Iptables state tracking
- by complexgeek
Hi there.
I've just taken over administration of a fairly complex firewall ruleset for a firewall box running Fedora Core 12, and there's one thing about it that is puzzling me.
When I run nmap on the gateway from outside the network, I see all the expected services, but also sunrpc on port 111. The INPUT chain has DEFAULT DROP set, and there is no rule allowing port 111. As best I can tell (watching the packet counters before/during/after the scan) it's being allowed by the rule:
"-m state --state RELATED,ESTABLISHED -j ACCEPT"
but I don't understand why a brand new TCP connection would be considered RELATED or ESTABLISHED.
Any suggestions would be greatly appreciated.
EDIT:
Conntrack modules:
nf_conntrack_netlink 14925 0
nfnetlink 3479 1 nf_conntrack_netlink
nf_conntrack_irc 5206 1 nf_nat_irc
nf_conntrack_proto_udplite 3138 0
nf_conntrack_h323 62110 1 nf_nat_h323
nf_conntrack_proto_dccp 6878 0
nf_conntrack_sip 16921 1 nf_nat_sip
nf_conntrack_proto_sctp 11131 0
nf_conntrack_pptp 10673 1 nf_nat_pptp
nf_conntrack_sane 5458 0
nf_conntrack_proto_gre 6574 1 nf_conntrack_pptp
nf_conntrack_amanda 2796 1 nf_nat_amanda
nf_conntrack_ftp 11741 1 nf_nat_ftp
nf_conntrack_tftp 4665 1 nf_nat_tftp
nf_conntrack_netbios_ns 1534 0
nf_conntrack_ipv6 18504 2
ipv6 279399 40 ip6t_REJECT,nf_conntrack_ipv6
INPUT chain on the filter table:
-A INPUT -s 192.168.200.10/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 127.0.0.0/8 -i lo -j ACCEPT
-A INPUT -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT
-A INPUT -d 192.168.200.5/32 -i eth0 -j ACCEPT
-A INPUT -d 192.168.1.2/32 -i eth0 -j ACCEPT
-A INPUT -d {public_ip}/32 -i ppp0 -p tcp -m multiport --dports 22,80,443 -j ACCEPT
-A INPUT -d {public_ip}/32 -i ppp0 -p tcp -m multiport --sports 22,25,80,443 -j ACCEPT
-A INPUT -d {public_ip}/32 -i ppp0 -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -d {public_ip}/32 -i ppp0 -p udp -m udp --sport 1194 -j ACCEPT
-A INPUT -d {public_ip}/32 -i ppp0 -p udp -m multiport --sports 53,123 -j ACCEPT
-A INPUT -d {public_ip}/32 -i ppp0 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -i eth0 -m state --state NEW -j ACCEPT
-A INPUT -d {public_ip}/32 -m state --state NEW -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
eth0 is connected to the internal network, eth3 is connected to an ADSL modem in bridge mode, ppp0 is the WAN connection tunneled over eth3.
