iptable questions

[Mikii]

Hi. I am rather new to iptables.

I have set up the following rules for one of the open vpn interfaces, but I randomly end up with a "Connected (Local: nn.nn.nn.nn - Public: unknown)" interface message on that vpn, and I understand this is mostly due to some iptables conflicts.

iptables -I FORWARD -i br0 -o tun14 -j ACCEPT
iptables -I FORWARD -i tun14 -o br0 -j ACCEPT
iptables -I FORWARD -i br0 -o vlan1 -j DROP
iptables -I INPUT -i tun14 -j REJECT
iptables -t nat -A POSTROUTING -o tun14 -j MASQUERADE

iptables -I FORWARD -i tun14 -p udp -d 192.168.1.100 --dport 16881 -j ACCEPT
iptables -I FORWARD -i tun14 -p tcp -d 192.168.1.100 --dport 16881 -j ACCEPT
iptables -t nat -I PREROUTING -i tun14 -p tcp --dport 16881 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p udp --dport 16881 -j DNAT --to-destination 192.168.1.100

iptables -I FORWARD -i tun14 -p udp -d 192.168.1.100 --dport 5672 -j ACCEPT
iptables -I FORWARD -i tun14 -p tcp -d 192.168.1.100 --dport 5672 -j ACCEPT
iptables -t nat -I PREROUTING -i tun14 -p tcp --dport 5672 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p udp --dport 5672 -j DNAT --to-destination 192.168.1.100

iptables -I FORWARD -i tun14 -p udp -d 192.168.1.100 --dport 5662 -j ACCEPT
iptables -I FORWARD -i tun14 -p tcp -d 192.168.1.100 --dport 5662 -j ACCEPT
iptables -t nat -I PREROUTING -i tun14 -p tcp --dport 5662 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p udp --dport 5662 -j DNAT --to-destination 192.168.1.100

iptables -I FORWARD -i tun14 -p udp -d 192.168.1.100 --dport 5665 -j ACCEPT
iptables -I FORWARD -i tun14 -p tcp -d 192.168.1.100 --dport 5665 -j ACCEPT
iptables -t nat -I PREROUTING -i tun14 -p tcp --dport 5665 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p udp --dport 5665 -j DNAT --to-destination 192.168.1.100

iptables -I FORWARD -i tun14 -p udp -d 192.168.1.100 --dport 6881 -j ACCEPT
iptables -I FORWARD -i tun14 -p tcp -d 192.168.1.100 --dport 6881 -j ACCEPT
iptables -t nat -I PREROUTING -i tun14 -p tcp --dport 6881 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p udp --dport 6881 -j DNAT --to-destination 192.168.1.100

So here'a few questions:

1. I currently set these rules on the "nat-start" file. Is this wrong (I read on the internet about using an "iptables-save and iptables-restore" method)?
2. I am also using "x3mRouting" at the same time, is this ok?
3. Can I use the above rules in conjunction with Merlin's "WAN - Virtual Server / Port Forwarding" or not?
- 3.1 With different ports on the same device (192.168.1.100)?
- 3.2 With different ports on other 192.168.1.nn devices?

I am pretty sure I am messing something up and I'd appreciate some suggestions!

 

[Tech Junky]

You've got quite a bit going on here. Well, not really it's just a bit too many lines for something simple.

First thing I would do to KISS it is use the range option for the ports to collapse several lines into a single line.
Using the ESTABLISHED command also helps in slimming things down.
One thing that sticks out is the REJECT on inbound traffic for Tun14 - this will drop all of your tunnel traffic / no connection

iptables -I INPUT -i tun14 -j REJECT

iptables -I FORWARD -i br0 -o tun14 -j ACCEPT
iptables -I FORWARD -i tun14 -o br0 -j ACCEPT
iptables -I FORWARD -i br0 -o vlan1 -j DROP
iptables -I FORWARD -i tun14 -p udp -d 192.168.1.100 --dport 16881 -j ACCEPT
iptables -I FORWARD -i tun14 -p tcp -d 192.168.1.100 --dport 16881 -j ACCEPT
iptables -I FORWARD -i tun14 -p udp -d 192.168.1.100 --dport 5672 -j ACCEPT
iptables -I FORWARD -i tun14 -p tcp -d 192.168.1.100 --dport 5672 -j ACCEPT
iptables -I FORWARD -i tun14 -p udp -d 192.168.1.100 --dport 5662 -j ACCEPT
iptables -I FORWARD -i tun14 -p tcp -d 192.168.1.100 --dport 5662 -j ACCEPT
iptables -I FORWARD -i tun14 -p udp -d 192.168.1.100 --dport 5665 -j ACCEPT
iptables -I FORWARD -i tun14 -p tcp -d 192.168.1.100 --dport 5665 -j ACCEPT
iptables -I FORWARD -i tun14 -p udp -d 192.168.1.100 --dport 6881 -j ACCEPT
iptables -I FORWARD -i tun14 -p tcp -d 192.168.1.100 --dport 6881 -j ACCEPT

Another thing that sticks out is do you need both TCP/UDP for these ports or is it primarily TCP or UDP?

This is what I do for FWD on my setup and it's a lot simpler.

-A PERMIT-FWD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PERMIT-FWD -m conntrack --ctstate NEW -j ACCEPT

Using a similar setup for the NAT since everything seems to be bound for the same IP maybe just push the HOST / Tun14 binding instead of specifying ports. This would condense the rules needed for both NAT / FWD. Another thing that sticks out is the -A for the Tun14 which puts it at the bottom of the rules vs -I which puts it at the top.

iptables -t nat -A POSTROUTING -o tun14 -j MASQUERADE
iptables -t nat -I PREROUTING -i tun14 -p tcp --dport 16881 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p udp --dport 16881 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p tcp --dport 5672 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p udp --dport 5672 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p tcp --dport 5662 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p udp --dport 5662 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p tcp --dport 5665 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p udp --dport 5665 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p tcp --dport 6881 -j DNAT --to-destination 192.168.1.100
iptables -t nat -I PREROUTING -i tun14 -p udp --dport 6881 -j DNAT --to-destination 192.168.1.100

Another option for the ports is making a container and put all of the ports into it and then just reference it instead.

 

[Mikii]

Thank you Tech Junky, I'll try to figure out how to follow your suggestions.