Hi allHoping someone with some expertise in iptables can help me adjust my settings on my TomatoUSB router.GRE packets are being dropped by the router, and I think all I have to do is add an entry for the wanin chain.This is what I get in my logs when attempting a VPN to my Windows 2008 R2 server.Oct 6 08:45:41 ? user.warn kernel: DROP IN=vlan1 OUT= MAC=58:6d:8f:0f:f9:4e:d8:5d:4c:a7:18:99:08:00:45:00:00:3c SRC=222.153.223.87 DST=MYIPAddress LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=3090 DF PROTO=47TomatoUSB has all the required ports forwarded, but there is nothing for the GRE protocol.This is my iptables output Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 DROP all -- br0 * 0.0.0.0/0 123.255.41.36 0 0 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 17 1865 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 2 112 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 0 0 logaccept udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 0 0 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 0 0 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU 26 6126 restrict all -- * vlan1 0.0.0.0/0 0.0.0.0/0 26 6126 monitor all -- * vlan1 0.0.0.0/0 0.0.0.0/0 48 9681 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 6 749 wanin all -- vlan1 * 0.0.0.0/0 0.0.0.0/0 0 0 wanout all -- * vlan1 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 6 749 upnp all -- vlan1 * 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 31 packets, 13934 bytes) pkts bytes target prot opt in out source destination Chain logaccept (24 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW limit: avg 1/sec burst 5 LOG flags 6 level 4 prefix `ACCEPT ' 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain logdrop (2 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW limit: avg 1/sec burst 5 LOG flags 6 level 4 prefix `DROP ' 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain logreject (0 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 6 level 4 prefix `REJECT ' 0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset Chain monitor (1 references) pkts bytes target prot opt in out source destination 0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 WEBMON --max_domains 300 --max_searches 300 Chain rdev01 (0 references) pkts bytes target prot opt in out source destination 0 0 rres01 all -- * * 10.0.0.7 0.0.0.0/0 [goto] 0 0 rres01 all -- * * 10.0.0.6 0.0.0.0/0 [goto] 0 0 rres01 all -- * * 10.0.0.14 0.0.0.0/0 [goto] 0 0 rres01 all -- * * 10.0.0.15 0.0.0.0/0 [goto] 0 0 rres01 all -- * * 10.0.0.113 0.0.0.0/0 [goto] 0 0 rres01 all -- * * 10.0.0.5 0.0.0.0/0 [goto] Chain restrict (1 references) pkts bytes target prot opt in out source destination 26 6126 rres02 all -- * * 0.0.0.0/0 0.0.0.0/0 Chain rres01 (6 references) pkts bytes target prot opt in out source destination 0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 web --hore "facebook myspace yaba bepo fbcdn" reject-with tcp-reset Chain rres02 (1 references) pkts bytes target prot opt in out source destination 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 destination IP range 0.0.1.0-0.0.255.255 Chain upnp (1 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- * * 0.0.0.0/0 10.0.0.8 tcp dpt:38449 6 749 ACCEPT udp -- * * 0.0.0.0/0 10.0.0.8 udp dpt:38449 Chain wanin (1 references) pkts bytes target prot opt in out source destination 0 0 logaccept tcp -- * * xx.xx.xx.xx/18 10.0.0.2 tcp dpt:1025 0 0 logaccept udp -- * * xx.xx.xx.xx/18 10.0.0.2 udp dpt:1025 0 0 logaccept tcp -- * * xx.xx.xx.xx 10.0.0.2 tcp dpts:5060:5062 0 0 logaccept udp -- * * xx.xx.xx.xx 10.0.0.2 udp dpts:5060:5062 0 0 logaccept tcp -- * * xx.xx.xx.xx/13 10.0.0.12 tcp dpt:21 0 0 logaccept tcp -- * * xx.xx.xx.xx 10.0.0.2 tcp dpt:1025 0 0 logaccept udp -- * * xx.xx.xx.xx 10.0.0.2 udp dpt:1025 0 0 logaccept tcp -- * * xx.xx.xx.xx 10.0.0.2 tcp dpts:5060:5062 0 0 logaccept udp -- * * xx.xx.xx.xx 10.0.0.2 udp dpts:5060:5062 0 0 logaccept tcp -- * * xx.xx.xx.xx 10.0.0.2 tcp dpts:50600:50610 0 0 logaccept udp -- * * xx.xx.xx.xx 10.0.0.2 udp dpts:50600:50610 0 0 logaccept tcp -- * * xx.xx.xx.xx 10.0.0.2 tcp dpts:50600:50610 0 0 logaccept udp -- * * xx.xx.xx.xx 10.0.0.2 udp dpts:50600:50610 0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:123 0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:80 0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:1723 0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:443 0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.8 tcp dpt:44871 0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:1701 0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:500 0 0 logaccept udp -- * * 0.0.0.0/0 10.0.0.12 udp dpt:500 0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.3 tcp dpt:25 0 0 logaccept udp -- * * 0.0.0.0/0 10.0.0.12 udp dpt:4500 Chain wanout (1 references)
↧