0

Can someone tell me, if I have rules that are not needed?

I am in particular unsure if

    $IPT -t nat -P PREROUTING ACCEPT                # is this required?
    $IPT -t nat -P INPUT ACCEPT                     # is this required?
    $IPT -t nat -P OUTPUT ACCEPT                    # is this required?

is needed.?

IPT='/sbin/iptables'

LAN_IP_NET="192.168.0.1/24"
WAN_IP="x.x.x.x"

LAN_NET="192.168.245.0/24"

CLIENT_NET1="192.168.245.128/25"  # 192.168.245.128 - 192.168.245.25
CLIENT_NET2="192.168.245.64/26"   # 192.168.245.64  - 192.168.245.12
CLIENT_NET3="192.168.245.32/27"   # 192.168.245.32  - 192.168.245.63
CLIENT_NET4="192.168.245.16/28"   # 192.168.245.16  - 192.168.245.31
CLIENT_NET5="192.168.245.8/29"    # 192.168.245.8   - 192.168.245.15

LAN_NIC="eth1"
WAN_NIC="eth0"

    # Flush everything
    $IPT -F
    $IPT -F -t nat
    $IPT -X
    $IPT -X -t nat


    # Enable packet forwarding
    echo 1 > /proc/sys/net/ipv4/ip_forward

    # Allow all outgoing
    $IPT -P OUTPUT ACCEPT
    $IPT -A OUTPUT -o lo -j ACCEPT

    # Filter rules
    $IPT -A INPUT -i lo -j ACCEPT
    $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    # Allow all traffic from LAN_NET on LAN_NIC
    $IPT -A INPUT -i $LAN_NIC -s $LAN_NET -j ACCEPT

    # Allow some services from the outside
    $IPT -A INPUT -i $WAN_NIC -p icmp --icmp-type echo-request -j ACCEPT
    $IPT -A INPUT -i $WAN_NIC -p tcp --dport ssh -j ACCEPT
    $IPT -A INPUT -i $WAN_NIC -p tcp --dport www -j ACCEPT

    $IPT -A INPUT -j REJECT



    # Masquerade 192.168.245.8 - 192.168.245.255
    $IPT -t nat -P PREROUTING ACCEPT                # is this required?
    $IPT -t nat -P INPUT ACCEPT                     # is this required?
    $IPT -t nat -P OUTPUT ACCEPT                    # is this required?

    $IPT -t nat -A POSTROUTING -s $CLIENT_NET1 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET2 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET3 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET4 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET5 -o $WAN_NIC -j MASQUERADE


    $IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

    # Forward 192.168.245.8 - 192.168.245.255. The first 7 IPs are reserved for failover etc
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET1 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET2 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET3 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET4 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET5 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -j REJECT

closed as too broad by Magellan, Tim Howland, Scott Pack, dawud, mdpc Oct 11 '13 at 15:24

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

1

Policy rules are unlike other rules, and all built-in chains have a policy. They are and implicit part of the chain and specify what to do if no rules in the chain match a packet. Setting the policy to a known value is a good practice.

You could try dropping the rules and seeing if the default policy is ACCEPT following a reboot. As long as the default policy remains ACCEPT, the commands are redundant. However, if someone changes the policy or the default policy changes, your firewall script will no longer do what you wish. Keep those rules even if it appears you don't need them.

Your best choice for a policy is to set it to whatever you want to happen to unmatched packets. For the default chains DROP or REJECT may be a better policy than ACCEPT. For the NAT chains, ACCEPT tends to be a good policy.

  • Excellent. I just noticed that I had -P PREROUTING ACCEPT. I suppose I should change that to -P POSTROUTING ACCEPT? – Sandra Oct 25 '11 at 10:34
  • You should replace INPUT with POSTROUTING. The three default NAT chains are PREROUTING, POSTROUTING, and OUTPUT. – BillThor Oct 25 '11 at 15:24
3

the -P rules are the "policy" rules. i.e: the default policy if none of the rules match. In your case they wont do anything because the last like is a reject all anyway, you could use a -P DROP and ditch that reject line also, however I do my firewall the same way you do currently because if you use a -P drop rule and then flush the table remotely using -F you still have the drop policy in place and it cuts out off your connection.

  • Does that mean I can remove the 3 rules I mentioned in the post of the post? – Sandra Oct 24 '11 at 16:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.