iptables firewall (arno) and home network issues

mrshrimp · 2010-06-18 04:40:31

Complete newb here. Especially to networking.
I have two computers at home with a router. The linux machine has has a wired connection to the modem, the windows one is wireless. They both have a working connection to the internet.
The problem is pretty basic. The windows machine can only ping the other computer when the firewall is down. While its down I can share files using samba, which is what I was going for. However it would be nice if I could just change the firewall settings to allow for this, instead of having to stop it completely.
I'm using arno's iptables script because iptables itself just goes completely over my head, so if somebody knows what I need to do in the configuration file that would be great. An general iptables explaination would be helpful too.

fukawi2 · 2010-06-18 11:36:56

1) I don't know arnotables or whatever it is, but I know iptables
Allow pings:

iptables -I INPUT -p icmp --icmp-type=echo-request -j ACCEPT
iptables -I OUTPUT -p icmp --icmp-type=echo-reply -j ACCEPT

Allow samba:

iptables -I INPUT -p tcp -m multiport --dports 139,445 -j ACCEPT
iptables -I INPUT -p udp -m multiport --dports 137,138 -j ACCEPT

iptables consists of 3 'tables' (filter, nat and mangle). Each table consists of multiple 'chains' -- there are several default chains for each table, and you can create your own new ones. 'filter' is the one you mainly need to work with until you start doing kung-fu iptables

Each iptables command can be broken into a few parts:

1) iptables = the command itself (duh )

2) -A or -D or -I etc = A, D, I etc are how you want this rule to alter the chain; Append, Delete, Insert. There's also -N, -X, -F etc but I'll leave that to the man page

3) INPUT or OUTPUT or FORWARD or <other> = The name of the chain you want to work on. INPUT is traffic destined to this machine. OUTPUT is traffic that originates on this machine. FORWARD is traffic that originated somewhere else, is not destined for this box, but is just 'passing through' (Generally not the case on desktop machines). <other> could be any chain you've created yourself.

4) {You can put a number here if you're using -I or -D to reference the rule number you want to Delete, or where you want to Insert it.}

5) {Here is where you put the 'match' criteria for your rule. There are a few 'standard' matches that iptables can make such as -p protocol, -d destination address, -s source address. Everything else is provided by a module, which needs to be loaded using a -m switch (eg, `-m state` to load the 'state' module). After you've 'loaded' a module, then you can use the switches that module provides (eg, `--state` provided by the state module). You can mix and match as many matching criteria as you like.}

6) {Finally, you use a -j (for 'jump') to tell iptables what to do with this packet *if it matches all* your 'match' criteria. There is currently no way to do OR in rules. You'll need 2 rules if you need to OR some match criteria. Again, there are a few jump targets provided as standard such as:
REJECT - send a packet back saying we refuse to accept the packet (return to sender)
DROP - just drop it and don't send anything back (pretend we never even saw it)
ACCEPT - allow the packet through
Any custom chains you have created can also be used as a target.

Example: Create a new chain to handle the things we want to accept on this machine, and rejecting anything else with a rejection message back to the source.

iptables -N SERVICES
iptables -A SERVICES -p tcp --dport 80 -j ACCEPT
iptables -A SERVICES -p tcp --dport 21 -j ACCEPT
iptables -A SERVICES -p icmp --icmp-type=echo-request -j ACCEPT
iptables -A SERVICES -j REJECT
iptables -I INPUT -m state --state NEW -j SERVICES

1. Create a New custom chain called "SERVICES"
2. Append a rule to our new SERVICES chain that matches any 'tcp' packets destined for port 80 (eg, http) and ACCEPT it.
3. Append another rule to our SERVICES chain that matches any 'tcp' packets destined for port 21 (eg, ftp) and ACCEPT it.
4. Append another rule to our SERVICES chain that matches any 'icmp' packets of type 'echo-request' (eg, ping) and ACCEPT it.
5. Append one more rule to our SERVICES chain that matches anything else and REJECTS it.
6. Insert a rule to the INPUT chain (traffic destined for this machine), match it only if it is "NEW" (using the 'state' module) and the Jump to our custom "SERVICES" chain

Final note: Target's (what we 'jump' to using -j) can be terminating or non-terminating. Terminating targets stop processing any more rules for this packet. Non-terminating targets allow further rules to keep processing. Most targets are terminating (eg, ACCEPT, REJECT, DROP) but some a non-terminating (eg, LOG). Jumping to another chain (eg, rule 6 above) is non-terminating, but the rules continue in the new chain, until it either:
1) it matches a terminating rule (rules rules 2-5 above); or
2) it reaches the end of the chain; at which point it returns to where it came from and keep processing more rules; or
3) it matches rule with a RETURN target -- this is non-terminating and sends processing back to where we were in the previous chain, even if there are still more rules in the current chain.
In other words, ORDER IS IMPORTANT. If you Append a rule to a chain, and wonder why it doesn't work even after you've made sure it is correct 100 times, there's probably a rule BEFORE it that has a terminating target as it's jump.
To see what rules are configured, use the command `iptables -nvL` -- this will show you counters of how many packets have matched a certain rule in the first column, so you can see if the problem is your rules, or something else

Last edited by fukawi2 (2010-06-18 11:40:51)

fukawi2 · 2010-06-18 11:38:32

(doh, quoted instead of editing last post... Idiot)

Last edited by fukawi2 (2010-06-18 11:39:33)

mrshrimp · 2010-06-18 15:44:16

Thanks fukawi2. That made sense. I only had to do a little reading of man iptables and I actually had an idea of what I was looking for this time.

This is what I did:

iptables -I INPUT -s 192.168.1.100/24 -j INT_INPUT_CHAIN
iptables -A INT_INPUT_CHAIN -p tcp -m multiport --dports 139,445 -j ACCEPT
iptables -A INT_INPUT_CHAIN -p udp -m multiport --dports 137,138 -j ACCEPT
iptables -A INT_INPUT_CHAIN -j REJECT

INT_INPUT_CHAIN was an empty chain. So this does work, and what it's hopefully doing is checking the source to see if it's the windows machine, and then only accepting it if it's through the ports samba uses.

fukawi2 · 2010-06-20 05:30:38

mrshrimp wrote:

INT_INPUT_CHAIN was an empty chain. So this does work, and what it's hopefully doing is checking the source to see if it's the windows machine, and then only accepting it if it's through the ports samba uses.

Glad it made sense.... I usually have more luck with late night posting than early morning posting

192.168.1.100/24 matches anything in the 192.168.1 network (ie, 192.168.1.x) so it will allow anything on your LAN. If you want to restrict it to only your windows machine (I'm assuming that's 192.168.1.100) then you want to use /32 instead of /24

Install `ipcalc` from "extra" -- it's a great help at checking subnet masks and CIDR masks

kgas · 2010-06-20 08:12:21

I have the following setup in the customrules for the arno-iptables to allow samba shares.

# Put any custom (iptables) rules here down below:
##################################################
 #Allow connections for samba shares..
iptables -A INPUT -p udp -m udp -s 192.168.1.0/24 --dport 137 -j ACCEPT 
iptables -A INPUT -p udp -m udp -s 192.168.1.0/24 --dport 138 -j ACCEPT 
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 192.168.1.0/24 --dport 139 -j ACCEPT 
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 192.168.0.0/24 --dport 445 -j ACCEPT 
iptables -A INPUT -p udp -m udp -s 192.168.1.0/24 --dport 137 -j ACCEPT 
iptables -A INPUT -p udp -m udp -s 192.168.1.0/24 --dport 138 -j ACCEPT 
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 192.168.1.0/24 --dport 139 -j ACCEPT 
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 192.168.1.0/24 --dport 445 -j ACCEPT 

# Allow ssh connections in. Uncomment if needed.
iptables -A INPUT -p tcp -m tcp --dport <port>

modify the rules that suites you (default ports used)

Arch Linux

#1 2010-06-18 04:40:31

iptables firewall (arno) and home network issues

#2 2010-06-18 11:36:56

Re: iptables firewall (arno) and home network issues

#3 2010-06-18 11:38:32

Re: iptables firewall (arno) and home network issues

#4 2010-06-18 15:44:16

Re: iptables firewall (arno) and home network issues

#5 2010-06-20 05:30:38

Re: iptables firewall (arno) and home network issues

#6 2010-06-20 08:12:21

Re: iptables firewall (arno) and home network issues

Board footer