[Riješeno] virt-manager, firewal

[komir]

Trebam pomoć oko konfiguriranja firewalla.
Imao sam preko virt-managera (KVM) instalirane neke strojeve, sad sam instalirao firestarter i sad mi niti jedan stroj nemože na net. Bili su složeni da idu preko nat na bilo koju karticu žičnu ili bežićnu.
Ako može pomoć kako da složim da mogu na net sa virt strojevima, nisam baš neki majstor za firewall i linux, taj dio radim na "windows principu", plug and play
Hvala

[glaskoncILLa]

kako je prije bio slozen nat, preko iptablesa?

[komir]

Imao sam samo ukljućen gUFW i stavljen da blokira sav ulazni promet

[glaskoncILLa]

nisam shvatio gdje je tu veza sa natom, skonfao si ga preko gUFW?

[komir]

U virtual-manageru sam stavio da je izlaz na mrežu za virtualne mašine preko NAT-a, a za firewall na hostu sam koristio gufw na kojem sam stavio da mi blokira dolazni promet

[glaskoncILLa]

ok, daj ispis od;

iptables -l
ifconfig

[komir]

Kod: Označi sve

target     prot opt source               destination         
ACCEPT     tcp  --  speedtouch.lan       anywhere            tcp flags:!FIN,SYN,RST,ACK/SYN 
ACCEPT     udp  --  speedtouch.lan       anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            limit: avg 10/sec burst 5 
DROP       all  --  anywhere             255.255.255.255     
DROP       all  --  anywhere             192.168.1.255       
DROP       all  --  BASE-ADDRESS.MCAST.NET/8  anywhere            
DROP       all  --  anywhere             BASE-ADDRESS.MCAST.NET/8 
DROP       all  --  255.255.255.255      anywhere            
DROP       all  --  anywhere             0.0.0.0             
DROP       all  --  anywhere             anywhere            state INVALID 
LSI        all  -f  anywhere             anywhere            limit: avg 10/min burst 5 
INBOUND    all  --  anywhere             anywhere            
LOG_FILTER  all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            LOG level info prefix `Unknown Input' 

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     icmp --  anywhere             anywhere            limit: avg 10/sec burst 5 
LOG_FILTER  all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            LOG level info prefix `Unknown Forward' 

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  komir.lan            speedtouch.lan      tcp dpt:domain 
ACCEPT     udp  --  komir.lan            speedtouch.lan      udp dpt:domain 
ACCEPT     all  --  anywhere             anywhere            
DROP       all  --  BASE-ADDRESS.MCAST.NET/8  anywhere            
DROP       all  --  anywhere             BASE-ADDRESS.MCAST.NET/8 
DROP       all  --  255.255.255.255      anywhere            
DROP       all  --  anywhere             0.0.0.0             
DROP       all  --  anywhere             anywhere            state INVALID 
OUTBOUND   all  --  anywhere             anywhere            
LOG_FILTER  all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            LOG level info prefix `Unknown Output' 

Chain INBOUND (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     udp  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  192.168.1.34         anywhere            
LSI        all  --  anywhere             anywhere            

Chain LOG_FILTER (5 references)
target     prot opt source               destination         

Chain LSI (2 references)
target     prot opt source               destination         
LOG_FILTER  all  --  anywhere             anywhere            
LOG        tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 1/sec burst 5 LOG level info prefix `Inbound ' 
DROP       tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN 
LOG        tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5 LOG level info prefix `Inbound ' 
DROP       tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/RST 
LOG        icmp --  anywhere             anywhere            icmp echo-request limit: avg 1/sec burst 5 LOG level info prefix `Inbound ' 
DROP       icmp --  anywhere             anywhere            icmp echo-request 
LOG        all  --  anywhere             anywhere            limit: avg 5/sec burst 5 LOG level info prefix `Inbound ' 
DROP       all  --  anywhere             anywhere            

Chain LSO (0 references)
target     prot opt source               destination         
LOG_FILTER  all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            limit: avg 5/sec burst 5 LOG level info prefix `Outbound ' 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTBOUND (1 references)
target     prot opt source               destination         
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     udp  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  anywhere             anywhere  

Kod: Označi sve

eth0      Link encap:Ethernet  HWaddr 00:17:a4:e5:14:52  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:16 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:390 errors:0 dropped:0 overruns:0 frame:0
          TX packets:390 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:20638 (20.6 KB)  TX bytes:20638 (20.6 KB)

virbr0    Link encap:Ethernet  HWaddr be:4e:db:58:b6:ff  
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:22 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:3702 (3.7 KB)

virbr1    Link encap:Ethernet  HWaddr 3e:8b:5d:b9:d4:21  
          inet addr:192.168.100.1  Bcast:192.168.100.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:19 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:3492 (3.4 KB)

vmnet1    Link encap:Ethernet  HWaddr 00:50:56:c0:00:01  
          inet addr:172.16.241.1  Bcast:172.16.241.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fec0:1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vmnet8    Link encap:Ethernet  HWaddr 00:50:56:c0:00:08  
          inet addr:192.168.76.1  Bcast:192.168.76.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fec0:8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wlan0     Link encap:Ethernet  HWaddr 00:1a:73:5f:3c:d1  
          inet addr:192.168.1.2  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::21a:73ff:fe5f:3cd1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2321 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2153 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1285496 (1.2 MB)  TX bytes:349829 (349.8 KB)

wmaster0  Link encap:UNSPEC  HWaddr 00-1A-73-5F-3C-D1-00-00-00-00-00-00-00-00-00-00  
          UP RUNNING  MTU:0  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

Jel to ?

[glaskoncILLa]

dzizs, ovo treba proucavati dva sata..

[glaskoncILLa]

i toliko od pameti ovih plug and play firewalla;

Chain OUTPUT (policy DROP)
target prot opt source destination

propusti sav tcp dns promet iz komirovog vlana prema routeru, koji ce mu to k, nije dns server..
ACCEPT tcp -- komir.lan speedtouch.lan tcp dpt:domain

propusti sac udp dns promet to sve isto, ok
ACCEPT udp -- komir.lan speedtouch.lan udp dpt:domain

dobitnik nobela, propusti sve svugdje ))))
ACCEPT all -- anywhere anywhere

pa su onda ispod toga nekakvi dropovi koji apsolutno nicemu ne sluze zbog ovog gore rulea..

gle, moj savjet ti je da se ostavis te klikalice iz nekoliko razloga:

- tu ima hrpa nelogicnih i nepotrebnih gluposti
- koliko vidim, nalazis se na privatnoj adresi iza routera, dakle ako nisi radio nikakve port forwardinge nitko ne moze doci direktno do tvog kompa
- ako jesi radio port forwardinge i/ili ako bas zelis firewall, prouci malo kako se slazu iptablesi, imas hrpu manuala po internetu, upisi iptables u google i dobiti ces barem 100 stranica, pa ako ti nesto nije jasno, pitaj ovdje..

[komir]

znaći ništa?