I am having two NIC on linux box ( hereafter by name INTserver). I have set this box as router ( for servicing internet services to my clients), webserver, FTP server. This box is connected to my ISP via ADSL router.
Now it is serving fine as webserver, FTP for external clients/Public and providing internet to my LAN Clients.
In order to have security, to start with i have implemented a basic rule of iptables on the same server.
Rules are below :
#comments
#LanIP - 172.16.0.0 - 255 / 255.255.0.0 - alias - eth0
#static IP - xx.xx.xx.xx - alias eth1 - external NIC
#172.16.0.1 - alias - eth0 - internal NIC
#(1) policies ( default)
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#(2) User-defined chain for ACCEPTED TCP packets
iptables -N okay
iptables -A okay -p TCP --syn -j ACCEPT
iptables -A okay -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A okay -p TCP -j DROP
#(3) INPUT chain rules
# Rules for incoming packets from LAN
iptables -A INPUT -p ALL -i eth0 -s 172.16.0.0/255.255.0.0 -j ACCEPT
iptables -A INPUT -p ALL -i lo -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p ALL -i lo -s 172.16.0.1 -j ACCEPT
iptables -A INPUT -p ALL -i lo -s xx.xx.xx.xx -j ACCEPT
iptables -A INPUT -p ALL -i eth0 -d 172.16.0.255 -j ACCEPT
# Rules for incoming packets from the internet
# Packets for established connections
iptables -A INPUT -p ALL -d xx.xx.xx.xx -m state --state ESTABLISHED,RELATED -j ACCEPT
#Rules for incoming packets from the internet to LAN
iptables -A INPUT -p tcp --sport telnet -j REJECT
# TCP rules
iptables -A INPUT -p TCP -i eth1 -s 0/0 --destination-port 21 -j okay
iptables -A INPUT -p TCP -i eth1 -s 0/0 --destination-port 22 -j okay
iptables -A INPUT -p TCP -i eth1 -s 0/0 --destination-port 80 -j okay
iptables -A INPUT -p TCP -i eth1 -s 0/0 --destination-port 113 -j okay
#UDP rules
iptables -A INPUT -p UDP -i eth1 -s 0/0 --destination-port 53 -j ACCEPT
iptables -A INPUT -p UDP -i eth1 -s 0/0 --destination-port 2074 -j ACCEPT
iptables -A INPUT -p UDP -i eth1 -s 0/0 --destination-port 4000 -j ACCEPT
#ICMP rules
iptables -A INPUT -p ICMP -i eth1 -s 0/0 --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP -i eth1 -s 0/0 --icmp-type 11 -j ACCEPT
# (4) FORWARD chain rules
# Accept the packets we want to forward
iptables -A FORWARD -i eth0 -j ACCEPT
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# (5) OUTPUT chain rules
#only output packets with local address ( no spoofing )
iptables -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -p ALL -s 172.16.0.1 -j ACCEPT
iptables -A OUTPUT -p ALL -s xx.xx.xx.xx -j ACCEPT
# (6) POSTROUTING chain rules - Main Connection for connecting to Internet - ROUTER
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source xx.xx.xx.xx
Now the problem is i am able to browse the internet from client but not from my INTserver console.I am also able to connect to all the sites via http or ftp or telnet immediately from the client. If i try to connect to ftp server or webserver on INTserver from the client, it is taking long time. Same way public also taking time to connect.
If i stop the iptable then i can connect to internet in INTserver console itself.
What will be the problem? Seems to have proble with rule.
Any suggestions or Any help will be appreciated....
Also how i can block particular range of internal or external ip address or machine address sending request (accessing the server) in or out ie both from internal(LAN) or external(from internet)
