Problems accessing net with netfilter/ iptables

[subdriver]

Dist: Gentoo 2008.0 on UltraSparc platform, kernel version 2.6.29-r1. Kernel is 64 bit with 32 bit userspace.
I am using this machine as a firewall / router for my home network, using netfilter / iptables configured using Bastille firewall. I cannot connect to the 'net, tracepath returns 'host name lookup failure' but I am able to ping the DNS servers on my ISPs network. I have tested with an earlier kernel build which doesn't have iptables compiled and I can access the 'net. TCPDump indicates that there is traffic both ways to the DNS server, so it seems the filter is blocking packets that I wouldn't expect it to.
I'm fairly new to packet filtering so don't really know where to look first; any pointers please?

[bendeguz]

post your iptables configuration
btw. i don't know bastille:S

[subdriver]

Is this what you need?

[bendeguz]

sorry, forgot -v option

could you please update your previous post with

[elissoncosta]

You need add the rule for established connections.
# iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# iptables-save > rules_file



--
Elisson Costa

[bendeguz]

well, i'm not much of an iptables guru, but i think you have to enable incoming packets in the "forward" chain

[bendeguz]

[elissoncosta]

The Forward chain work as filter for packets that going through the firewall between 2 hosts on different networks.
For connections from or to the firewall you should configure rules on INPUT or OUTPUT chains.



--
Elisson Costa

[bendeguz]

"I am using this machine as a firewall / router for my home network,"

so, he wants to use it as a gateway

[subdriver]

[subdriver]

[subdriver]

[elissoncosta]

Add the following rules on command line(Don't flush the rules) then test it.

# iptables -t nat -A POSTROUTING -j MASQUERADE

--
Elisson Costa

[bendeguz]

[subdriver]

[bendeguz]

Well, i dont't know, but isn't this ruleset overcomplicated?
If i were you i would build a basic ruleset, with the ones that allow you to go out the net(block everything in or through the gateway ( except related and established packages), allow everything out), and when it's working, then you can make it safer with adding more rules() .

(I was using floppyfw (http://www.zelow.no/floppyfw/) for routing for a long time.)

[subdriver]

[bendeguz]

You have a config file, to set up, like this http://www.physics.ucsb.edu/~taro/comp/dimension4100/bastille/bastille-firewall.cfg, and then you have to run a script which makes the rules from the config file?

Because if it is so, then maybe you have something wrong in the config file. Post that one too, if it is not too long.

[subdriver]

[bendeguz]

[subdriver]

Fixed
I discovered that module xt_state hadn't been built. Did a config, rebuilt the kernel and modules, including xt_state, and it works.
On a side note, most IPTables tutorials seem to refer to kernel version 2.4 or early 2.6 (pre 2.6.15) and a lot of the filter options have been renamed since then, it makes trying to ensure you have the correct modules very difficult
One last problem remains, psad isn't starting, it's complaining about unrecognized src/dst : myhomenet.net (myhomenet.net is my network's name); I'm guessing this needs to be set to something else in the psad.conf file.

[subdriver]

Fixed the psad issue, found the home network should be defined as the network IP address, i.e. 192.168.0.0/24 and not the name, that's not clear in the Bastille 'documentation' (the config file). Changed it and psad is working.