1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
|
<HTML>
<HEAD>
<link rel="stylesheet" type="text/css" href="css.css">
<TITLE>FireHOL, Troubleshooting the firewall.</TITLE>
<meta name="author" content="Costa Tsaousis">
<meta name="description" content="
Home for FireHOL, an iptables stateful packet filtering firewall builder for Linux (kernel 2.4),
supporting NAT, SNAT, DNAT, REDIRECT, MASQUERADE, DMZ, dual-homed, multi-homed and router setups,
protecting and securing hosts and LANs in all kinds of topologies. Configuration is done using
simple client and server statements while it can detect (and produce) its configuration
automatically. FireHOL is extremely easy to understand, configure and audit.
">
<meta name="keywords" content="iptables, netfilter, filter, firewall, stateful, port, secure, security, NAT, DMZ, DNAT, DSL, SNAT, redirect, router, rule, rules, automated, bash, block, builder, cable, complex, configuration, dual-homed, easy, easy configuration, example, fast, features, flexible, forward, free, gpl, helpme mode, human, intuitive, language, linux, masquerade, modem, multi-homed, open source, packet, panic mode, protect, script, service, system administration, wizard">
<meta http-equiv="Expires" content="Wed, 19 Mar 2003 00:00:01 GMT">
</HEAD>
<BODY bgcolor="#FFFFFF">
<center>
<script type="text/javascript"><!--
google_ad_client = "pub-4254040714325099";
google_ad_width = 728;
google_ad_height = 90;
google_ad_format = "728x90_as";
google_ad_channel ="";
google_page_url = document.location;
google_color_border = "336699";
google_color_bg = "FFFFFF";
google_color_link = "0000FF";
google_color_url = "008000";
google_color_text = "000000";
//--></script>
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
</center>
<p>
Troubleshooting a running firewall is relatively simple and for almost all iptables firewalls the means you have are the same:
<b>the system log</b>.
<p>
The system log (usually at <b>/var/log/messages</b>) will log all the packets dropped <b>implicitly</b> by FireHOL.
<b>Implicitly</b> means all packets that did not match any of the rules in FireHOL's configuration file.
<p>
FireHOL always logs all packets not matched by any rule, although it does not log every single packet,
in order to protect you from an attack that could "eat" all of your free hard disk space.
<p>
The frequency packets are logged is controlled by the same means the optional rule parameter
<a href="commands.html#loglimit">loglimit</a> is controlled.
<p>
In the system log you will find entries that look like:
<small><pre>
Dec 21 20:01:07 gateway kernel: IN-internet:IN=ppp0 OUT= MAC= SRC=200.75.88.187 DST=195.97.5.193 \
LEN=78 TOS=0x00 PREC=0x00 TTL=111 ID=63816 PROTO=UDP SPT=34165 DPT=137 LEN=58
Dec 21 22:25:39 gateway kernel: OUT-unknown:IN= OUT=ppp0 SRC=195.97.5.193 DST=192.168.23.1 \
LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=139 DPT=1255 WINDOW=2128 RES=0x00 ACK SYN URGP=0
Dec 21 20:01:07 gateway kernel: PASS-unknown:IN=ppp0 OUT=eth0 SRC=200.75.88.187 DST=195.97.5.194 \
LEN=78 TOS=0x00 PREC=0x00 TTL=110 ID=64840 PROTO=UDP SPT=34132 DPT=137 LEN=58
</pre></small>
Each of such lines represent one packet that did not satisfy the requirements of the configuration file rules.
<p>
The important things to look in these logs are:
<br>
<ul>
<li><b>Its reason text</b>. In FireHOL this has the form <b>IN-name</b>, <b>OUT-name</b>, <b>PASS-name</b>.
<br>
<ul>
<li><b>IN-name</b> matches packets that dropped at the end of the interface's <b>name</b> input.
These are packets tried to come into this host (it is not routed traffic).
<br>
<b>Name</b> matches the name given to a FireHOL <a href="commands.html#interface">interface</a>.
There is also the special name <b>unknown</b> that matches packets tried to come into this
host but did not match any of the <a href="commands.html#interface">interfaces</a> given
in FireHOL's configuration file.
<br>
</li>
<li><b>OUT-name</b> matches packets that dropped at the end of the interface's <b>name</b> output.
These are packets the host tried to send (it is not traffic routed).
<br>
<b>Name</b> matches the name given to a FireHOL <a href="commands.html#interface">interface</a>.
There is also the special name <b>unknown</b> that matches packets tried to go out of this
host but did not match any of the <a href="commands.html#interface">interfaces</a> given
in FireHOL's configuration file.
<br>
</li>
<li><b>PASS-unknown</b> matches packets that dropped at the end of all
<a href="commands.html#router">routers</a>.
This matches forwarded traffic.
<br>
There is no <b>name</b> here, since all FireHOL <a href="commands.html#router">routers</a>
have only one <a href="commands.html#policy">policy</a>: <b>RETURN</b>.
This makes all packets traverse all routers and then dropped at the end of the firewall.
<br>
</li>
</ul>
</li>
<li><b>IN=</b> gives the real network interface name the packet came in from.
<br>
It can be empty when the packet was generated locally.
<br>
</li>
<li><b>OUT=</b> gives the real network interface name the packet tried to use to go out of this host.
<br>
It can be empty when the packet was to be received by the firewall host.
<br>
</li>
<li><b>SRC=</b> gives the IP address of the sender.
<br>
</li>
<li><b>DST=</b> gives the IP address of the packet's destination.
<br>
</li>
<li><b>PROTO=</b> gives the protocol this packet is using (TCP, UDP, ICMP, etc).
<br>
</li>
<li><b>SPT=</b> gives the source port number of this packet.
<br>
</li>
<li><b>DPT=</b> gives the destination port number of this packet.
<br>
</li>
</ul>
Generally, you should monitor the system log for such entries and decide if each entry was something useful or not.
If it was something useful, you should have added another service somewhere in your FireHOL configuration to match
that packet and allow it to reach its destination. If it was not something useful, then FireHOL did the right job
and dropped it.
<p>
Keep in mind that there are certain cases where packets get dropped even though FireHOL has specific rules that should
allow them to pass. Such cases are not always errors, and here is why:
<p>
The iptables connection tracker has a mechanism for matching request packets and reply packets.
When an allowed request comes in, the connection tracker keeps it in a list and then waits for a matching reply to
come in the opposite direction. This list of <b>active connections</b> is available for you to see at <b>/proc/net/ip_conntrack</b>.
Simply <b>cat</b> this file to see all the current connections your system has.
<p>
The connection tracker will wait for a reply a certain amount of time. This time is, for example, about 20 seconds for UDP traffic.
After that time the connection tracker will remove the request from its list.
A reply that is send after the connection tracker has removed the request from its list, will be dropped and therefore logged in
the system log.
<p>
This situation may, for example, produce a few log entries in your DNS server for cases where the DNS server could not respond
within the time limits set by iptables, but this is not a problem because the DNS client had already timed out in 2 or 3 seconds.
<p>
Note however that the above are common when the connection tracker is trying to keep a state on a stateless protocol
(such as UDP or ICMP). Stateful protocols, such as TCP, always respond immediately to acknowledge the connection and therefore
the time needed by the application server to respond does not make the connection tracker to remove the request from its
list.
<p>
<hr noshade size=1>
<table border=0 width="100%">
<tr><td align=center valign=middle>
<A href="http://sourceforge.net"><IMG src="http://sourceforge.net/sflogo.php?group_id=58425&type=5" width="210" height="62" border="0" alt="SourceForge Logo"></A>
</td><td align=center valign=middle>
<small>$Id: trouble.html,v 1.8 2004/10/31 23:43:25 ktsaou Exp $</small>
<p>
<b>FireHOL</b>, a firewall for humans...<br>
© Copyright 2004
Costa Tsaousis <a href="mailto: costa@tsaousis.gr"><costa@tsaousis.gr></a>
</body>
</html>
|
