Interfaces file contains everything but the gateway statement on the private interface.

# /etc/network/interfaces -- configuration file for ifup(8), ifdown(8)

# The loopback interface
auto lo eth0 eth1
iface lo inet loopback

# The first network card - this entry was created during the Debian installationiface eth0 inet dhcp

iface eth1 inet static
address 192.168.55.1
netmask 255.255.255.0

When I add the gateway statement to the private interface, then the routing table shows two default gateway routes and I lose the ability to "surf" the internet, even from the Debian machine.

So I added my own routing statement, here is my routing table.

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.55.0 192.168.55.1 255.255.255.0 UG 0 0 0 eth1
192.168.55.0 * 255.255.255.0 U 0 0 0 eth1
12.237.234.0 * 255.255.254.0 U 0 0 0 eth0
default 12-237-234-1.cl 0.0.0.0 UG 0 0 0 eth0

Now my iptables file:

#!/bin/sh
#
# Notes: This shell script is for iptables v1.2.6+ and 2.4.12+ kernels, as
# there are glaring problems in previous versions. It may work, but
# I would not guarantee it to work completely right.
#
# I am assuming that the public interface is an ISP and the private
# interface is static. Firewall serves as Private DHCP server, and
# uses DNS from the internet. I included services that some like to
# foolishly run... ;) You can comment out mail, ftp and web. I would
# leave ssh for obvious reasons
#
# By default this script DROPS everything, the rules allow exception,
# using stateful checking and allowing exisiting conversation to
# continue, so you can run this script witout interruption of stuff.
# Also by default the script trusts the private interface, allows
# any traffic or conversation started by the private side. IOW, it
# will block anything trying to come in, without you asking for it.

# function check
#
check() {
if test ! -x "$1"; then
echo "$1 not found or is not executable"
exit 1
fi
}

# function log
#
log() {
if test -x "$LOGGER"; then
logger -p info "$1"
fi
}

# exec locations
#
MODPROBE="/sbin/modprobe"
IPTABLES="/sbin/iptables"
IP="/sbin/ip"
LOGGER="/usr/bin/logger"

# making sure they exist
# and are executable
#
check $MODPROBE
check $IPTABLES
check $IP

# PUB_IF assumed ISP_dynamic
#
PUB_IF="eth0"
#PUB_IP="10.0.0.1"
#PUB_SNM="255.0.0.0"
#PUB_NET="10.0.0.0"
#PUB_SNML="8"

# PRIV_IF assumed static
#
PRIV_IF="eth1"
PRIV_IP="192.168.55.1"
PRIV_SNM="255.255.255.0"
PRIV_NET="192.168.55.0"
PRIV_SNML="24"


cd /etc || exit 1

# sending to syslog
#
log "Activating firewall script"

# turning off forwarding (temp)
#
echo "0" > /proc/sys/net/ipv4/ip_forward

# setting good defaults for traffic
#
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout
echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_intvl
echo 0 > /proc/sys/net/ipv4/tcp_ecn
echo 0 > /proc/sys/net/ipv4/tcp_timestamps

# flushing the toilet
#
$IP -4 neigh flush dev $PRIV_IF

# setting default policies of DROP
#
$IPTABLES -P OUTPUT DROP
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP

# getting rid of any exisitng chains and tables
#
cat /proc/net/ip_tables_names | while read table; do
$IPTABLES -t $table -L -n | while read c chain rest; do
if test "X$c" = "XChain" ; then
$IPTABLES -t $table -F $chain
fi
done
$IPTABLES -t $table -X
done
# loading all the iptables modules
#
MODULE_DIR="/lib/modules/`uname -r`/kernel/net/ipv4/netfilter/"
MODULES=`(cd $MODULE_DIR; ls *_conntrack_* *_nat_* | sed 's/\\.o.*$//')`
for module in $(echo $MODULES); do
if [ -e "${MODULE_DIR}/${module}.o" -o -e "${MODULE_DIR}/${module}.o.gz" ]; then
$MODPROBE ${module} || exit 1
fi
done

# Rule NAT
#
$IPTABLES -t nat -A POSTROUTING -o $PUB_IF -s $PRIV_NET/$PRIV_SNML -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o $PRIV_IF -s $PRIV_NET/$PRIV_SNML -j SNAT --to-source $PRIV_IP

# Setting stateful inspection and allow already
# connected conversations to continue
#
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# public interface anti-spoofing rule so baddies claiming
# to be from the prviate network interface, can't make it in.
#
$IPTABLES -A INPUT -i $PUB_IF -s $PRIV_NET/$PRIV_SNML -j DROP
$IPTABLES -A FORWARD -i $PUB_IF -s $PRIV_NET/$PRIV_SNML -j DROP

# block fragments, a sure sign baddies are trying
#
$IPTABLES -A OUTPUT -p ip -f -j DROP
$IPTABLES -A INPUT -p ip -f -j DROP
$IPTABLES -A FORWARD -p ip -f -j DROP

# firewall uses DNS server on internet
#
$IPTABLES -A INPUT -p tcp -s 204.127.202.4 --destination-port 53 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 216.148.227.68 --destination-port 53 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p udp -s 204.127.202.4 --destination-port 53 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p udp -s 216.148.227.68 --destination-port 53 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --destination-port 53 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p udp --destination-port 53 -m state --state NEW -j ACCEPT

# firewall serves as DHCP server for LAN (listen rule)
#
$IPTABLES -A INPUT -p udp -m multiport -s $PRIV_IP --destination-ports 68,67
-m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p udp -m multiport -d $PRIV_IP --destination-ports 68,67 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p udp -m multiport -s $PRIV_NET/$PRIV_SNML --destination-ports 68,67 -m state --state NEW -j ACCEPT

# firewall serves as DHCP server for LAN (response rule)
#
$IPTABLES -A INPUT -p udp -m multiport -s $PRIV_IP --destination-ports 68,67
-m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p udp -m multiport -d $PRIV_IP --destination-ports 68,67 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p udp -m multiport -d $PRIV_NET/$PRIV_SNML --destination-ports 68,67 -m state --state NEW -j ACCEPT

# 'masquerading' rule
#
$IPTABLES -A INPUT -s $PRIV_IP -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -s $PRIV_NET/$PRIV_SNML -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -s $PRIV_NET/$PRIV_SNML -m state --state NEW -j ACCEPT
$IPTABLES -A FORWARD -s $PRIV_NET/$PRIV_SNML -j MASQUERADE
$IPTABLES -A FORWARD -i eth0 -j MASQ

# firewall serves as mail server (for those that do this)
#
$IPTABLES -A OUTPUT -p tcp -m multiport -d $PRIV_IP --destination-ports 143,993,110,25,465 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p tcp -m multiport --destination-ports 143,993,110,25,465
-m state --state NEW -j ACCEPT

# firewall serves as mail relay (for those that do this)
#
$IPTABLES -A INPUT -p tcp -m multiport -s $PRIV_IP --destination-ports 143,993,110,25,465 -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m multiport --destination-ports 143,993,110,25,465 -m state --state NEW -j ACCEPT

# firewall serves as web-server (for those that do this)
#
$IPTABLES -A OUTPUT -p tcp -m multiport -d $PRIV_IP --destination-ports 80,443 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p tcp -m multiport --destination-ports 80,443 -m state --state NEW -j ACCEPT

# firewall serves as ftp-server (for those that do this)
#
$IPTABLES -A OUTPUT -p tcp -m multiport -d $PRIV_IP --destination-ports 20,21 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p tcp -m multiport --destination-ports 20,21 -m state --state NEW -j ACCEPT

# Identd from firewall (for those that do this)
#
$IPTABLES -A OUTPUT -p tcp -d $PRIV_IP --destination-port 113 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p tcp --destination-port 113 -m state --state NEW -j ACCEPT

# ssh access to firewall (yes it's a global thing)
#
$IPTABLES -A OUTPUT -p tcp -d $PRIV_IP --destination-port 22 -m state --state NEW -j ACCEPT
$IPTABLES -A INPUT -p tcp --destination-port 22 -m state --state NEW -j ACCEPT
# 'catch all' rule to make sure
#
$IPTABLES -A OUTPUT -j DROP
$IPTABLES -A INPUT -j DROP
$IPTABLES -A FORWARD -j DROP

# turning forwarding back on
#
echo 1 > /proc/sys/net/ipv4/ip_forward


The goal here is to allow people on the private network to browse the public Internet from the private network, and to do things like ping, ssl, ftp from private to public (and disallow spoofing).

However, I want prevent everyone from getting in from the public internet, except to come in using ssl and http and ssl.

Here is my ipchains configuration which I got off the Internet from my "old" system. Based on the documentation, it appeared to do what I wanted to do.

# Firewall configuration written by lokkit
# Manual customization of this file is not recommended.
# Note: ifup-post will punch the current nameservers through the
# firewall; such entries will *not* be listed here.
:input ACCEPT
:forward ACCEPT
:output ACCEPT
-A forward -s 192.168.55.0/24 -j MASQ
-A forward -i eth0 -j MASQ
-A input -s 0/0 -d 0/0 80 -p tcp -y -j ACCEPT -l
-A input -s 0/0 -d 0/0 22 -p tcp -y -j ACCEPT -l
-A input -s 0/0 -d 0/0 -i lo -j ACCEPT
-A input -s 0/0 -d 0/0 -i eth0 -j ACCEPT
-A input -s 204.127.202.4 53 -d 0/0 -p udp -j ACCEPT
-A input -s 216.148.227.68 53 -d 0/0 -p udp -j ACCEPT
-A input -s 0/0 -d 0/0 -p tcp -y -j REJECT
-A input -s 0/0 -d 0/0 -p udp -j REJECT

So, I think I need to rework Greg's script to look a little more like my ipchains. Since I know very little about this, I would appreciate any help I can get.

Thanks,

Glen Austin

It appears iproute isn't installed on the machine.