how to allow dhcp using iptables?

Question

My iptables rules are blocking the DHCP server from reaching VM's. How can I allow DHCP

here is my iptables rules

# Generated by iptables-save v1.4.19.1 on Wed Sep 11 03:02:42 2013
*nat
:PREROUTING ACCEPT [70:4483]
:INPUT ACCEPT [6:400]
:OUTPUT ACCEPT [23:2070]
:POSTROUTING ACCEPT [27:3033]
-A PREROUTING -i tun0 -p udp -m udp --dport 53 -j DNAT --to-destination 10.0.1.2
-A PREROUTING -i tun0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 10.0.1.2
-A PREROUTING -i tun0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.1.2
-A PREROUTING -i tun0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.0.1.2
-A PREROUTING -i tun0 -p tcp -m tcp --dport 22 -j DNAT --to-destination 10.0.1.2
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
COMMIT
# Completed on Wed Sep 11 03:02:42 2013
# Generated by iptables-save v1.4.19.1 on Wed Sep 11 03:02:42 2013
*mangle
:PREROUTING ACCEPT [19983:3461520]
:INPUT ACCEPT [18606:2786464]
:FORWARD ACCEPT [1395:678611]
:OUTPUT ACCEPT [18932:10655717]
:POSTROUTING ACCEPT [20327:11334328]
-A OUTPUT -o tun0 -j TTL --ttl-set 128
COMMIT
# Completed on Wed Sep 11 03:02:42 2013
# Generated by iptables-save v1.4.19.1 on Wed Sep 11 03:02:42 2013
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:SSH_WhiteList - [0:0]
:bad_packets - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_inbound - [0:0]
:tcp_outbound - [0:0]
:udp_inbound - [0:0]
:udp_outbound - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -j bad_packets
-A INPUT -d 224.0.0.1/32 -j ACCEPT
-A INPUT -s 10.0.1.0/24 -i eth0-gigabit -j ACCEPT
-A INPUT -d 10.0.1.255/32 -i eth0-gigabit -j ACCEPT
-A INPUT -s 10.0.1.0/24 -i eth1-gigabit -j ACCEPT
-A INPUT -d 10.0.1.255/32 -i eth1-gigabit -j ACCEPT
-A INPUT -s 10.0.1.0/24 -i eth2-gigabit -j ACCEPT
-A INPUT -d 10.0.1.255/32 -i eth2-gigabit -j ACCEPT
-A INPUT -s 10.0.1.0/24 -i eth3 -j ACCEPT
-A INPUT -d 10.0.1.255/32 -i eth3 -j ACCEPT
-A INPUT -s 10.0.3.0/24 -i virbr0 -j ACCEPT
-A INPUT -d 10.0.3.255/32 -i virbr0 -j ACCEPT
-A INPUT -i eth0-gigabit -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i eth1-gigabit -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i eth2-gigabit -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i eth3 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i eth0-gigabit -p udp -m udp --sport 1294 -j ACCEPT
-A INPUT -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i tun0 -p tcp -j tcp_inbound
-A INPUT -i tun0 -p udp -j udp_inbound
-A INPUT -i tun0 -p icmp -j icmp_packets
-A INPUT -m pkttype --pkt-type broadcast -j DROP
-A INPUT -j LOG --log-prefix "fp=INPUT:99 a=DROP "
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j SSH_WhiteList
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j LOG --log-prefix "Brute Force SSH Attacks " --log-level 6
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP
-A FORWARD -j bad_packets
-A FORWARD -i eth0-gigabit -p tcp -j tcp_outbound
-A FORWARD -i eth1-gigabit -p tcp -j tcp_outbound
-A FORWARD -i eth2-gigabit -p tcp -j tcp_outbound
-A FORWARD -i eth3 -p tcp -j tcp_outbound
-A FORWARD -i virbr0 -p tcp -j tcp_outbound
-A FORWARD -i eth0-gigabit -p udp -j udp_outbound
-A FORWARD -i eth1-gigabit -p udp -j udp_outbound
-A FORWARD -i eth2-gigabit -p udp -j udp_outbound
-A FORWARD -i eth3 -p udp -j udp_outbound
-A FORWARD -i virbr0 -p udp -j udp_outbound
-A FORWARD -i eth0-gigabit -j ACCEPT
-A FORWARD -i eth1-gigabit -j ACCEPT
-A FORWARD -i eth2-gigabit -j ACCEPT
-A FORWARD -i eth3 -j ACCEPT
-A FORWARD -i virbr0 -j ACCEPT
-A FORWARD -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j LOG --log-prefix "fp=FORWARD:99 a=DROP "
-A OUTPUT -p icmp -m state --state INVALID -j DROP
-A OUTPUT -s 127.0.0.1/32 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s 10.0.1.2/32 -j ACCEPT
-A OUTPUT -o eth0-gigabit -j ACCEPT
-A OUTPUT -s 10.0.1.3/32 -j ACCEPT
-A OUTPUT -o eth1-gigabit -j ACCEPT
-A OUTPUT -s 10.0.1.4/32 -j ACCEPT
-A OUTPUT -o eth2-gigabit -j ACCEPT
-A OUTPUT -s 10.0.1.5/32 -j ACCEPT
-A OUTPUT -o eth3 -j ACCEPT
-A OUTPUT -s 10.0.3.1/32 -j ACCEPT
-A OUTPUT -o virbr0 -j ACCEPT
-A OUTPUT -o tun0 -j ACCEPT
-A OUTPUT -j LOG --log-prefix "fp=OUTPUT:99 a=DROP "
-A SSH_WhiteList -s 46.102.247.54/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.247.41/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.246.179/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.245.38/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.244.211/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.244.145/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.244.107/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.242.120/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.241.186/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.240.145/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 46.102.243.82/32 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 10.0.1.0/24 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A SSH_WhiteList -s 10.0.0.0/24 -m recent --remove --name SSH --mask 255.255.255.255 --rsource -j ACCEPT
-A bad_packets -s 10.0.1.0/24 -i tun0 -j LOG --log-prefix "fp=bad_packets:2 a=DROP "
-A bad_packets -s 10.0.1.0/24 -i tun0 -j DROP
-A bad_packets -m state --state INVALID -j LOG --log-prefix "fp=bad_packets:1 a=DROP "
-A bad_packets -m state --state INVALID -j DROP
-A bad_packets -p tcp -j bad_tcp_packets
-A bad_packets -j RETURN
-A bad_tcp_packets -i eth0-gigabit -p tcp -j RETURN
-A bad_tcp_packets -i eth1-gigabit -p tcp -j RETURN
-A bad_tcp_packets -i eth2-gigabit -p tcp -j RETURN
-A bad_tcp_packets -i eth3 -p tcp -j RETURN
-A bad_tcp_packets -i virbr0 -p tcp -j RETURN
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "fp=bad_tcp_packets:1 a=DROP "
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j LOG --log-prefix "fp=bad_tcp_packets:2 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j LOG --log-prefix "fp=bad_tcp_packets:3 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j LOG --log-prefix "fp=bad_tcp_packets:4 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j LOG --log-prefix "fp=bad_tcp_packets:5 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "fp=bad_tcp_packets:6 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j LOG --log-prefix "fp=bad_tcp_packets:7 a=DROP "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A bad_tcp_packets -p tcp -j RETURN
-A icmp_packets -p icmp -f -j LOG --log-prefix "fp=icmp_packets:1 a=DROP "
-A icmp_packets -p icmp -f -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A icmp_packets -p icmp -j RETURN
-A tcp_inbound -p tcp -m tcp --dport 53 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 80 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 443 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 22 -j ACCEPT
-A tcp_inbound -p tcp -j RETURN
-A tcp_outbound -p tcp -m tcp --dport 194 -j REJECT --reject-with icmp-port-unreachable
-A tcp_outbound -p tcp -j ACCEPT
-A udp_inbound -p udp -m udp --dport 137 -j DROP
-A udp_inbound -p udp -m udp --dport 138 -j DROP
-A udp_inbound -p udp -m udp --dport 53 -j ACCEPT
-A udp_inbound -p udp -m udp --dport 1294 -j ACCEPT
-A udp_inbound -p udp -j RETURN
-A udp_outbound -p udp -j ACCEPT
COMMIT
# Completed on Wed Sep 11 03:02:42 2013

UPDATE: dhcp packets are coming from eth2-gigabit and going to virbr0. VMs interface virbr0 the contents of /proc/sys/net/ipv4/ip_forward is 1

Any help would be much appreciated.

Andrew Domaszek · Accepted Answer · 2013-09-11 03:03:57Z

Your ruleset makes it somewhat non-obvious which interfaces do what and what is relevant. Try to reduce it to a minimal state that works and add rules back until you figure out what is blocking it. If that isn't possible, shut off your other interfaces (not absolutely necessary, but reduces noise), zero your iptables counters and attempt a DHCP connection from the appropriate interface. Then check your counters and see which rules were matched.

# zero all counters
iptables -Z 
# view counters
iptables -nvL

If you need more help, you should post some information about your network topology like where the dhcp packets are coming from and going to, what interface your VMs are on, which, if any, interface they are bridged to, and the contents of /proc/sys/net/ipv4/ip_forward

thx for responding. I did add what you ask for and i am trying what you suggested. — Flan Alflani, Sep 11, 2013 at 3:58

Zoredache · Accepted Answer · 2013-09-11 05:54:43Z

2

dhcp packets are coming from eth2-gigabit and going to virbr0 ... the contents of /proc/sys/net/ipv4/ip_forward is 1

Sorry, but is your DHCP server on a different subnet/broadcast domain? That is your problem. If you need DHCP to cross a router, then you need a DHCP Relay Agent.

edited Sep 11, 2013 at 5:54

answered Sep 11, 2013 at 5:46

Zoredache

132k41 gold badges280 silver badges422 bronze badges

Add a comment |

Stack Exchange Network

how to allow dhcp using iptables?

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
linux
iptables
.

Hot Network Questions

how to allow dhcp using iptables?

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged linuxiptables.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
linux
iptables
.