[Masq] ping does not return....

[Hajime Lucky Okada]

/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */ Hello, I'm just setting up firewall in our system shown in following figure using ipchains. I want to establish transparently connection from HOST-1 to HOST-WWW and internet. That is, from HOST-1 located in internal network to outer of firewall can be accessed freely, but opposed direction should be limited restrictedly at the firewall host. I tried to define rules shown bellow for this. BUT, in this process I have big problem as follows. I'm very confused why.. Please give me any suggestions!! [Problem] The ping from HOST-1 to HOST-WWW does not return to HOST-1. [Situation] 1. Without setting firewall, ping and another protocol like ftp can be established between HOST-1 and HOST-WWW. This means that the basic configuration of network, like managing hardware, IP/MASK address and gateway, should be proper, I think. 2. But, once I have set the rules of ipchains, the packet of ping is blocked... From a message of $(/sbin/ipchains -L -v), the packet of ping could pass eth0 of HOST-1, eth2 of HOST-F/W, ip address masquerading, eth0 of HOST-F/W and could reach to HOST-WWW. HOST-WWW replied ping to HOST-F/W because the source address has been masqueraded. The replied ping packet is accepted to eth0 of HOST-F/W. 3. Nextly the problem occurs. I don't why, but the output from eth2 of HOST-F/W to eth0 of HOST-1 seems to be blocked by "DENY POLICY" rule... by the message of ipchians. As result, the connection of ping is failed. So... what wrong thing do I do??? Another thing, how can I do logging packets rejected by "DENY POLICY"? Any suggestion is appreciated !! I have referred "IPCHAINS-HOWTO" http://howto.tucows.com/otherhowto/IPCHAINS-HOWTO . Thank you. << Requisites >>---------------------------------------------------------- OS: Red Hat Linux release 6.1J (Cartman) second edition KERNEL: Kernel 2.2.12-32 on an i686 (Reconfigured with the options CONFIG_FIREWALL=y and CONFIG_IP_FIREWALL=y.) ipchains : ipchains 1.3.9, 17-Mar-1999 << Figure >>--------------------------------------------------------------- 192.168.20.10 192.168.20.1 HOST-1 HOST-F/W A.B.C.1 +----------+ +----------------------+ |Internal | | Firewall | | eth0 +----------+ eth2 eth0 +--------------+-->> Internet +----------+ | | | +------+ eth1 | | | +----------------------+ A.B.C.10 | HOST-WWW | +----------+-----------+ another network | eth0 | | | |WWW/DNS Server | +----------------------+ << Rules >>--------------------------------------------------------------- # FIREWALL - IPCHAINS Setup H.Okada 2000/Abr/14 # Initialize /sbin/ipchains -F # Default policy -- All Deny /sbin/ipchains -P input DENY /sbin/ipchains -P forward DENY /sbin/ipchains -P output DENY # ALLOW all of loop back interface /sbin/ipchains -A input -i lo -j ACCEPT /sbin/ipchains -A output -i lo -j ACCEPT #---------------------------------------------------- # Step 1: Internal -> Inside of FIREWALL : eth2 # Only ping is accepted to FIREWALL machine #---------------------------------------------------- /sbin/ipchains -A input -s 192.168.20.0/24 -d ! 192.168.20.190/32 -i eth2 -j ACCEPT /sbin/ipchains -A input -p ICMP -s 192.168.20.0/24 -d 192.168.20.190/32 -i eth2 -j ACCEPT #---------------------------------------------------- # Step 2: Inside of FIREWALL #---------------------------------------------------- /sbin/ipchains -A forward -s 192.168.20.0/24 -j MASQ #---------------------------------------------------- # Step 3: Inside of FIREWALL -> Outside #---------------------------------------------------- # b) to Global Network (eth0) /sbin/ipchains -A output -p UDP -s A.B.C.1/32 1024: -i eth0 -j ACCEPT /sbin/ipchains -A output -p ICMP -s A.B.C.1/32 -i eth0 -j ACCEPT #---------------------------------------------------- # Step 4: Outside -> Inside of FIREWALL #---------------------------------------------------- # b) from Global Network (eth0) /sbin/ipchains -A input -p TCP ! -y -d A.B.C.1/32 1024: -i eth0 -j ACCEPT /sbin/ipchains -A input -p UDP -d A.B.C.1/32 1024: -i eth0 -j ACCEPT /sbin/ipchains -A input -p ICMP -d A.B.C.1/32 -i eth0 -j ACCEPT #---------------------------------------------------- # Step 5: Inside of FIREWALL #---------------------------------------------------- # none #---------------------------------------------------- # Step 6: Inside of FIREWALL -> Internal : eth2 #---------------------------------------------------- /sbin/ipchains -A output -s ! 192.168.20.190/32 -d 192.168.20.0/24 -i eth2 -j ACCEPT /sbin/ipchains -A output -p ICMP -s 192.168.20.190/32 -d 192.168.20.0/24 -i eth2 -j ACCEPT -- Hajime Lucky Okada Email) [EMAIL PROTECTED] _______________________________________________ Masq maillist - [EMAIL PROTECTED] Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES UNSUBSCRIBING! or email to [EMAIL PROTECTED] PLEASE read the HOWTO and search the archives before posting. You can start your search at http://www.indyramp.com/masq/ Please keep general linux/unix/pc/internet questions off the list.