1

I reinstalled a ClearOS box, which is based on CentOS. The previous install ran fine for 3 years, without a glitch but I may of misconfigured something on this install along the way, as things are not working as they should.

  1. Browsing internet does not work when content-filtering is disabled. I used to be able to browse without going through the proxy, but this no longer works unless web proxy is enabled. Idem for ssh traffic.

  2. This is much more serious: local network cannot connect to external ssh servers. It seems port 22 is not being allowed out, yet I have the firewall set to allow all external traffic.

Relevant config posted below, route and iptables listing.

iptable:

[root@alcastraz ~]# iptables --list -n -v
Chain INPUT (policy DROP 223 packets, 9229 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  eth0   *       0.0.0.0/0            46.241.27.20        
    0     0 DROP       all  --  eth0   *       46.241.27.20         0.0.0.0/0           
    0     0 DROP       all  --  eth0   *       0.0.0.0/0            196.29.120.73       
    0     0 DROP       all  --  eth0   *       196.29.120.73        0.0.0.0/0           
   88  3768 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x12/0x12 state NEW reject-with tcp-reset 
   18  1602 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 state NEW 
    0     0 DROP       all  --  eth0   *       127.0.0.0/8          0.0.0.0/0           
    0     0 DROP       all  --  eth0   *       169.254.0.0/16       0.0.0.0/0           
 9422 2499K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  pptp+  *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
14099 2515K ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     udp  --  eth2   *       0.0.0.0/0            192.168.0.50        udp spt:68 dpt:67 
    0     0 ACCEPT     tcp  --  eth2   *       0.0.0.0/0            192.168.0.50        tcp spt:68 dpt:67 
    0     0 ACCEPT     udp  --  eth2   *       192.168.0.0/24       192.168.0.50        udp dpt:53 
    0     0 ACCEPT     tcp  --  eth2   *       192.168.0.0/24       192.168.0.50        tcp dpt:53 
   35  1015 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           icmp type 0 
    0     0 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           icmp type 3 
    0     0 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           icmp type 8 
    0     0 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           icmp type 11 
   76 25624 ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp spt:67 dpt:68 
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp spt:67 dpt:68 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.0.50        tcp dpt:80 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            96.22.88.25         tcp dpt:80 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.0.50        tcp dpt:443 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            96.22.88.25         tcp dpt:443 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.0.50        tcp dpt:22 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            96.22.88.25         tcp dpt:22 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.0.50        tcp dpt:1875 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            96.22.88.25         tcp dpt:1875 
    0     0 ACCEPT     udp  --  eth2   *       0.0.0.0/0            0.0.0.0/0           udp dpts:1024:65535 state RELATED,ESTABLISHED 
    0     0 ACCEPT     tcp  --  eth2   *       0.0.0.0/0            0.0.0.0/0           tcp dpts:1024:65535 state RELATED,ESTABLISHED 
  438 56397 ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp dpts:1024:65535 state RELATED,ESTABLISHED 
18645 6458K ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpts:1024:65535 state RELATED,ESTABLISHED 

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  eth0   *       0.0.0.0/0            46.241.27.20        
    0     0 DROP       all  --  eth0   *       46.241.27.20         0.0.0.0/0           
    0     0 DROP       all  --  eth0   *       0.0.0.0/0            196.29.120.73       
    0     0 DROP       all  --  eth0   *       196.29.120.73        0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       192.168.0.0/24       0.0.0.0/0           icmp type 0 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            192.168.0.0/24      icmp type 0 
    0     0 ACCEPT     icmp --  *      *       192.168.0.0/24       0.0.0.0/0           icmp type 3 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            192.168.0.0/24      icmp type 3 
    4   336 ACCEPT     icmp --  *      *       192.168.0.0/24       0.0.0.0/0           icmp type 8 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            192.168.0.0/24      icmp type 8 
    0     0 ACCEPT     icmp --  *      *       192.168.0.0/24       0.0.0.0/0           icmp type 11 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            192.168.0.0/24      icmp type 11 
    0     0 DROP       icmp --  *      *       192.168.0.0/24       0.0.0.0/0           
    0     0 DROP       icmp --  *      *       0.0.0.0/0            192.168.0.0/24      
    0     0 ACCEPT     all  --  *      *       192.168.0.0/24       192.168.0.0/24      state RELATED,ESTABLISHED 
    0     0 DROP       all  --  *      *       192.168.0.0/24       192.168.0.0/24      
    0     0 ACCEPT     all  --  *      *       192.168.0.0/24       192.168.0.0/24      
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     all  --  eth2   *       0.0.0.0/0            0.0.0.0/0           
   84  4754 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  pptp+  *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 9440 2500K ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      pptp+   0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      tun+    0.0.0.0/0            0.0.0.0/0           
15382 6989K ACCEPT     all  --  *      eth1    0.0.0.0/0            0.0.0.0/0           
   35  1015 ACCEPT     icmp --  *      eth0    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     udp  --  *      eth0    0.0.0.0/0            0.0.0.0/0           udp spt:68 dpt:67 
    0     0 ACCEPT     tcp  --  *      eth0    0.0.0.0/0            0.0.0.0/0           tcp spt:68 dpt:67 
    0     0 ACCEPT     tcp  --  *      eth2    192.168.0.50         0.0.0.0/0           tcp spt:80 
    0     0 ACCEPT     tcp  --  *      eth0    96.22.88.25          0.0.0.0/0           tcp spt:80 
    0     0 ACCEPT     tcp  --  *      eth2    192.168.0.50         0.0.0.0/0           tcp spt:443 
    0     0 ACCEPT     tcp  --  *      eth0    96.22.88.25          0.0.0.0/0           tcp spt:443 
    0     0 ACCEPT     tcp  --  *      eth2    192.168.0.50         0.0.0.0/0           tcp spt:22 
    0     0 ACCEPT     tcp  --  *      eth0    96.22.88.25          0.0.0.0/0           tcp spt:22 
    0     0 ACCEPT     tcp  --  *      eth2    192.168.0.50         0.0.0.0/0           tcp spt:1875 
    0     0 ACCEPT     tcp  --  *      eth0    96.22.88.25          0.0.0.0/0           tcp spt:1875 
    0     0 ACCEPT     all  --  *      eth2    0.0.0.0/0            0.0.0.0/0           
21153 3140K ACCEPT     all  --  *      eth0    0.0.0.0/0            0.0.0.0/0           

Chain drop-lan (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

route: 

[root@alcastraz ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.0.0     *               255.255.255.0   U     0      0        0 eth1
192.168.0.0     *               255.255.255.0   U     0      0        0 eth2
96.22.88.0      *               255.255.255.0   U     0      0        0 eth0
default         modemcable001.8 0.0.0.0         UG    0      0        0 eth0

Any help or info to resolve this would be greatly appreciated.

Thanks!

stefgosselin
  • 257
  • 1
  • 3
  • 14

2 Answers2

1

Is this a set of hand-crafted rules?

One thing that jumps out: the network 192.168.0.0/24 is on two interfaces: eth1 and eth2 - which is almost certainly not what you want.

For general debugging, you can also use this command:

watch -d iptables -L -v -n

(or some variant of that.) Then you can watch packets increase as traffic flows. This is only really good for low traffic networks where you don't have a lot of extraneous traffic.

Another thing to do is to turn on logging for some of the firewall entries: use the LOG target extension.

Another thing: reset the counts and see what is getting dropped - or better yet, use that LOG target combined with rules that DROP. In your list, there are only two rules that have been matched and have dropped packets (pulling rules out of context):

Chain INPUT (policy DROP 223 packets, 9229 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   88  3768 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
   18  1602 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 state NEW

Perhaps these should be investigated?

To get away from that mess entirely, I'd suggest using Firewall Builder, an excellent GUI-based multi-firewall designer. You can design the firewall anywhere and plunk it down where it will do the work - fwbuilder even has ways of pushing the firewall out to the remote host.

Mei
  • 4,560
  • 8
  • 44
  • 53
0

I would consider using a firewall builder to generate your firewall. Something like Shorewall which is well documented and has some good example configurations could make your life easier. On a quick examination the three interface (zone) configuration might be a good starting point for you. The key files for shorewall are zones, interfaces, hosts, policy, and rules. There are a number of macros which generate commented rules by name rather than port.

Normally your state RELATED,ESTABLISHED rules would be at the top of the list. Using separate chains for various traffic flow might help understand what is happening.

It appears only two addresses have open access for port 80 which would explain your browsing problem. One should be the content-filter. The other may be the address from which you were able to browse while bypassing the content-filter.

BillThor
  • 27,354
  • 3
  • 35
  • 69