I reinstalled a ClearOS box, which is based on CentOS. The previous install ran fine for 3 years, without a glitch but I may of misconfigured something on this install along the way, as things are not working as they should.
Browsing internet does not work when content-filtering is disabled. I used to be able to browse without going through the proxy, but this no longer works unless web proxy is enabled. Idem for ssh traffic.
This is much more serious: local network cannot connect to external ssh servers. It seems port 22 is not being allowed out, yet I have the firewall set to allow all external traffic.
Relevant config posted below, route and iptables listing.
iptable:
[root@alcastraz ~]# iptables --list -n -v
Chain INPUT (policy DROP 223 packets, 9229 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- eth0 * 0.0.0.0/0 46.241.27.20
0 0 DROP all -- eth0 * 46.241.27.20 0.0.0.0/0
0 0 DROP all -- eth0 * 0.0.0.0/0 196.29.120.73
0 0 DROP all -- eth0 * 196.29.120.73 0.0.0.0/0
88 3768 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x12/0x12 state NEW reject-with tcp-reset
18 1602 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW
0 0 DROP all -- eth0 * 127.0.0.0/8 0.0.0.0/0
0 0 DROP all -- eth0 * 169.254.0.0/16 0.0.0.0/0
9422 2499K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- pptp+ * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
14099 2515K ACCEPT all -- eth1 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT udp -- eth2 * 0.0.0.0/0 192.168.0.50 udp spt:68 dpt:67
0 0 ACCEPT tcp -- eth2 * 0.0.0.0/0 192.168.0.50 tcp spt:68 dpt:67
0 0 ACCEPT udp -- eth2 * 192.168.0.0/24 192.168.0.50 udp dpt:53
0 0 ACCEPT tcp -- eth2 * 192.168.0.0/24 192.168.0.50 tcp dpt:53
35 1015 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 icmp type 0
0 0 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 icmp type 3
0 0 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 icmp type 11
76 25624 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp spt:67 dpt:68
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.0.50 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 96.22.88.25 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.0.50 tcp dpt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 96.22.88.25 tcp dpt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.0.50 tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 96.22.88.25 tcp dpt:22
0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.0.50 tcp dpt:1875
0 0 ACCEPT tcp -- * * 0.0.0.0/0 96.22.88.25 tcp dpt:1875
0 0 ACCEPT udp -- eth2 * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- eth2 * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535 state RELATED,ESTABLISHED
438 56397 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 state RELATED,ESTABLISHED
18645 6458K ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535 state RELATED,ESTABLISHED
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- eth0 * 0.0.0.0/0 46.241.27.20
0 0 DROP all -- eth0 * 46.241.27.20 0.0.0.0/0
0 0 DROP all -- eth0 * 0.0.0.0/0 196.29.120.73
0 0 DROP all -- eth0 * 196.29.120.73 0.0.0.0/0
0 0 ACCEPT icmp -- * * 192.168.0.0/24 0.0.0.0/0 icmp type 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.0.0/24 icmp type 0
0 0 ACCEPT icmp -- * * 192.168.0.0/24 0.0.0.0/0 icmp type 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.0.0/24 icmp type 3
4 336 ACCEPT icmp -- * * 192.168.0.0/24 0.0.0.0/0 icmp type 8
0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.0.0/24 icmp type 8
0 0 ACCEPT icmp -- * * 192.168.0.0/24 0.0.0.0/0 icmp type 11
0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.0.0/24 icmp type 11
0 0 DROP icmp -- * * 192.168.0.0/24 0.0.0.0/0
0 0 DROP icmp -- * * 0.0.0.0/0 192.168.0.0/24
0 0 ACCEPT all -- * * 192.168.0.0/24 192.168.0.0/24 state RELATED,ESTABLISHED
0 0 DROP all -- * * 192.168.0.0/24 192.168.0.0/24
0 0 ACCEPT all -- * * 192.168.0.0/24 192.168.0.0/24
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT all -- eth2 * 0.0.0.0/0 0.0.0.0/0
84 4754 ACCEPT all -- eth1 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- pptp+ * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
9440 2500K ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * pptp+ 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * tun+ 0.0.0.0/0 0.0.0.0/0
15382 6989K ACCEPT all -- * eth1 0.0.0.0/0 0.0.0.0/0
35 1015 ACCEPT icmp -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT udp -- * eth0 0.0.0.0/0 0.0.0.0/0 udp spt:68 dpt:67
0 0 ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp spt:68 dpt:67
0 0 ACCEPT tcp -- * eth2 192.168.0.50 0.0.0.0/0 tcp spt:80
0 0 ACCEPT tcp -- * eth0 96.22.88.25 0.0.0.0/0 tcp spt:80
0 0 ACCEPT tcp -- * eth2 192.168.0.50 0.0.0.0/0 tcp spt:443
0 0 ACCEPT tcp -- * eth0 96.22.88.25 0.0.0.0/0 tcp spt:443
0 0 ACCEPT tcp -- * eth2 192.168.0.50 0.0.0.0/0 tcp spt:22
0 0 ACCEPT tcp -- * eth0 96.22.88.25 0.0.0.0/0 tcp spt:22
0 0 ACCEPT tcp -- * eth2 192.168.0.50 0.0.0.0/0 tcp spt:1875
0 0 ACCEPT tcp -- * eth0 96.22.88.25 0.0.0.0/0 tcp spt:1875
0 0 ACCEPT all -- * eth2 0.0.0.0/0 0.0.0.0/0
21153 3140K ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain drop-lan (0 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
route:
[root@alcastraz ~]# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.0.0 * 255.255.255.0 U 0 0 0 eth1
192.168.0.0 * 255.255.255.0 U 0 0 0 eth2
96.22.88.0 * 255.255.255.0 U 0 0 0 eth0
default modemcable001.8 0.0.0.0 UG 0 0 0 eth0
Any help or info to resolve this would be greatly appreciated.
Thanks!
Is this a set of hand-crafted rules?
One thing that jumps out: the network 192.168.0.0/24 is on two interfaces:
eth1andeth2- which is almost certainly not what you want.For general debugging, you can also use this command:
(or some variant of that.) Then you can watch packets increase as traffic flows. This is only really good for low traffic networks where you don't have a lot of extraneous traffic.
Another thing to do is to turn on logging for some of the firewall entries: use the
LOGtarget extension.Another thing: reset the counts and see what is getting dropped - or better yet, use that
LOGtarget combined with rules thatDROP. In your list, there are only two rules that have been matched and have dropped packets (pulling rules out of context):Perhaps these should be investigated?
To get away from that mess entirely, I'd suggest using Firewall Builder, an excellent GUI-based multi-firewall designer. You can design the firewall anywhere and plunk it down where it will do the work - fwbuilder even has ways of pushing the firewall out to the remote host.
I would consider using a firewall builder to generate your firewall. Something like Shorewall which is well documented and has some good example configurations could make your life easier. On a quick examination the three interface (zone) configuration might be a good starting point for you. The key files for shorewall are zones, interfaces, hosts, policy, and rules. There are a number of macros which generate commented rules by name rather than port.
Normally your
state RELATED,ESTABLISHEDrules would be at the top of the list. Using separate chains for various traffic flow might help understand what is happening.It appears only two addresses have open access for port 80 which would explain your browsing problem. One should be the content-filter. The other may be the address from which you were able to browse while bypassing the content-filter.