Posts Tagged ‘iptables’

Control DropBox access with iptables

Thursday, March 24th, 2016

I have a few VMs on my network which do not require internet access. However I received a requirement to allow dropbox on them.
My iptables rules are configured to either allow full internet, or one at all.
So After some poking around, I managed to set up forward rules so that specific VMs get dropbox. from here: http://superuser.com/a/1056155/70234
a basic iptables for this scneario looks like this:

*filter
:partinet - [0:0]
:dropbox - [0:0]
-A partinet -p icmp -j ACCEPT

-A dropbox -p tcp -d 162.125.32.129 -j ACCEPT
-A dropbox -p tcp -s 162.125.32.129 -j ACCEPT
-A dropbox -p tcp -d 162.125.17.131 -j ACCEPT
-A dropbox -p tcp -s 162.125.17.131 -j ACCEPT

-A FORWARD -s 192.168.1.x -j partinet
-A FORWARD -d 192.168.1.x -j partinet
-A FORWARD -s 192.168.1.x -j dropbox
-A FORWARD -d 192.168.1.x -j dropbox

COMMIT

and in order to properly support all/most dropbox IPs, I found this blog: https://blog.varonis.com/detect-dropbox-network/ which pointed me to http://whois.arin.net/rest/org/DROPB/nets
so I computed the following iptables rules for my dropbox chain (the list needs to be maintained, of course. I may or may not write a script to automate the creation of these rules based on the arin.net page):

-A dropbox -i eth1 -o eth0 -p tcp -d 162.125.0.0/16 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 162.125.0.0/16 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 199.47.216.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 162.47.216.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 199.47.217.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 162.47.217.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 199.47.218.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 162.47.218.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 199.47.219.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 162.47.219.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.160.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.160.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.161.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.161.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.162.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.162.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.163.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.163.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.164.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.164.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.165.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.165.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.166.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.166.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.167.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.167.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.168.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.168.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.169.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.169.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.170.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.170.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.171.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.171.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.172.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.172.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.173.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.173.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.174.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.174.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 108.160.175.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 108.160.175.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 205.189.0.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 205.189.0.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 209.99.70.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 209.99.70.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.64.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.64.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.65.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.65.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.66.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.66.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.67.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.67.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.68.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.68.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.69.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.69.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.70.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.70.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.71.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.71.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.72.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.72.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.73.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.73.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.74.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.74.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.75.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.75.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.76.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.76.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.77.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.77.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.78.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.78.0/24 -j ACCEPT
-A dropbox -i eth1 -o eth0 -p tcp -d 45.58.79.0/24 -j ACCEPT
-A dropbox -i eth0 -o eth1 -p tcp -s 45.53.79.0/24 -j ACCEPT

Related posts

Troubleshooting NFS

Monday, January 6th, 2014

Every now and then I have issues with my NFS setup, server-side or client-side. And since I don’t usually handle NFS all that often, I always forget how to solve it and end up wasting a ton of time debugging and searching and stuff.

SO I finally, seconds before posting a long question on serverfault.com, managed to pin it down once again.

So, long story short:
– pretty much most of the problems regarding NFS come from firewall: server-side, client-side and/or router-side. So make sure to disable them all and see if that works. If it does, I’ll explain later how to make it work with your firewall enabled as well
– then, there are NFS server and NFS client configuration issues. There are plenty of how-tos out there for this

So how to troubleshoot a firewall/iptables issue? The most common flag for this problem is “connection timeout”. If you get it, it’s most likely a firewall/routing issue.

What I just did now, in my case, is to set up my firewall rules such a way that all drops are going to a special “mydrop” target, in which I drop everything.
Then, I have some scripts made which cancels, restores and enables logging in the firewall.
The logging script will cancel the firewall, then restore it (this cleans up stuff) then it adds logging like:

iptables -I mydrop -m limit --limit 2/sec -j LOG --log-prefix "IPTables-dropped: " --log-level 4 --log-tcp-options --log-ip-options

then, in another console, I do

tail -f /var/log/messages

and in the first one I start the mount/showmount/rpcinfo commands and check the tail log to see what packets are being dropped.
Then I make rules for those packets.

Now, in my personal case, I set up my NFS server to have static/dedicated ports (there are how-tos out there on how to do it, I won’t go over them here).
So, on a tight firewalled linux machine, the iptables rules for NFS client would look like this

# nfs client
-A services -s 192.168.1.4 -p tcp --sport 111 -j ACCEPT
-A services -s 192.168.1.4 -p tcp --sport 892 -j ACCEPT
-A services -s 192.168.1.4 -p tcp --sport 2049 -j ACCEPT
-A services -s 127.0.0.1 -d 127.0.0.1 -p udp --dport 111 -j ACCEPT
-A services -s 127.0.0.1 -d 127.0.0.1 -p udp --sport 111 -j ACCEPT

“services” in this context is a dedicated target for my used services (usually server/daemon stuff, but also client stuff when needed, like this scenario).
Note: 192.168.1.4 is my NFS server.

Then, on server side I have this
# nfs server
-A services -s 192.168.1.0/24 -m state --state NEW -p udp --dport 111 -j ACCEPT
-A services -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 111 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 32803 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 32769 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 892 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 892 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 875 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 875 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -m state --state NEW -p tcp --dport 662 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -m state --state NEW -p udp --dport 662 -j ACCEPT

the rules with INPUT I have copied from another blog/site, which I can’t recall now. At the time I get these, I didn’t think about the logging idea I just wrote about, and I don’t want to kill all my machines to test it so I can figure out exactly what rules to put there.

Anyway, I hope this logging idea will help someone save some hours.

Related posts

Remember your firewall

Monday, July 6th, 2009

I have literally spent over 4 hours trying to get powerdns working on my server. I kept getting connection errors. Googled like crazy, nothing worked.
And then it hit me: I have a very negative firewall set up (which is good, kept me safe for years). One minor iptables change and it all went smoothly.
Geez, I got to remember my firewall!

Related posts