1

i'm trying to configure a dedicated firewall using iptables,

see here my network diagram

My firewall have 5 interfaces 4 for network and other for wan

  • WAN eth0 192.168.1.2/24
  • Lan1 eth1 192.150.1.1/24
  • Lan2 eth2 192.131.1.1/24

I have the forwarding enabled

root@FW # cat /proc/sys/net/ipv4/ip_forward 1

also i've created the following nat rules in order to allow traffic to internet (trough router 192.168.1.1)

iptables -A POSTROUTING -t nat -o eth0 -s 192.131.1.0/24 -d 0/0 -j MASQUERADE

iptables -A POSTROUTING -t nat -o eth0 -s 192.150.1.0/24 -d 0/0 -j MASQUERADE

with policy by default "ACCEPT" we have access to internet, but when i change the policy FORWARD to DROP. Then starts my problem. I added the following rules in order to allow only the http/s and dns traffic

iptables -A FORWARD -s 192.131.1.0/24 -i eth2 -o eth0 -p tcp -m multiport --dports 80,443,53 -m state --state NEW,RELATED,ESTABLISHED  -j ACCEPT
iptables -A FORWARD -s 192.131.1.0/24 -i eth2 -o eth0 -p udp -m multiport --dports 53 -m state --state NEW,RELATED,ESTABLISHED  -j ACCEPT
iptables -A FORWARD -s 192.150.1.0/24 -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,53 -m state --state NEW,RELATED,ESTABLISHED  -j ACCEPT
iptables -A FORWARD -s 192.150.1.0/24 -i eth1 -o eth0 -p udp -m multiport --dports 53 -m state --state NEW,RELATED,ESTABLISHED  -j ACCEPT

This are my actual ip route table

root@FW ~ # ip route show
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel  scope link  src 192.168.1.2 
192.130.1.0/24 via 192.131.1.2 dev eth2 
192.131.1.0/24 dev eth2  proto kernel  scope link  src 192.131.1.1 
192.150.1.0/24 dev eth1  proto kernel  scope link  src 192.150.1.1

Looks like that the traffic arrives to the DNS but never return to the host. Crhome returns DNS_PROBE_FINISHED_NO_INTERNET. I provide a tcpdump output from eth1 requests 192.150.1.0/24 to 8.8.8.8 192.168.1.0/24

root@FW ~ # tcpdump -vvv -i eth1
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
21:41:15.611604 IP (tos 0x0, ttl 128, id 9100, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53613 > 65.55.223.33.http: Flags [S], cksum 0x0ee2 (correct), seq 2855330165, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:16.051447 IP (tos 0x0, ttl 128, id 15625, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53614 > 157.55.235.152.https: Flags [S], cksum 0xf970 (correct), seq 3105324572, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:16.339182 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has FW (02:53:02:81:98:91 (oui Unknown)) tell 192.150.1.200, length 46
21:41:16.339261 ARP, Ethernet (len 6), IPv4 (len 4), Reply FW is-at 02:53:02:81:98:91 (oui Unknown), length 28
21:41:16.462608 IP (tos 0x0, ttl 128, id 9473, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53615 > 157.56.52.16.40015: Flags [S], cksum 0x8130 (correct), seq 2382446181, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:16.462989 IP (tos 0x0, ttl 128, id 30784, offset 0, flags [none], proto UDP (17), length 61)
    192.150.1.200.63043 > 64.4.23.167.40004: [udp sum ok] UDP, length 33
21:41:16.463147 IP (tos 0x0, ttl 128, id 3241, offset 0, flags [none], proto UDP (17), length 61)
    192.150.1.200.63043 > 157.55.235.165.40001: [udp sum ok] UDP, length 33
21:41:16.463235 IP (tos 0x0, ttl 128, id 5293, offset 0, flags [none], proto UDP (17), length 64)
    192.150.1.200.63043 > 157.56.52.31.40027: [udp sum ok] UDP, length 36
21:41:16.873853 IP (tos 0x0, ttl 128, id 32090, offset 0, flags [none], proto UDP (17), length 63)
    192.150.1.200.54744 > 8.8.8.8.domain: [udp sum ok] 22934+ A? gfwsl.geforce.com. (35)
21:41:16.873957 IP (tos 0x0, ttl 128, id 31098, offset 0, flags [none], proto UDP (17), length 63)
    192.150.1.200.54744 > 8.8.4.4.domain: [udp sum ok] 22934+ A? gfwsl.geforce.com. (35)
21:41:17.001636 IP (tos 0x0, ttl 128, id 9101, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53611 > 65.55.223.33.https: Flags [S], cksum 0x22d2 (correct), seq 900743325, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:17.413618 IP (tos 0x0, ttl 128, id 16465, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53605 > 157.55.130.146.40017: Flags [S], cksum 0x668f (correct), seq 2041721579, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:17.414671 IP (tos 0x0, ttl 128, id 4478, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53604 > 65.55.223.14.40012: Flags [S], cksum 0xf23d (correct), seq 1566622488, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:17.441620 IP (tos 0x0, ttl 128, id 15628, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53612 > 157.55.235.152.40017: Flags [S], cksum 0xbdc7 (correct), seq 1961780058, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:17.662269 IP (tos 0x0, ttl 128, id 15629, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53616 > 157.55.235.152.http: Flags [S], cksum 0xaf6b (correct), seq 2477190907, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:18.074678 IP (tos 0x0, ttl 128, id 9475, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53617 > 157.56.52.16.https: Flags [S], cksum 0xac36 (correct), seq 923010287, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:18.436097 IP (tos 0x0, ttl 128, id 31792, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53618 > 157.55.56.150.40028: Flags [S], cksum 0x1b8d (correct), seq 4028513622, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:18.447987 IP (tos 0x0, ttl 128, id 32092, offset 0, flags [none], proto UDP (17), length 56)
    192.150.1.200.63422 > 8.8.8.8.domain: [udp sum ok] 40049+ A? google.com. (28)
21:41:18.448151 IP (tos 0x0, ttl 128, id 32093, offset 0, flags [none], proto UDP (17), length 56)
    192.150.1.200.63423 > 8.8.8.8.domain: [udp sum ok] 36172+ A? google.com. (28)
21:41:18.620387 IP (tos 0x0, ttl 128, id 9103, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53613 > 65.55.223.33.http: Flags [S], cksum 0x0ee2 (correct), seq 2855330165, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:18.765698 IP (tos 0x0, ttl 128, id 7901, offset 0, flags [none], proto UDP (17), length 229)
    192.150.1.200.netbios-dgm > 192.150.1.255.netbios-dgm: [udp sum ok] 
>>> NBT UDP PACKET(138) Res=0x110E ID=0x975E IP=192 (0xc0).169 (0xa9).1 (0x1).200 (0xc8) Port=138 (0x8a) Length=187 (0xbb) Res2=0x0
SourceName=LAPTOP-99GNDJNH NameType=0x20 (Server)
DestName=WORKGROUP       NameType=0x1D (Master Browser)

SMB PACKET: SMBtrans (REQUEST)
SMB Command   =  0x25
Error class   =  0x0
Error code    =  0 (0x0)
Flags1        =  0x0
Flags2        =  0x0
Tree ID       =  0 (0x0)
Proc ID       =  0 (0x0)
UID           =  0 (0x0)
MID           =  0 (0x0)
Word Count    =  17 (0x11)
TotParamCnt=0 (0x0) 
TotDataCnt=33 (0x21) 
MaxParmCnt=0 (0x0) 
MaxDataCnt=0 (0x0)
MaxSCnt=0 (0x0) 
TransFlags=0x0 
Res1=0x3E8 
Res2=0x0 
Res3=0x0
ParamCnt=0 (0x0) 
ParamOff=0 (0x0) 
DataCnt=33 (0x21) 
DataOff=86 (0x56) 
SUCnt=3 (0x3)
Data: (6 bytes)
[000] 01 00 00 00 02 00                                 \0x01\0x00\0x00\0x00\0x02\0x00 
smb_bcc=50
Name=\MAILSLOT\BROWSE
BROWSE PACKET
BROWSE PACKET:
Type=0x1 (HostAnnouncement)
UpdateCount=0x8000
Res1=0xFC
AnnounceInterval=10 (0xa)
Name=LAPTOP-99GNDJNH NameType=0x00 (Workstation)
MajorVersion=0xA
MinorVersion=0x0
ServerType=0x1003
ElectionVersion=0x10F
BrowserConstant=0xAA55
Data: (1 bytes)
[000] 00                                                \0x00 



21:41:19.027797 IP (tos 0x0, ttl 128, id 4480, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53606 > 65.55.223.14.https: Flags [S], cksum 0x8ea0 (correct), seq 1025311113, win 65535, options [mss 1460,nop,nop,sackOK], length 0
21:41:19.027893 IP (tos 0x0, ttl 128, id 16469, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53607 > 157.55.130.146.https: Flags [S], cksum 0xda29 (correct), seq 4202952979, win 65535, options [mss 1460,nop,nop,sackOK], length 0
21:41:19.052327 IP (tos 0x0, ttl 128, id 15632, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53614 > 157.55.235.152.https: Flags [S], cksum 0xf970 (correct), seq 3105324572, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:19.458582 IP (tos 0x0, ttl 128, id 31101, offset 0, flags [none], proto UDP (17), length 56)
    192.150.1.200.63425 > 8.8.4.4.domain: [udp sum ok] 32283+ A? google.com. (28)
21:41:19.458765 IP (tos 0x0, ttl 128, id 31102, offset 0, flags [none], proto UDP (17), length 56)
    192.150.1.200.63426 > 8.8.4.4.domain: [udp sum ok] 53895+ A? google.com. (28)
21:41:19.463303 IP (tos 0x0, ttl 128, id 9476, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53615 > 157.56.52.16.40015: Flags [S], cksum 0x8130 (correct), seq 2382446181, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:19.692372 IP (tos 0x0, ttl 128, id 9477, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53619 > 157.56.52.16.http: Flags [S], cksum 0x1d9f (correct), seq 719167766, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:20.061944 IP (tos 0x0, ttl 128, id 31795, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53620 > 157.55.56.150.https: Flags [S], cksum 0x211b (correct), seq 3246391558, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:20.630606 IP (tos 0x0, ttl 128, id 4481, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53608 > 65.55.223.14.http: Flags [S], cksum 0xb3e2 (correct), seq 665768734, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:20.630726 IP (tos 0x0, ttl 128, id 16472, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53609 > 157.55.130.146.http: Flags [S], cksum 0xb4b9 (correct), seq 3498846692, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:20.662191 IP (tos 0x0, ttl 128, id 15635, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53616 > 157.55.235.152.http: Flags [S], cksum 0xaf6b (correct), seq 2477190907, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:20.884881 IP (tos 0x0, ttl 128, id 31103, offset 0, flags [none], proto UDP (17), length 63)
    192.150.1.200.57774 > 8.8.4.4.domain: [udp sum ok] 38873+ A? app.standsapp.org. (35)
21:41:21.075165 IP (tos 0x0, ttl 128, id 9478, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53617 > 157.56.52.16.https: Flags [S], cksum 0xac36 (correct), seq 923010287, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:21.394390 IP (tos 0x0, ttl 128, id 9106, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53610 > 65.55.223.33.40008: Flags [S], cksum 0x39e9 (correct), seq 3395956302, win 65535, options [mss 1460,nop,nop,sackOK], length 0
21:41:21.436455 IP (tos 0x0, ttl 128, id 31798, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53618 > 157.55.56.150.40028: Flags [S], cksum 0x1b8d (correct), seq 4028513622, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:21.673410 IP (tos 0x0, ttl 128, id 31799, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53621 > 157.55.56.150.http: Flags [S], cksum 0xaffe (correct), seq 2772406221, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:21.885789 IP (tos 0x0, ttl 128, id 32097, offset 0, flags [none], proto UDP (17), length 63)
    192.150.1.200.57774 > 8.8.8.8.domain: [udp sum ok] 38873+ A? app.standsapp.org. (35)
21:41:22.340262 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has FW (02:53:02:81:98:91 (oui Unknown)) tell 192.150.1.200, length 46
21:41:22.340331 ARP, Ethernet (len 6), IPv4 (len 4), Reply FW is-at 02:53:02:81:98:91 (oui Unknown), length 28
21:41:22.693442 IP (tos 0x0, ttl 128, id 9479, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53619 > 157.56.52.16.http: Flags [S], cksum 0x1d9f (correct), seq 719167766, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:22.885826 IP (tos 0x0, ttl 128, id 31105, offset 0, flags [none], proto UDP (17), length 63)
    192.150.1.200.57774 > 8.8.4.4.domain: [udp sum ok] 38873+ A? app.standsapp.org. (35)
21:41:23.002899 IP (tos 0x0, ttl 128, id 9107, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53611 > 65.55.223.33.https: Flags [S], cksum 0x36e1 (correct), seq 900743325, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:23.061622 IP (tos 0x0, ttl 128, id 31800, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53620 > 157.55.56.150.https: Flags [S], cksum 0x211b (correct), seq 3246391558, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:23.442415 IP (tos 0x0, ttl 128, id 15639, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53612 > 157.55.235.152.40017: Flags [S], cksum 0xd1d6 (correct), seq 1961780058, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:23.464332 IP (tos 0x0, ttl 255, id 21983, offset 0, flags [none], proto UDP (17), length 419)
    192.150.1.200.mdns > 224.0.0.251.mdns: [udp sum ok] 0*- [0q] 8/0/4 200.1.169.192.in-addr.arpa. (Cache flush) [2m] PTR LAPTOP-99GNDJNH.local., 1.8.F.5.B.2.6.7.1.9.E.6.9.9.4.C.0.0.0.0.0.0.0.0.0.0.0.0.0.8.E.F.ip6.arpa. (Cache flush) [2m] PTR LAPTOP-99GNDJNH.local., LAPTOP-99GNDJNH.local. (Cache flush) [2m] A 192.150.1.200, LAPTOP-99GNDJNH.local. (Cache flush) [2m] AAAA fe80::c499:6e91:762b:5f81, LAPTOP-99GNDJNH._nvstream._tcp.local. (Cache flush) [1h15m] TXT "", _services._dns-sd._udp.local. [1h15m] PTR _nvstream._tcp.local., _nvstream._tcp.local. [1h15m] PTR LAPTOP-99GNDJNH._nvstream._tcp.local., LAPTOP-99GNDJNH._nvstream._tcp.local. (Cache flush) [2m] SRV LAPTOP-99GNDJNH.local.:47989 0 0 ar: 200.1.169.192.in-addr.arpa. (Cache flush) [2m] NSEC, 1.8.F.5.B.2.6.7.1.9.E.6.9.9.4.C.0.0.0.0.0.0.0.0.0.0.0.0.0.8.E.F.ip6.arpa. (Cache flush) [2m] NSEC, LAPTOP-99GNDJNH.local. (Cache flush) [2m] NSEC, LAPTOP-99GNDJNH._nvstream._tcp.local. (Cache flush) [1h15m] NSEC (391)
21:41:24.620554 IP (tos 0x0, ttl 128, id 9108, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53613 > 65.55.223.33.http: Flags [S], cksum 0x22f1 (correct), seq 2855330165, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:24.674211 IP (tos 0x0, ttl 128, id 31802, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53621 > 157.55.56.150.http: Flags [S], cksum 0xaffe (correct), seq 2772406221, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:24.886861 IP (tos 0x0, ttl 128, id 32099, offset 0, flags [none], proto UDP (17), length 63)
    192.150.1.200.57774 > 8.8.8.8.domain: [udp sum ok] 38873+ A? app.standsapp.org. (35)
21:41:24.887037 IP (tos 0x0, ttl 128, id 31107, offset 0, flags [none], proto UDP (17), length 63)
    192.150.1.200.57774 > 8.8.4.4.domain: [udp sum ok] 38873+ A? app.standsapp.org. (35)
21:41:25.053331 IP (tos 0x0, ttl 128, id 15641, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53614 > 157.55.235.152.https: Flags [S], cksum 0x0d80 (correct), seq 3105324572, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:25.464672 IP (tos 0x0, ttl 128, id 9480, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53615 > 157.56.52.16.40015: Flags [S], cksum 0x953f (correct), seq 2382446181, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:25.613906 IP (tos 0x0, ttl 128, id 4218, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53622 > 65.55.223.37.40003: Flags [S], cksum 0x4dec (correct), seq 994407766, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:26.661518 IP (tos 0x0, ttl 128, id 15642, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53616 > 157.55.235.152.http: Flags [S], cksum 0xc37a (correct), seq 2477190907, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:26.992828 IP (tos 0x0, ttl 128, id 31108, offset 0, flags [none], proto UDP (17), length 65)
    192.150.1.200.64992 > 8.8.4.4.domain: [udp sum ok] 21716+ A? ws12.gti.mcafee.com. (37)
21:41:26.998580 IP (tos 0x0, ttl 128, id 32102, offset 0, flags [none], proto UDP (17), length 56)
    192.150.1.200.64993 > 8.8.8.8.domain: [udp sum ok] 35561+ A? google.com. (28)
21:41:26.998842 IP (tos 0x0, ttl 128, id 32103, offset 0, flags [none], proto UDP (17), length 56)
    192.150.1.200.64994 > 8.8.8.8.domain: [udp sum ok] 185+ A? google.com. (28)
21:41:27.010390 IP (tos 0x0, ttl 128, id 31111, offset 0, flags [none], proto UDP (17), length 65)
    192.150.1.200.62055 > 8.8.4.4.domain: [udp sum ok] 60785+ AAAA? ws12.gti.mcafee.com. (37)
21:41:27.074715 IP (tos 0x0, ttl 128, id 9481, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53617 > 157.56.52.16.https: Flags [S], cksum 0xc045 (correct), seq 923010287, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:27.224280 IP (tos 0x0, ttl 128, id 4219, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53623 > 65.55.223.37.https: Flags [S], cksum 0x2bd4 (correct), seq 1595412003, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:27.450803 IP (tos 0x0, ttl 128, id 31805, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53618 > 157.55.56.150.40028: Flags [S], cksum 0x2f9c (correct), seq 4028513622, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:27.850386 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has FW (02:53:02:81:98:91 (oui Unknown)) tell 192.150.1.200, length 46
21:41:27.850448 ARP, Ethernet (len 6), IPv4 (len 4), Reply FW is-at 02:53:02:81:98:91 (oui Unknown), length 28
21:41:27.994381 IP (tos 0x0, ttl 128, id 32105, offset 0, flags [none], proto UDP (17), length 65)
    192.150.1.200.64992 > 8.8.8.8.domain: [udp sum ok] 21716+ A? ws12.gti.mcafee.com. (37)
21:41:28.010271 IP (tos 0x0, ttl 128, id 32106, offset 0, flags [none], proto UDP (17), length 65)
    192.150.1.200.62055 > 8.8.8.8.domain: [udp sum ok] 60785+ AAAA? ws12.gti.mcafee.com. (37)
21:41:28.010401 IP (tos 0x0, ttl 128, id 31114, offset 0, flags [none], proto UDP (17), length 56)
    192.150.1.200.62057 > 8.8.4.4.domain: [udp sum ok] 34410+ A? google.com. (28)
21:41:28.010474 IP (tos 0x0, ttl 128, id 31115, offset 0, flags [none], proto UDP (17), length 56)
    192.150.1.200.62058 > 8.8.4.4.domain: [udp sum ok] 56428+ A? google.com. (28)
21:41:28.619868 IP (tos 0x0, ttl 128, id 4220, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53622 > 65.55.223.37.40003: Flags [S], cksum 0x4dec (correct), seq 994407766, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:28.704219 IP (tos 0x0, ttl 128, id 9482, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53619 > 157.56.52.16.http: Flags [S], cksum 0x31ae (correct), seq 719167766, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:28.852916 IP (tos 0x0, ttl 128, id 4221, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53624 > 65.55.223.37.http: Flags [S], cksum 0x680d (correct), seq 3601685438, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:28.888538 IP (tos 0x0, ttl 128, id 32109, offset 0, flags [none], proto UDP (17), length 63)
    192.150.1.200.57774 > 8.8.8.8.domain: [udp sum ok] 38873+ A? app.standsapp.org. (35)
21:41:28.888619 IP (tos 0x0, ttl 128, id 31117, offset 0, flags [none], proto UDP (17), length 63)
    192.150.1.200.57774 > 8.8.4.4.domain: [udp sum ok] 38873+ A? app.standsapp.org. (35)
21:41:29.004117 IP (tos 0x0, ttl 128, id 31118, offset 0, flags [none], proto UDP (17), length 65)
    192.150.1.200.64992 > 8.8.4.4.domain: [udp sum ok] 21716+ A? ws12.gti.mcafee.com. (37)
21:41:29.020027 IP (tos 0x0, ttl 128, id 31119, offset 0, flags [none], proto UDP (17), length 65)
    192.150.1.200.62055 > 8.8.4.4.domain: [udp sum ok] 60785+ AAAA? ws12.gti.mcafee.com. (37)
21:41:29.061880 IP (tos 0x0, ttl 128, id 31806, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53620 > 157.55.56.150.https: Flags [S], cksum 0x352a (correct), seq 3246391558, win 8192, options [mss 1460,nop,nop,sackOK], length 0
21:41:30.223919 IP (tos 0x0, ttl 128, id 4222, offset 0, flags [DF], proto TCP (6), length 52)
    192.150.1.200.53623 > 65.55.223.37.https: Flags [S], cksum 0x2bd4 (correct), seq 1595412003, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
21:41:30.673826 IP (tos 0x0, ttl 128, id 31807, offset 0, flags [DF], proto TCP (6), length 48)
    192.150.1.200.53621 > 157.55.56.150.http: Flags [S], cksum 0xc40d (correct), seq 2772406221, win 8192, options [mss 1460,nop,nop,sackOK], length 0
^C
77 packets captured
77 packets received by filter

Anyone can see which thing i don't see to solve this? thx in advance.

P.D my disto is Debian but i think that is not relevant

EDIT to ad iptables -S

root@FW ~ # iptables -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -s 192.168.1.7/32 -d 192.168.1.2/32 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.131.1.0/24 -i eth2 -o eth0 -p udp -m multiport --dports 53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.131.1.0/24 -i eth2 -o eth0 -p tcp -m multiport --dports 80,443,53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.150.1.0/24 -i eth1 -o eth0 -p tcp -m multiport --dports 80,443,53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.131.1.0/24 -i eth1 -o eth0 -p udp -m multiport --dports 53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.150.1.0/24 -i eth1 -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -s 192.168.1.2/32 -d 192.168.1.7/32 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

root@FW ~ # iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -s 192.150.1.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.131.1.0/24 -o eth0 -j MASQUERADE
2
  • Please show output for iptables -S. Commented Jul 11, 2017 at 20:57
  • this is my actual iptables table i edit the post to add the output for fiter and nat tables
    – MMG
    Commented Jul 11, 2017 at 23:24

2 Answers 2

0

I can't see a rule allowing the returning traffic to be forwarded - something like -A FORWARD -i eth0 --state RELATED,ESTABLISHED -j ACCEPT.

Try being less restrictive in the fist instance, then limit access once that works. Does something like this work for you:

-P FORWARD ALLOW -t nat -I POSTROUTING -o eth0 -j MASQUERADE

Once you've got it working in the simplest way you can, then try restricting traffic by source, destination and protocol line by line and see what works and what doesn't.

3
  • yes there are like this two rules -A FORWARD -s 192.131.1.0/24 -i eth2 -o eth0 -p udp -m multiport --dports 53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 192.131.1.0/24 -i eth2 -o eth0 -p tcp -m multiport --dports 80,443,53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
    – MMG
    Commented Jul 12, 2017 at 20:53
  • Those 2 rules are both outbound traffic. You need a separate rule to allow the replies back in Commented Jul 12, 2017 at 21:13
  • oh you're in truth, by adding -A FORWARD -i eth0 -o eth2 -m state --state RELATED,ESTABLISHED -j ACCEPT now works but if i want concrete more like adding -A FORWARD -i eth0 -o eth2 -d 192.130.1.0/24 -p tcp -m multiport --dports 80,443,53 -m state --state RELATED,ESTABLISHED -j ACCEPT and the same for the udp 53 port don't work, do you know why?
    – MMG
    Commented Jul 13, 2017 at 17:52
0

The connection uses a random/dynamic put number on the client end so you can't for the return traffic the same way. Just rely on established, related - this will effectively block any other traffic.

1
  • thx for your help!
    – MMG
    Commented Jul 13, 2017 at 19:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .