I'm replacing a wireless router running Tomato with an ubuntu server with dual NICs. I ssh'd into the tomato router and found /etc/iptables there and all the rules make sense based on what I'm reading. I'll probably use webmin once the server is set up and running. (as I'm writing this question, I'm already copying qos
and dnsmasq
settings files)
Is setting up iptables really as easy as changing the interfaces' names and saving the same file onto the Debian server?
Tomato: vlan1
(public), br0
(private wired), and eth1
(private wireless)
Ubuntu: eth0
(public) and eth1
(private).
The tomato config file with interfaces' names changed:
*mangle
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:QOSO - [0:0]
-A QOSO -j CONNMARK --restore-mark --mask 0xff
-A QOSO -m connmark ! --mark 0/0xff00 -j RETURN
-A QOSO -p tcp -m mport --dports 80,443 -m bcount --range 0x0-0x7ffff -j CONNMARK --set-return 0x2/0xFF
-A QOSO -p tcp -m mport --dports 80,443 -m bcount --range 0x80000 -j CONNMARK --set-return 0x4/0xFF
-A QOSO -p udp --dport 53 -m bcount --range 0x0-0x7ff -j CONNMARK --set-return 0x1/0xFF
-A QOSO -p tcp --dport 53 -m bcount --range 0x0-0x7ff -j CONNMARK --set-return 0x1/0xFF
-A QOSO -p udp --dport 53 -m bcount --range 0x800 -j CONNMARK --set-return 0x5/0xFF
-A QOSO -p tcp --dport 53 -m bcount --range 0x800 -j CONNMARK --set-return 0x5/0xFF
-A QOSO -p udp --dport 1024:65535 -j CONNMARK --set-return 0x5/0xFF
-A QOSO -p tcp --dport 1024:65535 -j CONNMARK --set-return 0x5/0xFF
-A QOSO -p udp -m mport --ports 5060:5090 -m layer7 --l7dir /etc/l7-protocols --l7proto sip -j CONNMARK --set-return 0x101/0xFF
-I QOSO -j BCOUNT
-A QOSO -j CONNMARK --set-return 0x4
-A FORWARD -o eth0 -j QOSO
-A OUTPUT -o eth0 -j QOSO
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -i eth0 -d 10.0.0.2/255.255.255.0 -j DROP
-A PREROUTING -p icmp -d 99.165.243.155 -j DNAT --to-destination 10.0.0.2
-A PREROUTING -p tcp -m tcp -d 99.165.243.155 --dport 22 -j DNAT --to-destination 10.0.0.2:22
-A PREROUTING -p tcp -d 99.165.243.155 --dport 8822 -j DNAT --to-destination 10.0.0.20:22
-A POSTROUTING -p tcp --dport 22 -s 10.0.0.2/255.255.255.0 -d 10.0.0.20 -j SNAT --to-source 99.165.243.155
:upnp - [0:0]
-A PREROUTING -d 99.165.243.155 -j upnp
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
*filter
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i eth1 -d 99.165.243.155 -j DROP
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-N shlimit
-A shlimit -m recent --set --name shlimit
-A shlimit -m recent --update --hitcount 3 --seconds 60 --name shlimit -j DROP
-A INPUT -p tcp --dport 22 -m state --state NEW -j shlimit
-A INPUT -i eth1 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp -d 10.0.0.2 --dport 22 -j ACCEPT
:FORWARD DROP [0:0]
-A FORWARD -i eth1 -o eth1 -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1461: -j TCPMSS --set-mss 1460
:L7in - [0:0]
-A FORWARD -i eth0 -j L7in
-A L7in -m layer7 --l7dir /etc/l7-protocols --l7proto sip -j RETURN
:wanin - [0:0]
:wanout - [0:0]
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -j wanin
-A FORWARD -o eth0 -j wanout
-A FORWARD -i eth1 -j ACCEPT
:upnp - [0:0]
-A FORWARD -i eth0 -j upnp
-A wanin -p tcp -m tcp -d 10.0.0.20 --dport 22 -j ACCEPT
COMMIT
Edited to add:
I've also been reading from these two great resources:
http://oceanpark.com/notes/firewall_example.html
http://www.novell.com/coolsolutions/feature/18139.html
Edited to add:
1. Ended up changing to Debian. Ubuntu 12.04 LTS was requiring too many hacks to get working on my hardware.
2. iptables
does not recognize the mport module, but that's a different question.
Yep... it's just as simple as copy/paste & adjust interface names as appropriate. Iptables on tomato, is the same as iptables on ubuntu/debian/centos/red hat/suse/dsl/openwrt/ddwrt/puppy/etc... The only potential conflict between flavors of OSes... is whether or not specific iptables modules were compiled/installed.
The configuration you posted above is generated by
iptables-save
and should be read byiptables-restore
. It is NOT read by default on most linux-flavors... so you may need to create an init script to restore the settings on boot.On Ubuntu, you can simply edit /etc/rc.local and add this:
The only non-standard installed module you're using that I see is the "layer7" module... but its easy to install in ubuntu. Just do an
and you're done.