Centos – iptable – configuration for outbound traffic from local network

centosclearosfirewalliptables

I reinstalled a ClearOS box, which is based on CentOS. The previous install ran fine for 3 years, without a glitch but I may of misconfigured something on this install along the way, as things are not working as they should.

Browsing internet does not work when content-filtering is disabled. I used to be able to browse without going through the proxy, but this no longer works unless web proxy is enabled. Idem for ssh traffic.
This is much more serious: local network cannot connect to external ssh servers. It seems port 22 is not being allowed out, yet I have the firewall set to allow all external traffic.

Relevant config posted below, route and iptables listing.

iptable:

[root@alcastraz ~]# iptables --list -n -v
Chain INPUT (policy DROP 223 packets, 9229 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  eth0   *       0.0.0.0/0            46.241.27.20        
    0     0 DROP       all  --  eth0   *       46.241.27.20         0.0.0.0/0           
    0     0 DROP       all  --  eth0   *       0.0.0.0/0            196.29.120.73       
    0     0 DROP       all  --  eth0   *       196.29.120.73        0.0.0.0/0           
   88  3768 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x12/0x12 state NEW reject-with tcp-reset 
   18  1602 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 state NEW 
    0     0 DROP       all  --  eth0   *       127.0.0.0/8          0.0.0.0/0           
    0     0 DROP       all  --  eth0   *       169.254.0.0/16       0.0.0.0/0           
 9422 2499K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  pptp+  *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           
14099 2515K ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     udp  --  eth2   *       0.0.0.0/0            192.168.0.50        udp spt:68 dpt:67 
    0     0 ACCEPT     tcp  --  eth2   *       0.0.0.0/0            192.168.0.50        tcp spt:68 dpt:67 
    0     0 ACCEPT     udp  --  eth2   *       192.168.0.0/24       192.168.0.50        udp dpt:53 
    0     0 ACCEPT     tcp  --  eth2   *       192.168.0.0/24       192.168.0.50        tcp dpt:53 
   35  1015 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           icmp type 0 
    0     0 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           icmp type 3 
    0     0 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           icmp type 8 
    0     0 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0           icmp type 11 
   76 25624 ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp spt:67 dpt:68 
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp spt:67 dpt:68 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.0.50        tcp dpt:80 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            96.22.88.25         tcp dpt:80 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.0.50        tcp dpt:443 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            96.22.88.25         tcp dpt:443 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.0.50        tcp dpt:22 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            96.22.88.25         tcp dpt:22 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.0.50        tcp dpt:1875 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            96.22.88.25         tcp dpt:1875 
    0     0 ACCEPT     udp  --  eth2   *       0.0.0.0/0            0.0.0.0/0           udp dpts:1024:65535 state RELATED,ESTABLISHED 
    0     0 ACCEPT     tcp  --  eth2   *       0.0.0.0/0            0.0.0.0/0           tcp dpts:1024:65535 state RELATED,ESTABLISHED 
  438 56397 ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp dpts:1024:65535 state RELATED,ESTABLISHED 
18645 6458K ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           tcp dpts:1024:65535 state RELATED,ESTABLISHED 

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  eth0   *       0.0.0.0/0            46.241.27.20        
    0     0 DROP       all  --  eth0   *       46.241.27.20         0.0.0.0/0           
    0     0 DROP       all  --  eth0   *       0.0.0.0/0            196.29.120.73       
    0     0 DROP       all  --  eth0   *       196.29.120.73        0.0.0.0/0           
    0     0 ACCEPT     icmp --  *      *       192.168.0.0/24       0.0.0.0/0           icmp type 0 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            192.168.0.0/24      icmp type 0 
    0     0 ACCEPT     icmp --  *      *       192.168.0.0/24       0.0.0.0/0           icmp type 3 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            192.168.0.0/24      icmp type 3 
    4   336 ACCEPT     icmp --  *      *       192.168.0.0/24       0.0.0.0/0           icmp type 8 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            192.168.0.0/24      icmp type 8 
    0     0 ACCEPT     icmp --  *      *       192.168.0.0/24       0.0.0.0/0           icmp type 11 
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            192.168.0.0/24      icmp type 11 
    0     0 DROP       icmp --  *      *       192.168.0.0/24       0.0.0.0/0           
    0     0 DROP       icmp --  *      *       0.0.0.0/0            192.168.0.0/24      
    0     0 ACCEPT     all  --  *      *       192.168.0.0/24       192.168.0.0/24      state RELATED,ESTABLISHED 
    0     0 DROP       all  --  *      *       192.168.0.0/24       192.168.0.0/24      
    0     0 ACCEPT     all  --  *      *       192.168.0.0/24       192.168.0.0/24      
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     all  --  eth2   *       0.0.0.0/0            0.0.0.0/0           
   84  4754 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  pptp+  *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  tun+   *       0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 9440 2500K ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      pptp+   0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      tun+    0.0.0.0/0            0.0.0.0/0           
15382 6989K ACCEPT     all  --  *      eth1    0.0.0.0/0            0.0.0.0/0           
   35  1015 ACCEPT     icmp --  *      eth0    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     udp  --  *      eth0    0.0.0.0/0            0.0.0.0/0           udp spt:68 dpt:67 
    0     0 ACCEPT     tcp  --  *      eth0    0.0.0.0/0            0.0.0.0/0           tcp spt:68 dpt:67 
    0     0 ACCEPT     tcp  --  *      eth2    192.168.0.50         0.0.0.0/0           tcp spt:80 
    0     0 ACCEPT     tcp  --  *      eth0    96.22.88.25          0.0.0.0/0           tcp spt:80 
    0     0 ACCEPT     tcp  --  *      eth2    192.168.0.50         0.0.0.0/0           tcp spt:443 
    0     0 ACCEPT     tcp  --  *      eth0    96.22.88.25          0.0.0.0/0           tcp spt:443 
    0     0 ACCEPT     tcp  --  *      eth2    192.168.0.50         0.0.0.0/0           tcp spt:22 
    0     0 ACCEPT     tcp  --  *      eth0    96.22.88.25          0.0.0.0/0           tcp spt:22 
    0     0 ACCEPT     tcp  --  *      eth2    192.168.0.50         0.0.0.0/0           tcp spt:1875 
    0     0 ACCEPT     tcp  --  *      eth0    96.22.88.25          0.0.0.0/0           tcp spt:1875 
    0     0 ACCEPT     all  --  *      eth2    0.0.0.0/0            0.0.0.0/0           
21153 3140K ACCEPT     all  --  *      eth0    0.0.0.0/0            0.0.0.0/0           

Chain drop-lan (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

route:

[root@alcastraz ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.0.0     *               255.255.255.0   U     0      0        0 eth1
192.168.0.0     *               255.255.255.0   U     0      0        0 eth2
96.22.88.0      *               255.255.255.0   U     0      0        0 eth0
default         modemcable001.8 0.0.0.0         UG    0      0        0 eth0

Any help or info to resolve this would be greatly appreciated.

Thanks!

Best Answer

Is this a set of hand-crafted rules?

One thing that jumps out: the network 192.168.0.0/24 is on two interfaces: eth1 and eth2 - which is almost certainly not what you want.

For general debugging, you can also use this command:

watch -d iptables -L -v -n

(or some variant of that.) Then you can watch packets increase as traffic flows. This is only really good for low traffic networks where you don't have a lot of extraneous traffic.

Another thing to do is to turn on logging for some of the firewall entries: use the LOG target extension.

Another thing: reset the counts and see what is getting dropped - or better yet, use that LOG target combined with rules that DROP. In your list, there are only two rules that have been matched and have dropped packets (pulling rules out of context):

Chain INPUT (policy DROP 223 packets, 9229 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   88  3768 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
   18  1602 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 state NEW

Perhaps these should be investigated?

To get away from that mess entirely, I'd suggest using Firewall Builder, an excellent GUI-based multi-firewall designer. You can design the firewall anywhere and plunk it down where it will do the work - fwbuilder even has ways of pushing the firewall out to the remote host.

Best Answer

Related Solutions

Iptables – Firewall still blocking port 53 despite listing otherwise

Iptables on CentOS 5.5; I want to allow snmp queries from a remote machine

Related Topic