Forward ports - why is it not doing what I ask it??

[jago25_98]

What on earth is going on here? It's driving me mad now.

Any settings changed in the web interface does not effect `iptables -L` including port forwarding DMZ and firewall.

Trying forwarding ports on the command line doesn't do it either when I actually test the port. How do you test the port without a remote machine anyway? At the moment I'm just trying to connect to the router on the port I'm trying to forward.


j@ethel:~$ nmap my.router

Starting Nmap 4.53 ( http://insecure.org ) at 2008-09-05 18:20 BST
Interesting ports on my.router (192.168.1.50):
Not shown: 1708 closed ports
PORT STATE SERVICE
23/tcp open telnet
53/tcp open domain
80/tcp open http
515/tcp open printer
9100/tcp open jetdirect
9101/tcp open jetdirect

Nmap done: 1 IP address (1 host up) scanned in 2.088 seconds


j@ethel:~$ nmap PUBLIC-INTERNET-IP

Starting Nmap 4.53 ( http://insecure.org ) at 2008-09-05 18:21 BST
Interesting ports on xxxx:
Not shown: 1709 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
1720/tcp filtered H.323/Q.931
8080/tcp open http-proxy

Nmap done: 1 IP address (1 host up) scanned in 11.056 seconds
j@ethel:~$


[admin@(none) root]$ iptables -A INPUT -p tcp --dport ssh -j ACCEPT
[admin@(none) root]$ iptables -A INPUT -p tcp --dport 8081 -j ACCEPT
[admin@(none) root]$ iptables -A FORWARD -i eth1 -p tcp --dport 8081:8081 --destination 192.168.1.3 -j ACCEPT
[admin@(none) root]$ iptables -A FORWARD -i eth1 -p tcp --dport 8081:8081 --destination 192.168.1.3 -j ACCEPT
[admin@(none) root]$ iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state NEW
ACCEPT all -- anywhere anywhere state NEW
SECURITY all -- anywhere anywhere state NEW
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:tproxy
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:tproxy
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:tproxy

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP all -- anywhere anywhere
SECURITY all -- anywhere anywhere state NEW
ACCEPT all -- anywhere anywhere ctstate DNAT
ACCEPT tcp -- anywhere 192.168.1.3 tcp dpt:tproxy
ACCEPT tcp -- anywhere 192.168.1.3 tcp dpt:tproxy
ACCEPT tcp -- anywhere 192.168.1.3 tcp dpt:tproxy

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain MACS (0 references)
target prot opt source destination

Chain SECURITY (2 references)
target prot opt source destination
RETURN tcp -- anywhere anywhere tcp flags:SYN,RST,ACK/SYN limit: avg 1/sec burst 5
RETURN tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5
RETURN udp -- anywhere anywhere limit: avg 5/sec burst 5
RETURN icmp -- anywhere anywhere limit: avg 5/sec burst 5
DROP all -- anywhere anywhere

Chain logaccept (0 references)
target prot opt source destination
LOG all -- anywhere anywhere state NEW LOG level warning tcp-sequence tcp-options ip-options prefix `ACCEPT '
ACCEPT all -- anywhere anywhere

Chain logdrop (0 references)
target prot opt source destination
LOG all -- anywhere anywhere state NEW LOG level warning tcp-sequence tcp-options ip-options prefix `DROP '
DROP all -- anywhere anywhere
[admin@(none) root]$

[ericguo]

Have you switch on Enable (Firewall, DMZ) on Web form?

If you already switch it on, custome iptables at post-firewall


[Eric@WL500g root]$ cat /usr/local/sbin/post-firewall
#!/bin/sh
iptables -P INPUT DROP
iptables -D INPUT -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 23 -j ACCEPT
iptables -A INPUT -p udp --dport 23 -j ACCEPT

[Eric@WL500g root]$


don't forget save and commit by cmd flashfs

I test my router as remote by linking to my neighbor wireless network (we are all open system :D)

[jago25_98]

[admin@(none) root]$ cat /usr/local/sbin/post-firewall
cat: /usr/local/sbin/post-firewall: No such file or directory
[admin@(none) root]$ uname -a
Linux (none) 2.4.20 #61 Mon Oct 9 21:51:36 MSD 2006 mips unknown
[admin@(none) root]$

Release: 1.9.2.7-7f

[darkside40]

Seems that you dont have a post-firewall script.
Refer to that post that explains how to setup the script etc. http://wl500g.info/showthread.php?t=10307

But i have another question, it seems that my iptable drop the settings i made with the script from time to time, is that normal?

[jago25_98]

Thanks for the help.

I don't really want to have to use the USB port and a thumb drive. I used to be able to forward ports without all that.

I also can't ping to the ADSL modem on 192.168.1.10 from behind the router (192.168.1.50) on a client like 192.168.101. But I can ping the modem from the router via telnet.

Surely issuing iptables commands on the command line should work?

When I get back from holiday I will instal a hub and buy a thumb drive on the USB so the printer can stay installed and go the whole hog of installing everything. But I'm not sure it will help.

In the screenshot attached, where are these settings saved?

[jago25_98]

It would be nice if I could open everything up and redirect everything to everwhere but alas I can't get it to work even doing this.

I think the problem could be the separate modem to the router. It has a separate IP 192.168.1.10, unlike the router, which is 192.168.1.50.

Could like be why I can't forward ports? - because I need to bridge the mdoem to the router?

If so how to I get to the modem? Do I have to really have to unplug it?

edit::

Think I have the solution.

I use a separate PPPOA modem. I think I need to bridge this to the router, and enter my PPPOA username and password on the WL500G router. There doesn't appear to be an option in the web interface for PPPOA however and selection of 0:38 UK encapsulation.... hmm...

[jago25_98]

going to try
iptables -t nat -A PREROUTING -i <public interface> -p tcp --sport <port> --dport <port> -j DNAT --to-destination <local ip> next

[jago25_98]

Now linux clients can connect over wifi but a windows box can't (it's ok on wired). I can't see anything in My Computer >manage>event viewer mentioned.

It just says `waiting for network`. Another windows laptop is the same...

iptables prerouting didn't work and I don't know what the modem IP is -it's *** starred out with traceroute.

I may have to throw away this wl500g and modem and buy something new.