iptables & vypress

Hi,
I've got two networks, 192.168.1.0 and 192.168.4.0, that are connected
thru an ADSL and a couple of firewalls (with iptables). Now I've got
some problems with the Vypress Messenger, a chat program that
communicates using the 7777 port. The problem is that outgoing traffic
from 192.168.4.0 is permitted, while incoming not, thus 192.168.4.0 can
send messages to the other network, but the 192.168.1.0 cannot. The
following is an excerpt of the iptables configuration for the network
192.168.1.0 on the 192.168.4.0 firewall:

[root@firewall script]# iptables-save | grep 192.168.1
-A INPUT -s 192.168.4.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -p
tcp -j ACCEPT
-A INPUT -s 192.168.4.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -p
udp -j ACCEPT
-A FORWARD -s 192.168.4.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -p
tcp -j ACCEPT
-A FORWARD -s 192.168.4.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -p
udp -j ACCEPT
-A OUTPUT -d 192.168.1.0/255.255.255.0 -o eth1 -p udp -j ACCEPT


I cannot see what's wrong here, since all the traffic among 192.168.1.0
and 192.168.4.0 is permitted. I'm pretty sure the problem is in the
iptables of 192.168.4.0 network cause if I cannot directly (i.e.,
bypassing the iptable firewall) vypress works.
Any suggestion?

Thanks,
Luca

--
Luca Ferrari
fluca1978@infinito.it
-
To unsubscribe from this list: send the line "unsubscribe linux-admin" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Re: iptables & vypress

Let me get this right

LAN192.168.4.0-----------[eth0]---iptables-firewall--[eth1]- ------------LAN192.168.1.0

You need 2 set of rules for both directions

from .4. to .1.
iptables -A FORWARD -s 192.168.4.0/24 -d 192.168.1.0/24 -p tcp -j ACCEPT
iptables -A FORWARD -s 192.168.4.0/24 -d 192.168.1.0/24 -p udp -j ACCEPT

from .1. to .4.
iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.4.0/24 -p tcp -j ACCEPT
iptables -A FORWARD -s 192.168.4.0/24 -d 192.168.1.0/24 -p udp -j ACCEPT

INPUT & OUTPUT chains are for local processes (bind, squid, pppd) not forward.

I've never been a big fan of default DROP policy on chains. Sometimes
yes, it can be of some help but otherwise you don't want to be ssh-ing
to another country and accidentally invoking iptables -F :)


--Adrian
Oriflame Romania SysAdmin

On 7/14/05, Luca Ferrari wrote:
> Hi,
> I've got two networks, 192.168.1.0 and 192.168.4.0, that are connected
> thru an ADSL and a couple of firewalls (with iptables). Now I've got
> some problems with the Vypress Messenger, a chat program that
> communicates using the 7777 port. The problem is that outgoing traffic
> from 192.168.4.0 is permitted, while incoming not, thus 192.168.4.0 can
> send messages to the other network, but the 192.168.1.0 cannot. The
> following is an excerpt of the iptables configuration for the network
> 192.168.1.0 on the 192.168.4.0 firewall:
>
> [root@firewall script]# iptables-save | grep 192.168.1
> -A INPUT -s 192.168.4.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -p
> tcp -j ACCEPT
> -A INPUT -s 192.168.4.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -p
> udp -j ACCEPT
> -A FORWARD -s 192.168.4.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -p
> tcp -j ACCEPT
> -A FORWARD -s 192.168.4.0/255.255.255.0 -d 192.168.1.0/255.255.255.0 -p
> udp -j ACCEPT
> -A OUTPUT -d 192.168.1.0/255.255.255.0 -o eth1 -p udp -j ACCEPT
>
>
> I cannot see what's wrong here, since all the traffic among 192.168.1.0
> and 192.168.4.0 is permitted. I'm pretty sure the problem is in the
> iptables of 192.168.4.0 network cause if I cannot directly (i.e.,
> bypassing the iptable firewall) vypress works.
> Any suggestion?
>
> Thanks,
> Luca
>
> --
> Luca Ferrari
> fluca1978@infinito.it
> -
> To unsubscribe from this list: send the line "unsubscribe linux-admin" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
-
To unsubscribe from this list: send the line "unsubscribe linux-admin" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

Re: iptables & vypress

Adrian C.'s cat, on 15/07/2005 11.47, walking on the keyboard wrote:
> from .4. to .1.
> iptables -A FORWARD -s 192.168.4.0/24 -d 192.168.1.0/24 -p tcp -j ACCEPT
> iptables -A FORWARD -s 192.168.4.0/24 -d 192.168.1.0/24 -p udp -j ACCEPT
>
> from .1. to .4.
> iptables -A FORWARD -s 192.168.1.0/24 -d 192.168.4.0/24 -p tcp -j ACCEPT
> iptables -A FORWARD -s 192.168.4.0/24 -d 192.168.1.0/24 -p udp -j ACCEPT

Thanks for your help, but even adding the above rules (I guess the thrid
line has inverted the lan addresses) does not work. The strange thing is
that I can use ssh, telnet, and other services across the LANs, but not
this. And my iptables is not logging anything.
Any idea?

Thanks,
Luca


--
Luca Ferrari
fluca1978@infinito.it
-
To unsubscribe from this list: send the line "unsubscribe linux-admin" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html