Re: [opensuse] Question about iptables and port forward masquerading

11 Jun 2019

      Aw but Jeffrey you may indeed be partially correct! My own additional
research has now found that apparently localhost does not use the
PREROUTING chain in the iptables and this is where SuSEfirewall2 is
putting these FW_FORWARD_MASQ rules.  I think what I have to do is coax
SuSEFirewall2 to put the localhost port routing rules in the OUTPUT
chain instead. So now the question is how do I do that? Back to Google
and searching, hopefully someone here knows and/or will beat me to the
answer and share it with this poor lost soul!?  ;-)

   Marc...

P.S. Jeffrey had replied privately to me so I have removed identifying
information in order to respect that, but wanted to give him kudos and
let him and the group see where he has lead me in my search for a
solution to this problem.

On 6/10/19 6:32 PM, Jeffrey ***** wrote:
...
My statement is incorrect.
Sorry, 
  Jeffrey
On Mon, Jun 10, 2019, 8:15 PM Jeffrey (email deleted since Jeffery
replied to me privately) wrote:
I don't think connections to localhost go thru the firewall.
Jeffrey
On Mon, Jun 10, 2019, 7:49 PM Marc Chamberlin
    <marc@marcchamberlin.com <mailto:marc@marcchamberlin.com>> wrote:
Hi - I dunno if this is a good group to ask this question but
        I will
        give it a shot and  perhaps get pointed to a better group...
I am running the Apache James email server on an OpenSuSE 15.0 x64
        system and because of some other requirements I have to run
        the James
        daemon under a system user name and not under root. To
        accomplish that I
        had to change all the standard email ports that it listens on,
        to higher
        ones (I added 10000 to the standard port numbers so for
        example instead
        of having the smtp server listen on port 25 I configured it to
        listen on
        port 10025. Then using SuSEfirewall2 I configured it to do forward
        masquerading to route connections from port 25 to port 10025.
        So for
        example, and in particular for localhost which is shown here,
        I did the
        following - (sorry about the formatting, Thunderbird seems to
        be making
        choices
        that I don't want and I haven't got the time to figure out how
        to tell
        Thunderbird to knock it off!.)
FW_FORWARD_MASQ=" ... \
        (ext and int interface routing not shown but it is similar to
        what is
        shown below for localhost)
        0/0,127.0.0.1,tcp,25,10025,127.0.0.1 \
        0/0,127.0.0.1,tcp,465,10465,127.0.0.1 \
        0/0,127.0.0.1,tcp,587,10587,127.0.0.1 \
        0/0,127.0.0.1,tcp,110,10110,127.0.0.1 \
        0/0,127.0.0.1,tcp,995,10995,127.0.0.1 \
        0/0,127.0.0.1,tcp,143,10143,127.0.0.1 \
        0/0,127.0.0.1,tcp,993,10993,127.0.0.1"
The server is not protected from the internal network (this is
        a SOHO
        net) and all the external ports are opened. From either the
        internal
        network, or from the external network I can use telnet to
        connect to
        either the low number ports or the high numbered ports
        successfully. But
        from the localhost I can only connect to the high numbered ports.
        Connecting to the low number ports, such as 25,  gets me a
        Connection
        Refused message when I try and do a 'telnet localhost 25'. 
        ('telnet
        localhost 10025' works!) 
Using netstat shows that indeed Apache James (a java
        application) is
        listening on for example port 10025 -
netstat -plnt
        Active Internet connections (only servers)
        Proto Recv-Q Send-Q Local Address           Foreign
        Address        
        State       PID/Program name
tcp        0      0 0.0.0.0:10025
        <http://0.0.0.0:10025>           0.0.0.0:*              
        LISTEN      25012/java         
and from a snip of the iptables I see this -
iptables -t nat -vnL
        Chain PREROUTING (policy ACCEPT 226K packets, 15M bytes)
         pkts bytes target     prot opt in     out    
        source              
        destination        
(lots of other stuff removed, in particular the external
        interface as I
        don't want to show the IP addresses, but here is a bit showing
        some of
        the internal interface)
     0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        192.168.10.100       tcp dpt:25 to:192.168.10.100:10025
        <http://192.168.10.100:10025>
            0     0 DNAT       tcp  --  lo     *       0.0.0.0/0
        <http://0.0.0.0/0>           
        192.168.10.100       tcp dpt:25 to:192.168.10.100:10025
        <http://192.168.10.100:10025>
           22  1320 DNAT       tcp  --  p3p1   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        192.168.10.100       tcp dpt:25 to:192.168.10.100:10025
        <http://192.168.10.100:10025>
            0     0 DNAT       tcp  --  p3p2   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        192.168.10.100       tcp dpt:25 to:192.168.10.100:10025
        <http://192.168.10.100:10025>
            0     0 DNAT       tcp  --  tun0   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        192.168.10.100       tcp dpt:25 to:192.168.10.100:10025
        <http://192.168.10.100:10025>
            0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        192.168.10.100       tcp dpt:465 to:192.168.10.100:10465
        <http://192.168.10.100:10465>
            0     0 DNAT       tcp  --  lo     *       0.0.0.0/0
        <http://0.0.0.0/0>           
        192.168.10.100       tcp dpt:465 to:192.168.10.100:10465
        <http://192.168.10.100:10465>
            9   468 DNAT       tcp  --  p3p1   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        192.168.10.100       tcp dpt:465 to:192.168.10.100:10465
        <http://192.168.10.100:10465>
            0     0 DNAT       tcp  --  p3p2   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        192.168.10.100       tcp dpt:465 to:192.168.10.100:10465
        <http://192.168.10.100:10465>
(and here is some of the things showing the localhost interface)
  0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:25 to:127.0.0.1:10025
        <http://127.0.0.1:10025>
            0     0 DNAT       tcp  --  lo     *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:25 to:127.0.0.1:10025
        <http://127.0.0.1:10025>
            0     0 DNAT       tcp  --  p3p1   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:25 to:127.0.0.1:10025
        <http://127.0.0.1:10025>
            0     0 DNAT       tcp  --  p3p2   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:25 to:127.0.0.1:10025
        <http://127.0.0.1:10025>
            0     0 DNAT       tcp  --  tun0   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:25 to:127.0.0.1:10025
        <http://127.0.0.1:10025>
            0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:465 to:127.0.0.1:10465
        <http://127.0.0.1:10465>
            0     0 DNAT       tcp  --  lo     *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:465 to:127.0.0.1:10465
        <http://127.0.0.1:10465>
            0     0 DNAT       tcp  --  p3p1   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:465 to:127.0.0.1:10465
        <http://127.0.0.1:10465>
            0     0 DNAT       tcp  --  p3p2   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:465 to:127.0.0.1:10465
        <http://127.0.0.1:10465>
            0     0 DNAT       tcp  --  tun0   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:465 to:127.0.0.1:10465
        <http://127.0.0.1:10465>
            0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:587 to:127.0.0.1:10587
        <http://127.0.0.1:10587>
            0     0 DNAT       tcp  --  lo     *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:587 to:127.0.0.1:10587
        <http://127.0.0.1:10587>
            0     0 DNAT       tcp  --  p3p1   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:587 to:127.0.0.1:10587
        <http://127.0.0.1:10587>
            0     0 DNAT       tcp  --  p3p2   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:587 to:127.0.0.1:10587
        <http://127.0.0.1:10587>
            0     0 DNAT       tcp  --  tun0   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:587 to:127.0.0.1:10587
        <http://127.0.0.1:10587>
            0     0 DNAT       tcp  --  eth0   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:110 to:127.0.0.1:10110
        <http://127.0.0.1:10110>
            0     0 DNAT       tcp  --  lo     *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:110 to:127.0.0.1:10110
        <http://127.0.0.1:10110>
            0     0 DNAT       tcp  --  p3p1   *       0.0.0.0/0
        <http://0.0.0.0/0>           
        127.0.0.1            tcp dpt:110 to:127.0.0.1:10110
        <http://127.0.0.1:10110>
        yada yada yada...
So what am I missing? It is important that I get localhost to
        accept
        connections on the low ports since I am using other tools, such as
        sendmail (in non-daemon mode) and I want it to use Apache
        James as it's
        MTA. Yet I cannot get connections to the low ports on
        localhost to work,
        but I am doing exactly the same sort of setup for the internal and
        external interfaces and there everything does work!
Thanks in advance for any thoughts and ideas. I will be happy
        to provide
        more information, just ask!     Marc..
--
  --...  ...-- .----. ...    -..  .    .--  .-  --...  .--. 
        -..-  .--     --  .-  .-.  -.-.
        <b>Computers: the final frontier. These are the voyages of the
        user Marc.<br> His mission: to explore strange new hardware.
        To seek out new software and new applications.<br> To boldly
        go where no Marc has gone before!<br></b>
-- 
        To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org
        <mailto:opensuse%2Bunsubscribe@opensuse.org>
        To contact the owner, e-mail: opensuse+owner@opensuse.org
        <mailto:opensuse%2Bowner@opensuse.org>
-- 
  --...  ...-- .----. ...    -..  .    .--  .-  --...  .--.  -..-  .--     --  .-  .-.  -.-.
<b>Computers: the final frontier. These are the voyages of the user Marc.<br> 
His mission: to explore strange new hardware. To seek out new software and new applications.<br> 
To boldly go where no Marc has gone before!<br></b>

-- 
To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org
To contact the owner, e-mail: opensuse+owner@opensuse.org

Marc Chamberlin

tags

participants (1)