Sponsored Content
Special Forums IP Networking Proxy Server iptables as "proxy" and a filter Post 302927078 by Smiling Dragon on Sunday 30th of November 2014 07:02:17 PM
Old 11-30-2014
One thing I note in your friend's script is that it sets the firewall to drop all incoming connections before allowing port 22 (ssh) connections. If something goes wrong along the way on this, you'll need console access to get back in :/ I'd recommend setting the -P INPUT DROP last tbh Smilie

As you've noted, this is just INPUT filters, your one is just NAT/IPMASQ. So it's like comparing apples and oranges really.

Looking just at your rules, I don't see anything untoward there, it appears that you are causing the proxy to accept traffic arriving on port 80 and redirecting it to 5.196.130.245.

An external customer connecting to the address would not be able to detect the redirect and would see all their connections as going to and coming back from the address of your proxy.
The webserver would see all the connections as coming from the proxy server address, unless the customer is setting "X-Forwarded-For" headers in their requests (not all that uncommon to find) which would be passed along to the webserver and quite possibly included in it's logs.

If you have a little more background of what your end goal is, we might be able to offer more advice Smilie

I would recommend also adding a FORWARD rule to DROP anything not for that port arriving from the external interface, as you've turned on IP forwarding and at present your setup would happily forward anything anyone asks it to. It's note really serious but could exacerbate any existing security issue into a full exploit.
 

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Explain the line "mn_code=`env|grep "..mn"|awk -F"=" '{print $2}'`"

Hi Friends, Can any of you explain me about the below line of code? mn_code=`env|grep "..mn"|awk -F"=" '{print $2}'` Im not able to understand, what exactly it is doing :confused: Any help would be useful for me. Lokesha (4 Replies)
Discussion started by: Lokesha
4 Replies

2. Shell Programming and Scripting

cat $como_file | awk /^~/'{print $1","$2","$3","$4}' | sed -e 's/~//g'

hi All, cat file_name | awk /^~/'{print $1","$2","$3","$4}' | sed -e 's/~//g' Can this be done by using sed or awk alone (4 Replies)
Discussion started by: harshakusam
4 Replies

3. Shell Programming and Scripting

awk command to replace ";" with "|" and ""|" at diferent places in line of file

Hi, I have line in input file as below: 3G_CENTRAL;INDONESIA_(M)_TELKOMSEL;SPECIAL_WORLD_GRP_7_FA_2_TELKOMSEL My expected output for line in the file must be : "1-Radon1-cMOC_deg"|"LDIndex"|"3G_CENTRAL|INDONESIA_(M)_TELKOMSEL"|LAST|"SPECIAL_WORLD_GRP_7_FA_2_TELKOMSEL" Can someone... (7 Replies)
Discussion started by: shis100
7 Replies

4. Solaris

The slices "usr", "opt", "tmp" disappeared!!! Help please.

The system don't boot. on the screen appears following: press enter to maintenance (or type CTRL-D to continue)...I checked with format command. ... the slices "0-root","1-swap","2-backup" exist. ...the slises "3-var","6-usr" -unassigned. :( (16 Replies)
Discussion started by: wolfgang
16 Replies

5. Shell Programming and Scripting

Filter file by length, looking only at lines that don't begin with ">"

I have a file that stores data in pairs of lines, following this format: line 1: header (preceded by ">") line 2: sequence Example.txt: >seq1 name GATTGATGTTTGAGTTTTGGTTTTT >seq2 name TTTTCTTC I want to filter out the sequences and corresponding headers for all sequences that are less... (2 Replies)
Discussion started by: pathunkathunk
2 Replies

6. UNIX for Dummies Questions & Answers

Using "mailx" command to read "to" and "cc" email addreses from input file

How to use "mailx" command to do e-mail reading the input file containing email address, where column 1 has name and column 2 containing “To” e-mail address and column 3 contains “cc” e-mail address to include with same email. Sample input file, email.txt Below is an sample code where... (2 Replies)
Discussion started by: asjaiswal
2 Replies

7. UNIX for Dummies Questions & Answers

Grep : Filter/Move All The Lines Containing Not More Than One "X" Character Into A Text File

Hi All It's me again with another huge txt files. :confused: What I have: - I have 33 huge txt files in a folder. - I have thousands of line in this txt file which contain many the letter "x" in them. - Some of them have more than one "x" character in the line. What I want to achieve:... (8 Replies)
Discussion started by: Nexeu
8 Replies

8. Shell Programming and Scripting

Bash script - Print an ascii file using specific font "Latin Modern Mono 12" "regular" "9"

Hello. System : opensuse leap 42.3 I have a bash script that build a text file. I would like the last command doing : print_cmd -o page-left=43 -o page-right=22 -o page-top=28 -o page-bottom=43 -o font=LatinModernMono12:regular:9 some_file.txt where : print_cmd ::= some printing... (1 Reply)
Discussion started by: jcdole
1 Replies

9. AIX

Apache 2.4 directory cannot display "Last modified" "Size" "Description"

Hi 2 all, i have had AIX 7.2 :/# /usr/IBMAHS/bin/apachectl -v Server version: Apache/2.4.12 (Unix) Server built: May 25 2015 04:58:27 :/#:/# /usr/IBMAHS/bin/apachectl -M Loaded Modules: core_module (static) so_module (static) http_module (static) mpm_worker_module (static) ... (3 Replies)
Discussion started by: penchev
3 Replies
FTP-PROXY(8)						    BSD System Manager's Manual 					      FTP-PROXY(8)

NAME
ftp-proxy -- Internet File Transfer Protocol proxy server SYNOPSIS
ftp-proxy -i [-AnrVw] [-a address] [-D debuglevel] [-g group] [-M maxport] [-m minport] [-R address[:port]] [-S address] [-t timeout] [-u user] ftp-proxy -p [-AnrVw] [-a address] [-D debuglevel] [-g group] [-M maxport] [-m minport] [-R address[:port]] [-S address] [-t timeout] [-u user] DESCRIPTION
ftp-proxy is a proxy for the Internet File Transfer Protocol. The proxy uses pf(4) and expects to have the FTP control connection as described in services(5) redirected to it via a pf(4) rdr command. An example of how to do that is further down in this document. The options are as follows: -A Permit only anonymous FTP connections. The proxy will allow connections to log in to other sites as the user "ftp" or "anonymous" only. Any attempt to log in as another user will be blocked by the proxy. -a address Specify the local IP address to use in bind(2) as the source for connections made by ftp-proxy when connecting to destination FTP servers. This may be necessary if the interface address of your default route is not reachable from the destinations ftp-proxy is attempting connections to, or this address is different from the one connections are being NATed to. In the usual case this means that address should be a publicly visible IP address assigned to one of the interfaces on the machine running ftp-proxy and should be the same address to which you are translating traffic if you are using the -n option. -D debuglevel Specify a debug level, where the proxy emits verbose debug output into syslogd(8) at level LOG_DEBUG. Meaningful values of debu- glevel are 0-3, where 0 is no debug output and 3 is lots of debug output, the default being 0. -g group Specify the named group to drop group privileges to, after doing pf(4) lookups which require root. By default, ftp-proxy uses the default group of the user it drops privilege to. -i Set ftp-proxy for use with IP-Filter. -M maxport Specify the upper end of the port range the proxy will use for the data connections it establishes. The default is IPPORT_HILASTAUTO defined in <netinet/in.h> as 65535. -m minport Specify the lower end of the port range the proxy will use for all data connections it establishes. The default is IPPORT_HIFIRSTAUTO defined in <netinet/in.h> as 49152. -n Activate network address translation (NAT) mode. In this mode, the proxy will not attempt to proxy passive mode (PASV or EPSV) data connections. In order for this to work, the machine running the proxy will need to be forwarding packets and doing network address translation to allow the outbound passive connections from the client to reach the server. See pf.conf(5) for more details on NAT. The proxy only ignores passive mode data connections when using this flag; it will still proxy PORT and EPRT mode data connections. Without this flag, ftp-proxy does not require any IP forwarding or NAT beyond the rdr necessary to capture the FTP control connec- tion. -p Set ftp-proxy for use with pf. -R address:[port] Reverse proxy mode for FTP servers running behind a NAT gateway. In this mode, no redirection is needed. The proxy is run from inetd(8) on the port that external clients connect to (usually 21). Control connections and passive data connections are forwarded to the server. -r Use reverse host (reverse DNS) lookups for logging and libwrap use. By default, the proxy does not look up hostnames for libwrap or logging purposes. -S address Source address to use for data connections made by the proxy. Useful when there are multiple addresses (aliases) available to the proxy. Clients may expect data connections to have the same source address as the control connections, and reject or drop other con- nections. -t timeout Specifies a timeout, in seconds. The proxy will exit and close open connections if it sees no data for the duration of the timeout. The default is 0, which means the proxy will not time out. -u user Specify the named user to drop privilege to, after doing pf(4) lookups which require root privilege. By default, ftp-proxy drops privilege to the user proxy. Running as root means that the source of data connections the proxy makes for PORT and EPRT will be the RFC mandated port 20. When running as a non-root user, the source of the data connections from ftp-proxy will be chosen randomly from the range minport to maxport as described above. -V Be verbose. With this option the proxy logs the control commands sent by clients and the replies sent by the servers to syslogd(8). -w Use the tcp wrapper access control library hosts_access(3), allowing connections to be allowed or denied based on the tcp wrapper's hosts.allow(5) and hosts.deny(5) files. The proxy does libwrap operations after determining the destination of the captured control connection, so that tcp wrapper rules may be written based on the destination as well as the source of FTP connections. ftp-proxy is run from inetd(8) and requires that FTP connections are redirected to it using a rdr rule. A typical way to do this would be to use either an ipnat rule such as int_if = "xl0"; rdr $int_if 0/0 port 21 -> 127.0.0.1 port 8021 tcp or a pf.conf(5) rule such as int_if = "xl0" rdr pass on $int_if proto tcp from any to any port 21 -> 127.0.0.1 port 8021 inetd(8) must then be configured to run ftp-proxy on the port from above using 127.0.0.1:8021 stream tcp nowait root /usr/libexec/ftp-proxy ftp-proxy -[ip] in inetd.conf(5). ftp-proxy accepts the redirected control connections and forwards them to the server. The proxy replaces the address and port number that the client sends through the control connection to the server with its own address and proxy port, where it listens for the data connection. When the server opens the data connection back to this port, the proxy forwards it to the client. If you're using IP-Filter, the ipf.conf(5) rules need to let pass connections to these proxy ports (see options -u, -m, and -M above) in on the external interface. The following exam- ple allows only ports 49152 to 65535 to pass in statefully: block in on $ext_if proto tcp all pass in on $ext_if inet proto tcp from any to $ext_if port > 49151 keep state If you're using pf, then the pf.conf(5) rules need to let pass connections to these proxy ports (see options -u, -m, and -M above) in on the external interface. The following example allows only ports 49152 to 65535 to pass in statefully: block in on $ext_if proto tcp all pass in on $ext_if inet proto tcp from any to $ext_if port > 49151 keep state Alternatively, pf.conf(5) rules can make use of the fact that by default, ftp-proxy runs as user "proxy" to allow the backchannel connec- tions, as in the following example: block in on $ext_if proto tcp all pass in on $ext_if inet proto tcp from any to $ext_if user proxy keep state These examples do not cover the connections from the proxy to the foreign FTP server. If one does not pass outgoing connections by default additional rules are needed. NOTES
com.apple/100.InternetSharing/ftp-proxy PF anchor is required for this daemon to correctly function. SEE ALSO
ftp(1), pf(4), hosts.allow(5), hosts.deny(5), inetd.conf(5), ipf.conf(5), ipnat.conf(5), pf.conf(5), inetd(8), ipf(8), ipnat(8), pfctl(8), syslogd(8) BUGS
Extended Passive mode (EPSV) is not supported by the proxy and will not work unless the proxy is run in network address translation mode. When not in network address translation mode, the proxy returns an error to the client, hopefully forcing the client to revert to passive mode (PASV) which is supported. EPSV will work in network address translation mode, assuming a configuration setup which allows the EPSV connections through to their destinations. IPv6 is not yet supported. BSD
March 16, 2011 BSD
All times are GMT -4. The time now is 05:36 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy