Whitelist filtering with port forwards?

[the_townie]

Okay, I did as you mentioned. Here's what I get:

Chain PREROUTING (policy ACCEPT 20573 packets, 2814K bytes)
num   pkts bytes target     prot opt in     out     source               destination       
1      910  104K VSERVER    all  --  *      *       0.0.0.0/0            173.xx.xx.135     

Chain INPUT (policy ACCEPT 11868 packets, 1199K bytes)
num   pkts bytes target     prot opt in     out     source               destination       

Chain OUTPUT (policy ACCEPT 30230 packets, 2354K bytes)
num   pkts bytes target     prot opt in     out     source               destination       

Chain POSTROUTING (policy ACCEPT 8028 packets, 966K bytes)
num   pkts bytes target     prot opt in     out     source               destination       
1     7214 1491K MASQUERADE  all  --  *      eth0   !173.xx.xx.135        0.0.0.0/0        
2    22205 1389K MASQUERADE  all  --  *      br0     192.168.100.0/24     192.168.100.0/24 

Chain DNSFILTER (0 references)
num   pkts bytes target     prot opt in     out     source               destination       

Chain LOCALSRV (0 references)
num   pkts bytes target     prot opt in     out     source               destination       

Chain VSERVER (1 references)
num   pkts bytes target     prot opt in     out     source               destination       
1        0     0 DNAT       udp  --  *      *       8.xx.xx.0/24         0.0.0.0/0            udp dpt:5004 to:192.168.100.175:5004
2        0     0 DNAT       udp  --  *      *       8.xx.xx.0/24         0.0.0.0/0            udp dpt:5060 to:192.168.100.175:5060
3      910  104K VUPNP      all  --  *      *       0.0.0.0/0            0.0.0.0/0         

Chain VUPNP (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Under VSERVER, the destination for the two entries shows as 0.0.0.0/0 with udp dpt:5004 to 192.168.100.175:5004 & 5060

I'm not sure how exactly to read all of this. Is it showing that the device can only communicate with the block of IPs listed?

I appreciate all the help. I'm still learning this stuff!

 

[Martineau]

Okay, I did as you mentioned. Here's what I get:

Chain PREROUTING (policy ACCEPT 20573 packets, 2814K bytes)
num   pkts bytes target     prot opt in     out     source               destination       
1      910  104K VSERVER    all  --  *      *       0.0.0.0/0            173.xx.xx.135     

Chain INPUT (policy ACCEPT 11868 packets, 1199K bytes)
num   pkts bytes target     prot opt in     out     source               destination       

Chain OUTPUT (policy ACCEPT 30230 packets, 2354K bytes)
num   pkts bytes target     prot opt in     out     source               destination       

Chain POSTROUTING (policy ACCEPT 8028 packets, 966K bytes)
num   pkts bytes target     prot opt in     out     source               destination       
1     7214 1491K MASQUERADE  all  --  *      eth0   !173.xx.xx.135        0.0.0.0/0        
2    22205 1389K MASQUERADE  all  --  *      br0     192.168.100.0/24     192.168.100.0/24 

Chain DNSFILTER (0 references)
num   pkts bytes target     prot opt in     out     source               destination       

Chain LOCALSRV (0 references)
num   pkts bytes target     prot opt in     out     source               destination       

Chain VSERVER (1 references)
num   pkts bytes target     prot opt in     out     source               destination       
1        0     0 DNAT       udp  --  *      *       8.xx.xx.0/24         0.0.0.0/0            udp dpt:5004 to:192.168.100.175:5004
2        0     0 DNAT       udp  --  *      *       8.xx.xx.0/24         0.0.0.0/0            udp dpt:5060 to:192.168.100.175:5060
3      910  104K VUPNP      all  --  *      *       0.0.0.0/0            0.0.0.0/0         

Chain VUPNP (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Under VSERVER, the destination for the two entries shows as 0.0.0.0/0 with udp dpt:5004 to 192.168.100.175:5004 & 5060

I'm not sure how exactly to read all of this. Is it showing that the device can only communicate with the block of IPs listed?

I appreciate all the help. I'm still learning this stuff!

You can use the Virtual Server / Port Forwardng tab to see if a comparable port forwarding definition results in an iptables entry with the same syntax (obviously without the source 8.xxx.xxx.0/24 filter because this is not available via the GUI).

Since the source port is the same as the destination port then that is why I believe the :xxxx suffix on the --to address is superflous.

 

[the_townie]

You can use the Virtual Server / Port Forwardng tab to see if a comparable port forwarding definition results in an iptables entry with the same syntax (obviously without the source 8.xxx.xxx.0/24 filter because this is not available via the GUI).

I don't see anything listed there. However, under System Log, the Port Forwarding tab shows:

Destination     Proto. Port range  Redirect to     Local port  Chain
ALL             UDP    5004        192.168.100.175 5004        VSERVER        
ALL             UDP    5060        192.168.100.175 5060        VSERVER

Just curious, why does it say ALL under destination.

Also, in my last post, why does it show 0.0.0.0/0 under destination and then over to the side udp dpt...

Chain VSERVER (1 references)
num   pkts bytes target     prot opt in     out     source               destination       
1        0     0 DNAT       udp  --  *      *       8.xx.xx.0/24         0.0.0.0/0            udp dpt:5004 to:192.168.100.175:5004
2        0     0 DNAT       udp  --  *      *       8.xx.xx.0/24         0.0.0.0/0            udp dpt:5060 to:192.168.100.175:5060
3      910  104K VUPNP      all  --  *      *       0.0.0.0/0            0.0.0.0/0

Scroll right to see.

Thanks!

 

[heliosone]

sorry for warming up this thread,but I stumbled on this,on my search to a way to add/delete a forward rule via ssh.
Why are rules added i.e. :

iptables -t nat -I VSERVER 1 -p tcp -m tcp --dport 18734 -j DNAT --to 192.168.0.123:5900

not shown in the web gui virtual server list ?
I assume as I dont give the rule a name it doesnt appear right ? how can I add rules so they are listed in the gui ?

 

[Martineau]

sorry for warming up this thread,but I stumbled on this,on my search to a way to add/delete a forward rule via ssh.
Why are rules added i.e. :

iptables -t nat -I VSERVER 1 -p tcp -m tcp --dport 18734 -j DNAT --to 192.168.0.123:5900

not shown in the web gui virtual server list ?
I assume as I dont give the rule a name it doesnt appear right ? how can I add rules so they are listed in the gui ?

You didn't update the NVRAM variable ?

nvram get vts_rulelist

if the returned value is blank then

nvram set vts_rulelist="<VNC>18734>192.168.0.123>5900>TCP"
nvram commit

otherwise you will need to append your new Port Forward/Virtual Server configuration to the end of the existing vts_rulelist NVRAM variable.

 

[heliosone]

big thanks for that info !!!
never looked into the nvram variables before,definitely on my toDOlist

here are the shortcuts I now use,maybe they are a help to someone else with the same idea I had :
(this only works,if your only have 1 port forward/device you need to toggle on/off line.)

enable (add rule) :

#!/bin/sh
iptables -t nat -I VSERVER 1 -p tcp -m tcp --dport 12345 -j DNAT --to 192.168.3.124:5900
nvram set vts_rulelist="<Test>12345>192.168.3.124>5900>TCP"
nvram commit

nvram get vts_rulelist
iptables -t nat -L VSERVER -n -v

disable (remove rule) :

#!/bin/sh
iptables -t nat -D VSERVER 1
nvram set vts_rulelist=""
nvram commit
nvram get vts_rulelist
iptables -t nat -L VSERVER -n -v

show rules (added via gui/actual active rules) :

#!/bin/sh
nvram get vts_rulelist
iptables -t nat -L VSERVER -n -v