Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Access Point on my Ubuntu machine with iptables. The machine has eth0 and wlan0 that is bridged to form the interface br0.
There should not be any firewall between eth0 and wlan0, I want the traffic to flow freely and unrestricted. If traffic stops at either eth0 or wlan0 the firewall kicks in

So I tried this code in iptables that seams to work.

$IPTABLES -N RULE_3
$IPTABLES -A FORWARD  -m physdev --physdev-is-bridged --physdev-in eth0 --physdev-out wlan0  -m state --state NEW  -j RULE_3
$IPTABLES -A FORWARD  -m physdev --physdev-is-bridged --physdev-in wlan0 --physdev-out eth0  -m state --state NEW  -j RULE_3
$IPTABLES -A RULE_3  -j LOG  --log-level info --log-prefix "RULE 3 -- ACCEPT "
$IPTABLES -A RULE_3  -j ACCEPT

BUT, for some reasons some package are dropped so I can't f.ex stream youtube on wlan0 devices. This I found in my log

Apr 10 21:32:03 NASHTPC kernel: [273846.062793] RULE 8 -- DENY IN=br0 OUT=br0 PHYSIN=wlan0 PHYSOUT=eth0 MAC=************** SRC=192.168.0.15 DST=17.172.208.47 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=63737 PROTO=TCP SPT=58807 DPT=443 WINDOW=65535 RES=0x00 ACK FIN URGP=0  
Apr 10 21:32:03 NASHTPC kernel: [273846.070615] RULE 3 -- ACCEPT IN=br0 OUT=br0 PHYSIN=wlan0 PHYSOUT=eth0 MAC=**************** SRC=192.168.0.15 DST=17.172.208.47 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=2782 DF PROTO=TCP SPT=58808 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0  
Apr 10 21:32:03 NASHTPC kernel: [273846.776553] RULE 8 -- DENY IN=br0 OUT=br0 PHYSIN=wlan0 PHYSOUT=eth0 MAC=************** SRC=192.168.0.15 DST=17.172.208.47 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=10631 PROTO=TCP SPT=58807 DPT=443 WINDOW=65535 RES=0x00 ACK FIN URGP=0

It looks like the problem is that the firewall is dropping my ACK/FIN package. Rule 8 is a DENY ALL rule.

Any suggestions on how to fix this? Should I change rule 3 to something else to allow the traffic to flow freely?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

If you want traffic to flow unrestricted, then make it so:

iptables -A FORWARD -m physdev --physdev-is-bridged --physdev-in eth0 --physdev-out wlan0 -j ACCEPT
iptables -A FORWARD -m physdev --physdev-is-bridged --physdev-in wlan0 --physdev-out eth0 -j ACCEPT

For more information on the meaning of TCP flags, see: here

share|improve this answer
    
It works, thanks! –  Sun_Blood Apr 11 '13 at 18:56

You are forwarding only NEW state, not ACK FIN which are considered ESTABLISHED as everithing after the SYN/ACK packets

Could you try this:

$IPTABLES -N RULE_3
$IPTABLES -A FORWARD  -m physdev --physdev-is-bridged --physdev-in eth0 --physdev-out wlan0  -m state --state NEW,RELATED,ESTABLISHED  -j RULE_3
$IPTABLES -A FORWARD  -m physdev --physdev-is-bridged --physdev-in wlan0 --physdev-out eth0  -m state --state NEW,RELATED,ESTABLISHED  -j RULE_3
$IPTABLES -A RULE_3  -j LOG  --log-level info --log-prefix "RULE 3 -- ACCEPT "
$IPTABLES -A RULE_3  -j ACCEPT

Explanations here

share|improve this answer
    
This works good, the strange thing is that I already had a rule in the beginning that allows all related and established. But for some reason it was not trigged correctly. But I choose to remove the "state" part and now everything is allowed. –  Sun_Blood Apr 11 '13 at 18:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.