iptable in fc5

[list user]

Hongwei Li wrote:
>>Hongwei Li wrote:
>>
>>>>Hongwei Li wrote:
>>>>
>>>>>I have a question about iptables in fc5. I have iptables 1.3.5-1.2
>>>>>installed.
>>>>>By default, the iptables has a line
>>>>>-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
>>>>>... and
>>>>>-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
>>>>>
>>>>>I try to add the port 2049 for our lan nfs by adding aline before the
>>>>>above
>>>>>reject line:
>>>>>
>>>>>-A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -m state --state NEW
>>>>>-m
>>>>>tcp -p tcp --dport 2049 -j ACCEPT
>>>>
>>>>
>>>>That rule will only match the initial packet of the stream.  You will
>>>>also need to match states ESTABLISHED and RELATED:
>>>>
>>>>-A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -m state --state
>>>>NEW,ESTABLISHED,RELATED -p tcp --dport 2049 -j ACCEPT
>>>>
>>>>>-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
>>>>>
>>>>>and restart iptables.  But my other linux boxes cannot mount the exported
>>>>>folder.  If I stop the iptable, then they can mount it.  I tried to open
>>>>>several other ports: 137, 139, etc.  But as long as the last line is there,
>>>>>it
>>>>>always failed.  If I comment out the last line, then nfs works.
>>>>>
>>
>>>>>What is "icmp-host-prohibited"
>>
>>Just what it says.  You are prohibited from accessing this host.
>>
> 
> I don't know if the output of tcpdump -nn helps or not:
> ...
> 16:02:40.803697 IP 128.252.85.35.22 > 128.252.85.103.2167: P
<snip />

oooh :(  SSH makes alot of noise.  Not too useful this way.

> Here is iptables-save output:
> 
> # Generated by iptables-save v1.3.5 on Mon May 15 15:59:18 2006
> *filter
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> :RH-Firewall-1-INPUT - [0:0]
> :okay - [0:0]
> -A INPUT -j RH-Firewall-1-INPUT
> -A FORWARD -j RH-Firewall-1-INPUT
> -A OUTPUT -s 127.0.0.1 -j ACCEPT
> -A OUTPUT -s 128.252.85.35 -j ACCEPT
> -A RH-Firewall-1-INPUT -s 127.0.0.1 -i lo -j ACCEPT
> -A RH-Firewall-1-INPUT -s 128.252.85.35 -i lo -j ACCEPT
> -A RH-Firewall-1-INPUT -i lo -j ACCEPT
> -A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
> -A RH-Firewall-1-INPUT -p ipv6-crypt -j ACCEPT
> -A RH-Firewall-1-INPUT -p ipv6-auth -j ACCEPT
> -A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
> -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
> -A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp
> --dport 21 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp
> --dport 22 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp
> --dport 25 -j ACCEPT
> -A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp
> --dport 80 -j ACCEPT
> -A RH-Firewall-1-INPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m udp
> --dport 137 -j ACCEPT
> -A RH-Firewall-1-INPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m udp
> --dport 139 -j ACCEPT
> -A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -p tcp -m state --state
> NEW,RELATED,ESTABLISHED -m tcp --dport 2049 -j ACCEPT
> -A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -p udp -m state --state
> NEW,RELATED,ESTABLISHED -m udp --dport 2049 -j ACCEPT
> -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
> -A okay -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
> -A okay -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
> COMMIT
> # Completed on Mon May 15 15:59:18 2006
> 
> I just added udp for nfs port, but still the same problem.
> 

Ok.  Just looked through your "iptables-save".  There is some
duplication but nothing that I can see that is wrong.

Since you are hitting the REJECT you are not matching a previous rule.
 From what I can see, the rules must be failing because
   a) source address/mask isn't what is being used;
   b) port number is not the one being used.

If you use "tcpdump -nn port ! ssh" while you try using nfs you should
receive something more useable.