Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.

iptables line 2 failed

[es] :: Linux mreže :: iptables line 2 failed

[ Pregleda: 2649 | Odgovora: 10 ] > FB > Twit

Postavi temu Odgovori

Autor

Pretraga teme: Traži
Markiranje Štampanje RSS

Invisible Maan
njanja njanjic
Biograd,HR

Član broj: 93844
Poruke: 26
*.dsl.optinet.hr.

ICQ: 197353246


Profil

icon iptables line 2 failed21.08.2009. u 13:25 - pre 147 meseci
imam skriptu za firewall..uzmimo za primjer firewall.rc kopiram je u /etc/iptables-save i odradim komandu

cat /etc/iptables-save | iptables-restore -c

linux mi izbaci line 31 failed...jel tko zna u čemu je problem...kroistim slackware
 
Odgovor na temu

maksvel

Moderator
Član broj: 107376
Poruke: 2416

Jabber: maksvel
Sajt: maksvel.in.rs


+161 Profil

icon Re: iptables line 2 failed21.08.2009. u 13:36 - pre 147 meseci
A šta piše u toj 31. liniji? Može biti da je neko pravilo problematično...
 
Odgovor na temu

Invisible Maan
njanja njanjic
Biograd,HR

Član broj: 93844
Poruke: 26
*.dsl.optinet.hr.

ICQ: 197353246


Profil

icon Re: iptables line 2 failed21.08.2009. u 22:50 - pre 147 meseci
ma skinuo sam skriptu firewall.rc i još par primjera i svudi isto..čin dodje do prve linije bez komentara tu javlja grešku
 
Odgovor na temu

combuster
Ivan Bulatovic
Kraljevo

Član broj: 151351
Poruke: 4563
93.86.111.*

Sajt: www.linuxsrbija.org


+104 Profil

icon Re: iptables line 2 failed22.08.2009. u 04:38 - pre 147 meseci
Jel mozes da okacis tu skriptu?
make love - !war
 
Odgovor na temu

Tyler Durden
Tyler Durden
Beograd

Član broj: 4312
Poruke: 3379
*.adsl.verat.net.



+1365 Profil

icon Re: iptables line 2 failed22.08.2009. u 08:21 - pre 147 meseci
Linija 31 je vjerovatno COMMIT...
Beneath civilization's fragile crust, cold chaos churns...
 
Odgovor na temu

Invisible Maan
njanja njanjic
Biograd,HR

Član broj: 93844
Poruke: 26
*.201.233.0

ICQ: 197353246


Profil

icon Re: iptables line 2 failed22.08.2009. u 10:05 - pre 147 meseci
Citat:
#!/bin/sh
set -e
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# Ciscenje FILTER tabela
iptables -t filter -F
iptables -t filter -X

# Svi kojima vjerujemo idu u odgovarajucu bijelu listu
TRUSTED_SSH="161.53.0.0/16"
iptables -N SSH_WHITELIST
iptables -F SSH_WHITELIST

iptables -A SSH_WHITELIST -s $TRUSTED_SSH -m recent --remove --name SSH -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSH_WHITELIST

# Rezanje pristupa i logiranje adresa s kojih dolaze SSH brute force napadi
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 \
--rttl --name SSH -m limit --limit 2/sec -j LOG --log-prefix "SSH_brute_force:"
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 \
--rttl --name SSH -j DROP


Citat:
#!/bin/sh
#
# rc.firewall - Initial SIMPLE IP Firewall script for Linux 2.4.x and iptables
#
# Copyright (C) 2001 Oskar Andreasson <bluefluxATkoffeinDOTnet>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program or from the site that you downloaded it
# from; if not, write to the Free Software Foundation, Inc., 59 Temple
# Place, Suite 330, Boston, MA 02111-1307 USA
#

###########################################################################
#
# 1. Configuration options.
#

#
# 1.1 Internet Configuration.
#

INET_IP="194.236.50.155"
INET_IFACE="eth0"
INET_BROADCAST="194.236.50.255"

#
# 1.1.1 DHCP
#

#
# 1.1.2 PPPoE
#

#
# 1.2 Local Area Network configuration.
#
# your LAN's IP range and localhost IP. /24 means to only use the first 24
# bits of the 32 bit IP address. the same as netmask 255.255.255.0
#

LAN_IP="192.168.0.2"
LAN_IP_RANGE="192.168.0.0/16"
LAN_IFACE="eth1"

#
# 1.3 DMZ Configuration.
#

#
# 1.4 Localhost Configuration.
#

LO_IFACE="lo"
LO_IP="127.0.0.1"

#
# 1.5 IPTables Configuration.
#

IPTABLES="/usr/sbin/iptables"

#
# 1.6 Other Configuration.
#

###########################################################################
#
# 2. Module loading.
#

#
# Needed to initially load modules
#

/sbin/depmod -a

#
# 2.1 Required modules
#

/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_state

#
# 2.2 Non-Required modules
#

#/sbin/modprobe ipt_owner
#/sbin/modprobe ipt_REJECT
#/sbin/modprobe ipt_MASQUERADE
#/sbin/modprobe ip_conntrack_ftp
#/sbin/modprobe ip_conntrack_irc
#/sbin/modprobe ip_nat_ftp
#/sbin/modprobe ip_nat_irc

###########################################################################
#
# 3. /proc set up.
#

#
# 3.1 Required proc configuration
#

echo "1" > /proc/sys/net/ipv4/ip_forward

#
# 3.2 Non-Required proc configuration
#

#echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
#echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
#echo "1" > /proc/sys/net/ipv4/ip_dynaddr

###########################################################################
#
# 4. rules set up.
#

######
# 4.1 Filter table
#

#
# 4.1.1 Set policies
#

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

#
# 4.1.2 Create userspecified chains
#

#
# Create chain for bad tcp packets
#

$IPTABLES -N bad_tcp_packets

#
# Create separate chains for ICMP, TCP and UDP to traverse
#

$IPTABLES -N allowed
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets

#
# 4.1.3 Create content in userspecified chains
#

#
# bad_tcp_packets chain
#

$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \
-m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
--log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

#
# allowed chain
#

$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP

#
# TCP rules
#

$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed

#
# UDP ports
#

#$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 53 -j ACCEPT
#$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 123 -j ACCEPT
#$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 2074 -j ACCEPT
#$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 4000 -j ACCEPT

#
# In Microsoft Networks you will be swamped by broadcasts. These lines
# will prevent them from showing up in the logs.
#

#$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d $INET_BROADCAST \
#--destination-port 135:139 -j DROP

#
# If we get DHCP requests from the Outside of our network, our logs will
# be swamped as well. This rule will block them from getting logged.
#

#$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 \
#--destination-port 67:68 -j DROP

#
# ICMP rules
#

$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

#
# 4.1.4 INPUT chain
#

#
# Bad TCP packets we don't want.
#

$IPTABLES -A INPUT -p tcp -j bad_tcp_packets

#
# Rules for special networks not part of the Internet
#

$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT

#
# Special rule for DHCP requests from LAN, which are not caught properly
# otherwise.
#

$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT

#
# Rules for incoming packets from the internet.
#

$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED \
-j ACCEPT
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets

#
# If you have a Microsoft Network on the outside of your firewall, you may
# also get flooded by Multicasts. We drop them so we do not get flooded by
# logs
#

#$IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP

#
# Log weird packets that don't match the above.
#

$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT INPUT packet died: "

#
# 4.1.5 FORWARD chain
#

#
# Bad TCP packets we don't want
#

$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets

#
# Accept the packets we actually want to forward
#

$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

#
# Log weird packets that don't match the above.
#

$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT FORWARD packet died: "

#
# 4.1.6 OUTPUT chain
#

#
# Bad TCP packets we don't want.
#

$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets

#
# Special OUTPUT rules to decide which IP's to allow.
#

$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT

#
# Log weird packets that don't match the above.
#

$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "

######
# 4.2 nat table
#

#
# 4.2.1 Set policies
#

#
# 4.2.2 Create user specified chains
#

#
# 4.2.3 Create content in user specified chains
#

#
# 4.2.4 PREROUTING chain
#

#
# 4.2.5 POSTROUTING chain
#

#
# Enable simple IP Forwarding and Network Address Translation
#

$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP

#
# 4.2.6 OUTPUT chain
#

######
# 4.3 mangle table
#

#
# 4.3.1 Set policies
#

#
# 4.3.2 Create user specified chains
#

#
# 4.3.3 Create content in user specified chains
#

#
# 4.3.4 PREROUTING chain
#

#
# 4.3.5 INPUT chain
#

#
# 4.3.6 FORWARD chain
#

#
# 4.3.7 OUTPUT chain
#

#
# 4.3.8 POSTROUTING chain
#



u prvoj skripti javlja grešku na drugoj liniji a u drugoj skripti na 31
 
Odgovor na temu

combuster
Ivan Bulatovic
Kraljevo

Član broj: 151351
Poruke: 4563
93.86.111.*

Sajt: www.linuxsrbija.org


+104 Profil

icon Re: iptables line 2 failed22.08.2009. u 10:28 - pre 147 meseci
Pa kolje te na prvoj liniji koda koji nije komentar.

Probaj ovako: /sbin/iptables-restore < /etc/iptables-save

Jel ti kaze jos nesto kad prijavi line error, kako tacno glasi error message?
make love - !war
 
Odgovor na temu

maksvel

Moderator
Član broj: 107376
Poruke: 2416

Jabber: maksvel
Sajt: maksvel.in.rs


+161 Profil

icon Re: iptables line 2 failed22.08.2009. u 10:59 - pre 147 meseci
Čini mi se da je ovde problem u konceptu skript/iptables-save. Da bi koristio iptables-restore, moraš mu dati regularan format pravila tabela, a ne tekst skripta. Znači, izvršiš skript, pa onda sačuvaš tabele sa iptables-save, a posle radiš restore.
iptables ne konta šta je set -e ili INET_IP="194.236.50.155" .
 
Odgovor na temu

Invisible Maan
njanja njanjic
Biograd,HR

Član broj: 93844
Poruke: 26
*.201.233.0

ICQ: 197353246


Profil

icon Re: iptables line 2 failed22.08.2009. u 12:24 - pre 147 meseci
ne kuzin bas...mos mi malo pojasnit
 
Odgovor na temu

combuster
Ivan Bulatovic
Kraljevo

Član broj: 151351
Poruke: 4563
93.86.111.*

Sajt: www.linuxsrbija.org


+104 Profil

icon Re: iptables line 2 failed22.08.2009. u 12:57 - pre 147 meseci
Ja stvarno to nisam ni primetio. Ono sto je maksvel hteo da ti kaze je da podesavanja sacuvas sa iptables-save i kasnije da ih ucitas sa iptables-restore.

pokreni kao root iptables-save -c > /home/tvojusername/ipsave
a zatim odradi cat /home/tvojusername/ipsave i pogledaj kakav ti output daje, videces da je u drugacijem formatu od firewall skripte.

Firewall skriptu postavis u /etc/rc.d/ postavis je kao executable, resetujes i to je to...
make love - !war
 
Odgovor na temu

Invisible Maan
njanja njanjic
Biograd,HR

Član broj: 93844
Poruke: 26
*.201.233.0

ICQ: 197353246


Profil

icon Re: iptables line 2 failed22.08.2009. u 13:04 - pre 147 meseci
jap skuzija san...


dokumentacija za iptables mi se cini jako loša...objasnu dobro podešavanja i što kako triba,ali kako to pokrenut da radi i slične stvari su jako slabo pokrivene
 
Odgovor na temu

[es] :: Linux mreže :: iptables line 2 failed

[ Pregleda: 2649 | Odgovora: 10 ] > FB > Twit

Postavi temu Odgovori

Navigacija
Lista poslednjih: 16, 32, 64, 128 poruka.