Ping through Firewall

Issues related to configuring your network
Post Reply
billb3
Posts: 3
Joined: 2008/04/02 20:36:25

Ping through Firewall

Post by billb3 » 2008/12/03 19:53:08

Hello All,

I'm hoping you can help with what is probably a simple issue, but I'm getting confused by readying more examples. I have a CentOS4 box that I am using as a firewall/gateway. It has 2 NICs, eth0 is the external NIC and eth1 is internal. Most of my boxes don't need internet access, so I don't allow it. Only a few do and have a script that enables NAT for those boxes. Those two boxes can get to the internet fine, but can not ping any computers outside of our local network. I included two files below, my /etc/sysconfig/iptables file and a small script that I run in rc.local to enable internet for those two computers.

/etc/sysconfig/iptables
------------------
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth1 -j ACCEPT
-A RH-Firewall-1-INPUT -i tun0 -j ACCEPT
-A RH-Firewall-1-INPUT -i tun1 -j ACCEPT
-A RH-Firewall-1-INPUT -i tun2 -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#smtp
-A RH-Firewall-1-INPUT -i eth0 -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
#https
-A RH-Firewall-1-INPUT -i eth0 -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
------------------

/etc/rc.d/rc.local
------------------
iptables -t nat -A POSTROUTING -o eth0 -p tcp -s 10.176.0.200 -j SNAT --to 64.246.135.41
iptables -t nat -A POSTROUTING -o eth0 -p tcp -s 10.176.0.201 -j SNAT --to 64.246.135.41
------------------

Post Reply

Return to “CentOS 4 - Networking Support”