Boot order iptables problem?

I've got iptables running on a server forwarding eth0 to a LAN.

My symptoms are that I can ping external web servers but not the
firewall server from computers on the LAN. SSH also does not work.

Interestingly if I disable SSH through the firewall
(system-config-securitylevel GUI) then re-enable it then I can ping and
SSH the firewall. If I reboot then I am back to the situation of not
being able to ping the firewall server but I can surf the WWW. Also if
I have it running then re-run my iptables set-up script I lose the
ability to ping or SSH the firewall server.

Perhaps there is a problem that firewall rules are coming up too soon
during boot or vice versa.
I seem to remember this all working under FC3 but since switching to
FC5 I've noticed this weird behavior.


Any thoughts? On the firewall server I am running FC5
2.6.17-1.2174_FC5

Here is my iptables script
-------------------------------------------
#!/bin/sh

#Last modified 08/16/06 DPD
#Relevant for Fedora Core 5.

#Note: For forwarding to work you must have set already
#net.ipv4.ip_forward = 1
#in the file /etc/sysctl.conf. Setting to 0 will stop ip forwarding
#while leaving the configuration in tact (sometimes useful/desrirable)
#while working things out.

#Replace this with your network interface nickname that connects
#the gateway to the internet (e.g. eth0)
OUTSIDE=eth0

#Replace this with the your network nickname that connects the gateway
#to the LAN
LANSIDE=eth0:g

################################################## #########
#Modify the following lines at your own risk
################################################## #########


# erase rules
/sbin/iptables -F
/sbin/iptables -t nat -F

# default policies
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT

# NAT on eth0.
#/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# block all on eth0 input, except established and related packets
#/sbin/iptables -A INPUT -i ppp0 -m state --state ESTABLISHED,RELATED
-j ACCEPT
#/sbin/iptables -A INPUT -i ppp0 -j DROP

# NAT on OUTSIDE
/sbin/iptables -t nat -A POSTROUTING -o $OUTSIDE -j MASQUERADE

# block all on OUTSIDE input, except established and related packets
/sbin/iptables -A INPUT -i $OUTSIDE -m state --state
ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -i $OUTSIDE -j DROP

################################################## #########
#This last command saves the iptable configuration as it stands now for
subsequent boots.
#If we don't run this then the configuration is lost next time we
reboot.
/etc/init.d/iptables save

On Wed, 06 Sep 2006 15:41:11 -0700, dpdoughe wrote:

> Interestingly if I disable SSH through the firewall
> (system-config-securitylevel GUI) then re-enable it then I can ping and
> SSH the firewall. If I reboot then I am back to the situation of not
> being able to ping the firewall server but I can surf the WWW. Also if
> I have it running then re-run my iptables set-up script I lose the
> ability to ping or SSH the firewall server.

I would say after you disable and re-enable SSH you should run the
following command;

service iptables save

This will save your setting that are working.

> Perhaps there is a problem that firewall rules are coming up too soon
> during boot or vice versa.

You want your firewall rules to come up before the interfaces so your
system(s) are protected.

Also looking at the rules you listed below there is nothing in there that
has anything to do with SSH or ping. Make a copy of
/etc/sysconfig/iptables then get everything up and working. After that
run the command above and then re-post the iptables file. I don't think
we are getting the whole story.

Thinking what you are showing below is not the /etc/sysconfig/iptables
file that the system uses when it starts iptables. You are most likely
starting this script after the system has started iptables and thus
killing the system settings.

> Any thoughts? On the firewall server I am running FC5

Yeah run a script once to configure your firewall and then let the system
do the work. Post the file i talked about above then we can get you setup
correctly.


--

Regards
Robert

Smile... it increases your face value!


----== Posted via Newsfeeds.Com - Unlimited-Unrestricted-Secure Usenet News==----
http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups
----= East and West-Coast Server Farms - Total Privacy via Encryption =----