri's rule and the stateful and delete what i suggested then iy is going to be secure –  Gabor Vincze Mar 9 '12 at 18:58
    
okay i'll give it a try tomorrow! thanks –  3a2roub Mar 9 '12 at 20:04
    
added the stateful and jiri's rules and everything works fine. thanks to both of u. should i have accepted jiri's answer instead? –  3a2roub Mar 10 '12 at 10:28
    
Send the output of iptables -vnL and i can tell –  Gabor Vincze Mar 10 '12 at 11:43
show 2 more comments

'-I FORWARD -i eth1 -d 192.168.1.0/24 -j ACCEPT' enables/opens access from (probably) yours egress iface to internal lan.

for allowing outgoing connection use - 'iptables -I FORWARD -s 192.168.11.0/24 -p tcp --dport 110 -j ACCEPT'.

be aware that enabling outgoing connection just like that is wrong, you give virus/worms/trojans to connect to internet via those ports. restrict it by specifying exact destination IP, of force users to use internal smtp server for outgoing connection with AUTH enabled.

if they need remote pop3, download mail via pop3 to a server inside your network and inform your users to use internal pop3 "mirror" copy.

there are also some pop3 proxies or some mail client can run pop3/smtp via proxy...

share|improve this answer
    
i get a syntax error when applying that -D rule –  3a2roub Mar 9 '12 at 13:09
    
ah, sorry i pasted bad line, '-D' was deleting command :D OK one is '-I' (insert) or '-A' (append). –  Jiri Xichtkniha Mar 9 '12 at 13:11
    
no worries jiri! but i tried both -I and -A and it didnt work. i tried similar syntax before i posted here. what are we missing? –  3a2roub Mar 9 '12 at 13:16
    
no idea, paste an error, works for me –  Jiri Xichtkniha Mar 9 '12 at 14:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.