mercredi 25 février 2015

PPTP Through IPTables


If this has already been answered, I apologize, I could not find an answer to this during my searching.


I am new at Linux/Unix and I have recently implemented a Raspberry Pi firewall/gateway on my network running iptables.


Ever since the implementation, I am unable to connect to a Windows-based PPTP server at my job. All of the posts I have found regarding iptables and PPTP involve forwarding the ports from outside to an internal address. It seems to be blocking OUTBOUND PPTP connections from my LAN to the work network.


From my limited knowledge, I thought that I had an "allow everything that's going out" rule, but I guess not. Entire iptables script listed below. Any guidance would be greatly appreciated. Thank you in advance!



PATH=/usr/sbin:/sbin:/bin:/usr/bin

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

iptables -A FORWARD -i eth1 -o eth1 -j REJECT

echo 1 > /proc/sys/net/ipv4/ip_forward


Here is my results from iptables -L -vn; iptables -t nat -L -vn:


Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination

0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0

21 1572 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT all -- eth1 * 0.0.0.0/0 0.0.0.0/0 state NEW 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22


Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination

9 656 ACCEPT all -- eth1 eth0 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT tcp -- eth1 eth0 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723 state NEW,ESTABLISHED 0 0 ACCEPT tcp -- eth0 eth1 0.0.0.0/0 0.0.0.0/0 tcp spt:1723 state RELATED,ESTABLISHED 0 0 ACCEPT 47 -- eth1 eth1 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED 0 0 ACCEPT 47 -- eth0 eth1 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 9 498 ACCEPT all -- eth0 eth1 0.0.0.0/0 0.0.0.0/0

0 0 REJECT all -- eth1 eth1 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable


Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination

11 1212 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED Chain PREROUTING (policy ACCEPT 1 packets, 64 bytes) pkts bytes target prot opt in out source destination

0 0 DNAT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723 to:192.168.1.51 0 0 DNAT 47 -- eth1 * 0.0.0.0/0 0.0.0.0/0 to:192.168.1.51


Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination


Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination


Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination

1 64 MASQUERADE all -- * eth1 0.0.0.0/0 0.0.0.0/0



Aucun commentaire:

Enregistrer un commentaire