Telnet 1863

marceloalveslima
(usa Debian)

Enviado em 12/12/2012 - 17:04h

Galera,
Seguinte, no meu ambiente de teste consigo dar um telnet numa boa nas portas das regras abaixo mas quando tento na 1863 o mesmo não conecta, ja tentei fora da rede conectou numa boa, existe algum bloqueio não estou conseguindo pegar nos logs do iptables, segue abaixo regras, alguém sabe me dizer oque e? msn exige alguma outra portar udp talvez?.


eth0=Internet
eth1=redeinternet
REDEINT=192.168.26.0/24 = rede interna

iptables -P FORWARD DROP
sysctl -w net.ipv4.ip_forward=1

$IPT -A FORWARD -o eth1 -j ACCEPT
$IPT -A FORWARD -p tcp -s $REDEINT -m multiport --dport 22,445,587,993,1863 -j ACCEPT

$IPT -t nat -A POSTROUTING -o eth0 -j MASQUERADE

phrich
(usa Slackware)

Enviado em 12/12/2012 - 17:10h

veja com o tcpdump:

#tcpdump -ni any host ip_da_estação


Então veja os detalhes na saída...

marceloalveslima
(usa Debian)

Enviado em 12/12/2012 - 17:25h

Olha so o que me retornou, nao consegui entender muito o log, existe algum bloqueio?

root@russia:~# telnet messenger.hotmail.com 1863
Trying 65.55.64.254...
telnet: Unable to connect to remote host: Connection timed out

No Firewall

17:20:13.074264 ARP, Request who-has 192.168.26.22 tell 192.168.26.2, length 46
17:20:18.080840 IP 192.168.26.22.54383 > 65.55.64.254.1863: Flags [S], seq 3085625416, win 5840, options [mss 1460,sackOK,TS val 410930 ecr 0,nop,wscale 5], length 0
17:20:21.077028 IP 192.168.26.22.54383 > 65.55.64.254.1863: Flags [S], seq 3085625416, win 5840, options [mss 1460,sackOK,TS val 411680 ecr 0,nop,wscale 5], length 0
17:20:23.077009 ARP, Request who-has 192.168.26.1 tell 192.168.26.22, length 46
17:20:23.077060 ARP, Reply 192.168.26.1 is-at 52:54:00:f0:d4:32, length 28
17:20:27.076983 IP 192.168.26.22.54383 > 65.55.64.254.1863: Flags [S], seq 3085625416, win 5840, options [mss 1460,sackOK,TS val 413180 ecr 0,nop,wscale 5], length 0


root@russia:~# telnet smtp.googlemail.com 587
Trying 74.125.130.16...
Connected to googlemail-smtp.l.google.com.
Escape character is '^]'.
220 mx.google.com ESMTP w1sm2981665anl.5

Neste ele conectou numa boa e me retonou o log abaixo no firewall

17:16:49.471794 ARP, Request who-has 192.168.26.22 tell 192.168.26.2, length 46
17:16:49.675650 IP 192.168.26.22.54130 > 74.125.130.16.587: Flags [S], seq 2848907125, win 5840, options [mss 1460,sackOK,TS val 358829 ecr 0,nop,wscale 5], length 0
17:16:49.806885 IP 74.125.130.16.587 > 192.168.26.22.54130: Flags [S.], seq 3910307608, ack 2848907126, win 14180, options [mss 1430,sackOK,TS val 1949842160 ecr 358829,nop,wscale 6], length 0
17:16:49.807557 IP 192.168.26.22.54130 > 74.125.130.16.587: Flags [.], ack 1, win 183, options [nop,nop,TS val 358862 ecr 1949842160], length 0
17:16:50.012724 IP 74.125.130.16.587 > 192.168.26.22.54130: Flags [P.], seq 1:45, ack 1, win 222, options [nop,nop,TS val 1949842365 ecr 358862], length 44
17:16:50.013410 IP 192.168.26.22.54130 > 74.125.130.16.587: Flags [.], ack 45, win 183, options [nop,nop,TS val 358914 ecr 1949842365], length 0
17:16:54.803457 ARP, Request who-has 192.168.26.22 tell 192.168.26.1, length 28
17:16:54.804086 ARP, Reply 192.168.26.22 is-at 52:54:00:22:f4:a7, length 46
17:16:59.568434 IP 192.168.26.22.54130 > 74.125.130.16.587: Flags [P.], seq 1:7, ack 45, win 183, options [nop,nop,TS val 361302 ecr 1949842365], length 6
17:16:59.698938 IP 74.125.130.16.587 > 192.168.26.22.54130: Flags [.], ack 7, win 222, options [nop,nop,TS val 1949852053 ecr 361302], length 0
17:16:59.700062 IP 74.125.130.16.587 > 192.168.26.22.54130: Flags [P.], seq 45:94, ack 7, win 222, options [nop,nop,TS val 1949852053 ecr 361302], length 49
17:16:59.700409 IP 74.125.130.16.587 > 192.168.26.22.54130: Flags [F.], seq 94, ack 7, win 222, options [nop,nop,TS val 1949852053 ecr 361302], length 0
17:16:59.700758 IP 192.168.26.22.54130 > 74.125.130.16.587: Flags [.], ack 94, win 183, options [nop,nop,TS val 361335 ecr 1949852053], length 0
17:16:59.700861 IP 192.168.26.22.54130 > 74.125.130.16.587: Flags [F.], seq 7, ack 95, win 183, options [nop,nop,TS val 361335 ecr 1949852053], length 0
17:16:59.831701 IP 74.125.130.16.587 > 192.168.26.22.54130: Flags [.], ack 8, win 222, options [nop,nop,TS val 1949852185 ecr 361335], length 0

phrich
(usa Slackware)

Enviado em 12/12/2012 - 17:34h

Viu as portas que ele conectou?

Talvez ele tbém possa utilizar alguma url, utilize o tcpdump sem o -n (mas mantenha o -i) e veja os hosts...

marceloalveslima
(usa Debian)

Enviado em 12/12/2012 - 17:47h

Tambem realizei um teste liberando tudo nao deu certo.

#Liberando Internet russia
$IPT -t nat -A POSTROUTING -s $RUSSIA -j MASQUERADE
$IPT -I FORWARD -s $RUSSIA -j ACCEPT

Em meu Firewall me retornou isso,
root@israel:~# tcpdump -i any host 192.168.26.22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
17:46:49.214001 ARP, Request who-has 192.168.26.2 tell 192.168.26.22, length 46
17:46:49.368201 ARP, Request who-has 192.168.26.22 tell 192.168.26.2, length 46
17:46:49.536093 ARP, Request who-has 192.168.26.1 tell 192.168.26.22, length 46
17:46:49.536565 ARP, Reply 192.168.26.1 is-at 52:54:00:f0:d4:32 (oui Unknown), length 28
17:46:49.537202 IP 192.168.26.22.54389 > 65.55.64.254.msnp: Flags [S], seq 4097751016, win 5840, options [mss 1460,sackOK,TS val 808790 ecr 0,nop,wscale 5], length 0
17:46:52.518046 IP 192.168.26.22.54389 > 65.55.64.254.msnp: Flags [S], seq 4097751016, win 5840, options [mss 1460,sackOK,TS val 809540 ecr 0,nop,wscale 5], length 0
17:46:58.516989 IP 192.168.26.22.54389 > 65.55.64.254.msnp: Flags [S], seq 4097751016, win 5840, options [mss 1460,sackOK,TS val 811040 ecr 0,nop,wscale 5], length 0

phrich
(usa Slackware)

Enviado em 12/12/2012 - 17:53h

Com esses dados na mão, é só analisar e partir "pro abraço"

marceloalveslima
(usa Debian)

Enviado em 12/12/2012 - 18:02h

phrich ainda sou meio junior em iptables, no log ele acessa o 65.55.64.254.msnp para mim nao tem nada de errado, voce poderia dar uma ajudinha ou explicar onde esta o problema?

phrich
(usa Slackware)

Enviado em 12/12/2012 - 18:06h

posta o seu script de firewall aí

marceloalveslima
(usa Debian)

Enviado em 12/12/2012 - 18:15h

Segue..


#!/bin/bash
set -x

case $1 in
start)

iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

sysctl -w net.ipv4.ip_forward=1

REDEINT="192.168.26.0/24"
REDEEXT="192.168.25.0/24"
IPT=/sbin/iptables
IPSEMAIL=`cat /etc/firewall/ipsemail.txt`

ISRAEL="192.168.26.1"
RUSSIA="192.168.26.22"
INDIA="192.168.26.24"

$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

$IPT -A INPUT -p tcp -m multiport --sport 80,443 -j ACCEPT
$IPT -A OUTPUT -p tcp -m multiport --dport 80,443 -j ACCEPT

$IPT -A INPUT -p udp -m multiport --sport 53 -j ACCEPT
$IPT -A OUTPUT -p udp -m multiport --dport 53 -j ACCEPT

$IPT -A INPUT -p tcp -s $REDEINT -m multiport --dport 2222,8080 -j ACCEPT
$IPT -A OUTPUT -p tcp -m multiport --sport 2222,8080 -j ACCEPT

$IPT -A INPUT -p udp -m multiport --dport 53 -j ACCEPT
$IPT -A OUTPUT -p udp -m multiport --sport 53 -j ACCEPT

$IPT -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
$IPT -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT

$IPT -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT


$IPT -A FORWARD -o eth1 -j ACCEPT

$IPT -A FORWARD -p tcp -s $REDEINT -m multiport --dport 22,445,1863 -j ACCEPT

for i in $IPSEMAIL;do
$IPT -A FORWARD -p tcp -s $i -m multiport --dport 25,110,587,993 -j ACCEPT
done


echo "Regras Prerouting OK"


#Argelia Repositorio porta 81
# $IPT -t nat -A PREROUTING -i $ETHINTERNET -p tcp --dport 81 -j DNAT --to $INDIA:80


$IPT -t nat -A POSTROUTING -s $INDIA -j MASQUERADE
$IPT -I FORWARD -s $INDIA -j ACCEPT

$IPT -t nat -A POSTROUTING -s $RUSSIA -j MASQUERADE
$IPT -I FORWARD -s $RUSSIA -j ACCEPT

$IPT -t nat -A POSTROUTING -o eth0 -j MASQUERADE

$IPT -A INPUT -j LOG --log-prefix "INPUT NEGADA"
$IPT -A OUTPUT -j LOG --log-prefix "OUTPUT NEGADA"
$IPT -A FORWARD -j LOG --log-prefix "FORWARD NEGADA"

;;
stop)

iptables -F -t nat
iptables -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

;;
restart)
$0 stop
$0 start
;;
esac

phrich
(usa Slackware)

Enviado em 12/12/2012 - 18:49h

Cara, seu script está meio bagunçado, vc deve seguir uma ordem, veja o artigo para lhe auxiliar:

http://www.vivaolinux.com.br/artigo/Iptables-Seguranca-total-para-sua-rede/

marceloalveslima
(usa Debian)

Enviado em 12/12/2012 - 18:59h

Valeu ai pela dica vou ler e relere reorganizar, mas e quanto ao telnet onde estou errando?

phrich
(usa Slackware)

Enviado em 12/12/2012 - 19:01h

Cara, não teste com telnet, teste com o próprio msn...