Well, I figured out what's causing this, but I still have no clue as to why. Something hit me like a ton of bricks just after my last post. I did a fresh reboot and started X fine. I then applied the new firewall rules and wouldn't you know it- X no longer starts! I'm hoping somebody else here is really good with the iptables firewall rules and can shed some light on what I'm doing wrong.
eth0 is the built-in NIC on the motherboard. It's connected to our network at large and to the internet. The IPs on our network are 207.185.212.xxx, which is why I'm limiting the new traffic to those.
eth1 is a giga-fast PCI NIC that is connected to a hub. I have other computers hooked into this hub to share the internet connection. The IPs I've given these computers are 192.168.100.yyy, which is why I'm limiting the traffic to those.
eth2 is now removed due to a hardware failure. However, it will be replaced with another PCI NIC in the very near future. I'm planning on hooking up a wireless AP to it. The IPs I've decided on for the wireless network are 192.168.200.zzz. I don't want to risk anybody else tapping into our network, so I've limited the traffic to a single IP. As the wireless network grows, I'll add more IPs to the rules.
Here is the original firewall rules that don't prevent X from loading.
Code:
iptables -F; iptables -t nat -F; iptables -t mangle -F
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 207.185.212.104
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT
iptables -A INPUT -s 207.185.212.1/24 -m state --state NEW -i eth0 -j ACCEPT
iptables -A INPUT -s 207.185.212.1/24 -i eth0 -j ACCEPT
iptables -P INPUT DROP
iptables -A FORWARD -i eth0 -o eth0 -j REJECT
Here are the new rules that do prevent X from loading. As you can see, I've added comments and prettied it up a bit.
Code:
# Flush Tables and Clear System Policies to Start Fresh
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
# Set Default Route
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 207.185.212.104
# Enable IP Packet Forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Allow Traffic Due to Established and Related Connections Through
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Set Rules for New Connection Requests
iptables -A INPUT -m state --state NEW -s 207.185.212.1/24 -i eth0 -j ACCEPT
iptables -A INPUT -m state --state NEW -s 192.168.100.1/24 -i eth1 -j ACCEPT
iptables -A INPUT -m state --state NEW -s 192.168.200.2/32 -i eth2 -j ACCEPT
# Set Default Input Rules for All Traffic from Local IPs
iptables -A INPUT -s 207.185.212.1/24 -i eth0 -j ACCEPT
iptables -A INPUT -s 192.168.100.1/24 -i eth1 -j ACCEPT
iptables -A INPUT -s 192.168.200.2/32 -i eth2 -j ACCEPT
# Set Default Forwarding Rules for All Traffic from Local IPs
iptables -A FORWARD -s 207.185.212.1/24 -i eth0 -j ACCEPT
iptables -A FORWARD -s 192.168.100.1/24 -i eth1 -j ACCEPT
iptables -A FORWARD -s 192.168.200.2/32 -i eth2 -j ACCEPT
# Drop All Other Packets as System Policy
iptables -P INPUT DROP
#iptables -P OUTPUT DROP //Causes ping to fail
#iptables -P FORWARD DROP //Causes *ALL* forwarding to cease- why?
# Reject All Other Forwarding Requests
iptables -A FORWARD -i eth0 -o eth0 -j REJECT
iptables -A FORWARD -i eth1 -s ! 192.168.200.1/24 -j REJECT
iptables -A FORWARD -i eth2 -s ! 192.168.200.2/32 -j REJECT
Anybody see anywhere I've screwed up or something that would be causing the above behavior? It all seems straight-forward to me, but I'm still a newbie when it comes to this kind of stuff.
)
)
-
Linear Mode
