Networking-Blog

My WordPress Blog

Categories

Linux Iptables Port Forward

PREROUTING rule so that traffic coming to a particular public IP port is routed to your internal machine.

DNAT the traffic to your internal machine
Internal machine FILTER rules should not block the incoming traffic .

sudo iptables -t nat -I PREROUTING 1 -d 85.234.65.57 -p tcp -m multiport –dports 80,443
-j DNAT –to 10.20.0.13
!
sudo iptables -I FORWARD 33 -d 10.20.0.13 -p tcp -m multiport –dports 80,443 -j ACCEPT
sudo iptables -I FORWARD -m state –state RELATED,ESTABLISHED -j ACCEPT

RELATED,ESTABLISHED will take care of any return packets.
Accept packets to webservers (http and https) in the FORWARD chain.


Create additional chain within FORWARD chain to jump to another chain.
This configuration is organizing chain to required service or naming ACL.


Create a chain :
sudo iptables -N ahdb_network
Create FORWARD rule to jump to ahdb_network :
sudo iptables -I FORWARD 1 -s 128.0.0.0/8 -d 128.0.0.0/8 -j ahdb_network
sudo iptables -I FORWARD 1 -s 128.0.0.0/8 -d 10.0.0.0/16 -j ahdb_network
sudo iptables -I FORWARD 1 -s 10.0.0.0/16 -d 128.0.0.0/8 -j ahdb_network
ahdb_network Chain :
sudo iptables -I ahdb_network 1 -s 128.0.0.0/8 -d 128.0.0.0/8 -j ACCEPT
sudo iptables -I ahdb_network 2 -s 128.10.0.0/16 -d 10.0.0.0/16 -j ACCEPT
sudo iptables -I ahdb_network 3 -s 128.20.0.0/16 -d 10.0.0.0/16 -j ACCEPT
sudo iptables -I ahdb_network 4 -s 10.0.0.0/16 -d 128.10.0.0/16 -j ACCEPT
sudo iptables -I ahdb_network 5 -s 10.0.0.0/16 -d 128.20.0.0/16 -j ACCEPT


Intersite VPN Connectivity :

iptables -I FORWARD 63 -o eth0 -s 10.20.0.0/16 -d 10.20.21.1/32 -p tcp -m tcp
--dport 3389 -j Priory_Vets_Group
!
iptables -I FORWARD 64 -o eth0 -s 10.20.21.1/32 -d 10.20.0.0/16 -p tcp -m tcp
--sport 3389 -j Priory_Vets_Group
!
iptables -I Priory_Vets_Group 1 -d 10.20.0.0/16 -j ACCEPT
iptables -I Priory_Vets_Group 2 -d 10.20.21.1/32 -j ACCEPT
IpTables
No comments yet.

Tags: ,

by admin

Cisco ASA Port-Forward

PIX/ASA 7.x and above: Mail (SMTP) Server Access on the DMZ Configuration Example

!— This access list allows hosts to access !— IP address 192.168.200.227 for the !— Simple Mail Transfer Protocol (SMTP) port.

access-list outside_int extended permit tcp any host 192.168.200.227 eq smtp

!— Allows outgoing SMTP connections. !— This access list allows host IP 172.16.31.10 !— sourcing the SMTP port to access any host.

access-list dmz_int extended permit tcp host 172.16.31.10 any eq smtp

!— This network static does not use address translation. !— Inside hosts appear on the DMZ with their own addresses.

static (inside,dmz) 10.1.1.0 10.1.1.0 netmask 255.255.255.0

!— This network static uses address translation. !— Hosts accessing the mail server from the outside !— use the 192.168.200.227 address.

static (dmz,outside) 192.168.200.227 172.16.31.10 netmask 255.255.255.255

access-group outside_int in interface outside
access-group dmz_int in interface dmz

!— The inspect esmtp command (included in the map) allows !— SMTP/ESMTP to inspect the application.

policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp

BGP, CheckPoint, Cisco ASA, Cisco MPLS, Cisco Routers, Cisco Switch, FireBrick, FireWalls, Hot Standby, HP, IpTables, Linux, Microsoft, Routing Protocol, VM, xrio, Zyxel Router
No comments yet.

Tags: , ,

by admin

Cisco ASA Port Forward

static (inside,outside) 70.167.x.x 192.168.1.200 netmask 255.255.255.255
wan                    lan

Configure access-list to allow incoming Wan traffic :

access-list outside_in extended permit tcp any host 70.167.x.x eq smtp

Assign access-list to Outside Interface :

access-group outside_in in interface outside

eg :

static (MPLS,PublicIP) tcp 85.234.75.65 7870 172.18.192.24 7870 netmask 255.255.255.255
!
access-list MPLS_access_in extended permit tcp host 172.18.192.24 host 85.234.75.65 eq 7870
!
access-list PublicIP_access_in extended permit tcp host 172.18.192.24 host 85.234.75.65 eq 7870
!
!
access-group  MPLS_access_in in interface outside
access-group PublicIP_access_in in interface outside

Allow all traffic from source ip to destination ip address:

access-list PublicIP_access_in extended permit ip host 172.18.192.24 host 125.215.194.223
access-list PublicIP_access_in extended permit ip host 172.18.192.24 host 125.215.194.252
access-list PublicIP_access_in extended permit ip host 172.18.192.24 host 125.215.194.253
access-list PublicIP_access_in extended permit ip host 172.18.192.24 host 125.215.194.232
!
access-list PublicIP_access_in extended permit ip host 172.16.0.68 host 125.215.194.223
access-list PublicIP_access_in extended permit ip host 172.16.0.68 host 125.215.194.252
access-list PublicIP_access_in extended permit ip host 172.16.0.68 host 125.215.194.253
access-list PublicIP_access_in extended permit ip host 172.16.0.68 host 125.215.194.232

Cisco ASA
No comments yet.

Tags: , ,

by admin