Linux

Ask something
Discussion Locked

ipchains logging

0 helpful
6 replies

by cp409sd

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am having a problem finding out which rule of my ipchains firewall is not letting a some email go through. I just set up sendmail and a pop3 server and that all works fine when my firewall is down. When it is up though, emails are not going through.

I have tried to make a "logging firewall". In other words, I would like to log EVERYTHING for a brief period of time, then examine the logs to see what rule denies or rejects what I am looking for. I thought it would be something like this:

ipchains -F
ipchains -P input DENY
ipchains -P output REJECT
ipchains -P forward REJECT
ipchains -A input -s xxx.xxx.xxx.xxx -j REJECT -l
ipchains -A input -d xxx.xxx.xxx.xxx -j REJECT -l
ipchains -A output -s xxx.xxx.xxx.xxx -j REJECT -l
ipchains -A output -d xxx.xxx.xxx.xxx -j REJECT -l
ipchains -A forward -s xxx.xxx.xxx.xxx -j REJECT -l
ipchains -A forward -d xxx.xxx.xxx.xxx -j REJECT -l

This does not appear to be working though. Is there a better way to do this?? Thanks for the help.

6 replies

by rouse

I'd bet if you copy this to your /etc/sysconfig/ipchains it'll let your pop in:
:input ACCEPT
:forward ACCEPT
:output ACCEPT
-A input -s 0/0 -d 0/0 25 -p tcp -y -j ACCEPT
-A input -s 0/0 67:68 -d 0/0 67:68 -p udp -i eth0 -j ACCEPT
-A input -s 0/0 67:68 -d 0/0 67:68 -p udp -i eth1 -j ACCEPT
-A input -s 0/0 -d 0/0 -i lo -j ACCEPT
-A input -s 0/0 -d 0/0 110 -p tcp -y -j ACCEPT
-A input -s 192.168.1.0/255.255.255.0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -p tcp -s 0/0 -d 0/0 0:1023 -y -j REJECT
-A input -p tcp -s 0/0 -d 0/0 2049 -y -j REJECT
-A input -p udp -s 0/0 -d 0/0 0:1023 -j REJECT
-A input -p udp -s 0/0 -d 0/0 2049 -j REJECT
-A input -p tcp -s 0/0 -d 0/0 6000:6009 -y -j REJECT
-A input -p tcp -s 0/0 -d 0/0 7100 -y -j REJECT

Note that I'm letting in httpd (80) from only inside network. I believe you are looking for the (25) & (110) lines.
Also I'm trying to learn ipchains, but this works fine on my box.
I have your same problem with my smb service tho.Can't figure the rule to let my win machines in. I use ssh anyway, but as matter of learning, would like to where my block is (see my smb thru ipchains post). Ii also works when I flush ipchains.
Hope this helped.

by shanghai sam

Unfortunately this did not work. I tried to open my system up on ports 25,110, and even 53.(because this machine hosts a couple of different virtual domain that have different nameservers). Of course there are tons of rules for my firewall, but these are ones I have tried to manipulate to
allow email through in both directions:

ipchains -P input DENY
ipchains -P output REJECT
ipchains -P forward DENY

ipchains -A input -s 0/0 25 -d 0/0 -p tcp ! -y -j ACCEPT
ipchains -A output -s 0/0 -d 0/0 25 -p tcp -j ACCEPT

ipchains -A input -s 0/0 110 -d 0/0 -p tcp ! -y -j ACCEPT
ipchains -A output -s 0/0 -d 0/0 110 -p tcp -j ACCEPT

ipchains -A input -s 0/0 53 -d 0/0 -p tcp ! -y -j ACCEPT
ipchains -A output -s 0/0 -d 0/053 -p tcp -j ACCEPT
ipchains -A input -s 0/0 53 -d 0/0 -p udp -j ACCEPT
ipchains -A output -s 0/0 -d 0/0 53 -p udp -j ACCEPT

Thanks for any help you can provide.

by jaqui

interesting problem, never ran into any ipchains problem with mandrake 8.x distributions.
which distr. are you running?

have you concidered setting a firewall for each of the domains rather than one for all?

it may help, as getting the firewall running for only one nameserver at a time would be easier. saving the settings after having working on one nameserver then getting second nameserver working then third, rather than all three at the same time.
that way you only working with one set of chains at a time rather than all three.

by jaqui

not as elegant as setting all three at the same time, but maybe more sucessfull.
can't actually run three firewalls I know, but if you can have three settings that allow each name server to work, then combine into one setting table, it may solve the conflict.

at least allows you to find out which setting is causing the conflict.

by cp409sd

Thanks for your comment. I actually solved this problem. I had the ! -y flags set wrong it seems. I fixed the problem by not putting in that parameter. I also made some of the rules bidirectional with the -b flag. (not as safe, I know)Thanks for the comment.

This discussion is closed to new replies.