# [iptables] msn and firewall (solved)

## mardi_soir

hello i dont understand why i can-t connect to msn 

this script is lauched one the same computer where amsn .. is 

```
#!/bin/sh -norc

# Paramètrage du réseau local (LAN = Local Area Network)

LAN_INTERFACE=eth1           ; # Interface réseau interne

LAN_IP=192.168.0.1            ; # Adresse réseau interne

LAN_NETWORK=192.168.0.0/24    ; # Réseau interne

LAN_BROADCAST=192.168.0.255   ; # Adresse de broadcast interne

WAN_INTERFACE=eth0            ; # Interface modem

WAN_IP=192.168.1.173 ;

#WAN_IP=`/sbin/ifconfig | grep "P-t-P" | sed "s/^[: a-z]*\([.0-9]*\).*/\1/g"`  ; # Récupère l'adresse réseau externe (Internet)

WAN_NETWORK=0.0.0.0/0  ; 

WAN_BROADCAST=255.255.255.0;

#on charge les modules utiles

modprobe ip_tables

modprobe ip_nat_ftp

modprobe ip_nat_irc

modprobe iptable_filter

modprobe iptable_mangle

modprobe iptable_nat

#on permet la redirection de paquets

echo 1 > /proc/sys/net/ipv4/ip_forward

#  pas de spoofing (bloque les pings)

if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]

then

for filtre in /proc/sys/net/ipv4/conf/*/rp_filter

do

echo 1 > $filtre

done

fi 

# pas de icmp

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 

# Initialise la table Filter (par défaut tout les échanges sont refusés)

echo "+ Initialisation de la table Filter"

iptables -t filter -F

iptables -t filter -X 

iptables -t filter -P INPUT   DROP

iptables -t filter -P FORWARD DROP

iptables -t filter -P OUTPUT  DROP

# Initialise la table NAT (par défaut tout les échanges sont activés)

echo "+ Initialisation de la table NAT"

iptables -t nat -F

iptables -t nat -X 

iptables -t nat -P PREROUTING  ACCEPT

iptables -t nat -P OUTPUT      ACCEPT

iptables -t nat -P POSTROUTING ACCEPT

echo "+ Règles du localhost"

iptables -t filter -A OUTPUT -o lo -p all -j ACCEPT

iptables -t filter -A INPUT  -i lo -p all -j ACCEPT

echo "+ Règles du réseau local ($LAN_INTERFACE - $LAN_IP - $LAN_NETWORK)"

# Connexions firewall <-> réseau

iptables -t filter -A OUTPUT -o $LAN_INTERFACE -s $LAN_IP -d $LAN_NETWORK -p all -j ACCEPT

iptables -t filter -A INPUT  -i $LAN_INTERFACE -s $LAN_NETWORK -d $LAN_IP -p all -j ACCEPT

   

# Connexions firewall <-> broadcast réseau

iptables -t filter -A OUTPUT -o $LAN_INTERFACE -s $LAN_IP -d $LAN_BROADCAST -p all -j ACCEPT

iptables -t filter -A INPUT  -i $LAN_INTERFACE -s $LAN_BROADCAST -d $LAN_IP -p all -j ACCEPT

echo "+ truc pour accepter les résolutions de noms 53"

iptables -A INPUT -i $WAN_INTERFACE --protocol udp --source-port 53 -j ACCEPT

iptables -A OUTPUT -o $WAN_INTERFACE --protocol udp --destination-port 53 -j ACCEPT

iptables -A INPUT -i $WAN_INTERFACE --protocol tcp --source-port 53 -j ACCEPT

iptables -A OUTPUT -o $WAN_INTERFACE --protocol tcp --destination-port 53 -j ACCEPT

echo "+ on accepte le www 80"

iptables -A INPUT -i $WAN_INTERFACE --protocol tcp --source-port 80 -m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o $WAN_INTERFACE --protocol tcp --destination-port 80 -m state --state NEW,ESTABLISHED -j ACCEPT

echo "+ on accepte la connection à irc 6667"

iptables -A INPUT -i $WAN_INTERFACE --protocol tcp --source-port 6667 -m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o $WAN_INTERFACE --protocol tcp --destination-port 6667 -m state --state NEW,ESTABLISHED -j ACCEPT

echo "+ on accepte les ssh 22"

iptables -A INPUT -i $WAN_INTERFACE --protocol tcp --source-port 22 -m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o $WAN_INTERFACE --protocol tcp --destination-port 22 -m state --state NEW,ESTABLISHED -j ACCEPT

echo "+ on accepte le pop de gmail 995"

iptables -A INPUT -i $WAN_INTERFACE --protocol tcp --source-port 995 -m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o $WAN_INTERFACE --protocol tcp --destination-port 995 -m state --state NEW,ESTABLISHED -j ACCEPT

echo "+ on accepte le smtp de gmail 587"

iptables -A INPUT -i $WAN_INTERFACE --protocol tcp --source-port 587 -m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o $WAN_INTERFACE --protocol tcp --destination-port 587 -m state --state NEW,ESTABLISHED -j ACCEPT

#MSN MSN MSN MSN MSN flute zut prout chier poil marche pas

echo "+ on accepte la connection a msn 1863"

iptables -A INPUT -i $WAN_INTERFACE --protocol tcp --source-port 1863 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o $WAN_INTERFACE --protocol tcp --destination-port 1863 -m state --state NEW,ESTABLISHED -j ACCEPT

echo "+ on accepte la connection a jabber 5223"

iptables -A INPUT -i $WAN_INTERFACE --protocol tcp --source-port 5223 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o $WAN_INTERFACE --protocol tcp --destination-port 5223 -m state --state NEW,ESTABLISHED -j ACCEPT

echo "+ on accepte la connection a icq 5190"

iptables -A INPUT -i $WAN_INTERFACE --protocol tcp --source-port 5190 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o $WAN_INTERFACE --protocol tcp --destination-port 5190 -m state --state NEW,ESTABLISHED -j ACCEPT

```

Last edited by mardi_soir on Tue Oct 17, 2006 3:59 pm; edited 1 time in total

----------

## spuhpointer

Some IP table stuff: http://www.gentoo.org/doc/en/home-router-howto.xml

----------

## mardi_soir

thanks but  it does not help me very much .. 

only msn does not work 

i dont understand

----------

## mardi_soir

done !!!!!!!!!!

with this it works > 

```

echo "+ on accepte la connection a msn 1863"

iptables -A INPUT -i $WAN --protocol tcp --source-port 1863 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o $WAN --protocol tcp --destination-port 1863 -m state --state NEW,ESTABLISHED -j ACCEPT 
```

----------

## blue_american

Hi,

I'm having the same problem with msn and smtp, I can't connect to both.

I tried your trick but doesn't worked  :Sad: 

I'm getting desperate with this...

----------

## meekamoo

Hi all!

I am also experiencing the same problem. EVERYTHING works without a problem. All pc's behind NAT can access internet directly without any problems. Except MSN  :Sad: 

I'm running ipkungfu firewall at the moment. I used to run gshield on my suse enterprise server (which worked) but even when I tried gshield on my new gentoo box that was still unsuccessful. I moved to ipkungfu on the chance that it would work.

Failing that I tried the simplest 'firewall' I can think of:

```

# iptables -P INPUT ACCEPT

# iptables -P OUTPUT ACCEPT

# iptables -P FORWARD ACCEPT

# iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

```

yielding:

```

# iptables -L -n

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

```

and

```

# iptables -t nat -L -n

Chain PREROUTING (policy ACCEPT)

target     prot opt source               destination

RETURN     all  --  192.168.0.0/24      !192.168.0.0/24

Chain POSTROUTING (policy ACCEPT)

target     prot opt source               destination

MASQUERADE  all  --  192.168.0.0/24       0.0.0.0/0

MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

```

Even with the most simple firewall possible, MSN still won't connect. 

Anybody have any ideas? It's becoming pretty frustrating   :Mad: 

----------

## blue_american

If you're using a ppp over ethernet connection you will need this line

iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

----------

## meekamoo

 :Sad:  Didn't seem to do the trick.

What is really perplexing me is that the web messenger doesn't even work. 

Hmmmm.........

----------

## blue_american

Can you get messenger to work on the firewall machine?

----------

## meekamoo

Yeah, can log in with tmsnc without a problem at all.

----------

## blue_american

Try the same on the mangle table

iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

----------

## meekamoo

omg... that did it! 

Very weird though - as my previous server would let me connect to msn without that  :Confused: 

thanks man!

----------

## blue_american

No problem.

It is strange though, mine is working on the filter table...

----------

