fwbuilder, iptables & traceroute

This is a discussion on fwbuilder, iptables & traceroute within the Linux Security forums, part of the System Security and Security Related category; Hi, I have an iptables rule set to allow ICMP unreachables (Rule 0) and also allow all other traffic (Rule ...


Go Back   Usenet Forums > System Security and Security Related > Linux Security

FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #1 (permalink)  
Old 11-18-2004
Martin Roy
 
Posts: n/a
Default fwbuilder, iptables & traceroute

Hi,

I have an iptables rule set to allow ICMP unreachables (Rule 0) and
also allow all other traffic (Rule 1) (it's in a lab so I don't care
about security right now). I built my ruleset using fwbuilder.

Rule 0 allows me to traceroute to the firewall and it responds:

traceroute Dom01
traceroute: Warning: Multiple interfaces found; using 206.116.76.131 @
hme0
traceroute to nmDomNATfw01 (137.1.4.2), 30 hops max, 40 byte packets
1 206.116.76.156 2.389 ms 3.869 ms 3.309 ms
2 139.40.0.2 3.253 ms 0.769 ms 0.604 ms
3 137.1.4.2 0.611 ms 0.542 ms 0.579 ms

If I traceroute through the firewall, it does not respond to
traceroute:

traceroute gearLINNE_s01
traceroute: Warning: Multiple interfaces found; using 206.116.76.131 @
hme0
traceroute to gearLINNE_s01 (132.52.145.5), 30 hops max, 40 byte
packets
1 206.116.76.156 2.935 ms 2.385 ms 1.834 ms
2 139.40.0.2 3.161 ms 0.785 ms 0.559 ms
3 * * *
4 132.52.145.5 4.510 ms 1.262 ms 1.085 ms

How can I fix this?

Here is my rule set as generated by fwbuilder:

Rule 0(global)
+ iptables -N Cid419B703B.0
+ iptables -A INPUT -p icmp --icmp-type 3 -m state --state NEW -j
Cid419B703B.0
+ iptables -A Cid419B703B.0 -s 206.116.76.179 -j ACCEPT
+ iptables -A Cid419B703B.0 -s 206.116.76.128/27 -j ACCEPT
+ iptables -N Cid419B703B.1
+ iptables -A FORWARD -p icmp --icmp-type 3 -m state --state NEW -j
Cid419B703B.1
+ iptables -A Cid419B703B.1 -s 206.116.76.179 -j ACCEPT
+ iptables -A Cid419B703B.1 -s 206.116.76.128/27 -j ACCEPT
+ echo 'Rule 1(global)'
Rule 1(global)
+ iptables -A OUTPUT -m state --state NEW -j ACCEPT
+ iptables -A INPUT -m state --state NEW -j ACCEPT
+ iptables -A FORWARD -m state --state NEW -j ACCEPT
+ echo 1

Thanks

Martin
Reply With Quote
Reply
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On




All times are GMT +1. The time now is 12:58 PM.


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0