Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #191386

Re: Simple iptables table doesn't let me forward X windows

Show all headers | View raw

On Sat, Jan 20, 2018 at 07:30:09PM +0000, Joe wrote:
> On Sat, 20 Jan 2018 12:13:12 -0600
> Jason <electron@emypeople.net> wrote:
> 
> > Hi,
> > 
> > I am trying to setup (what should be) a simple iptables table between
> > two machines on a local network, both with static IP addresses. The
> > machine I want to set up the iptables on is a headless server which I
> > access using ssh. I want to cut off all communications except with the
> > machine I ssh from. What I did works except when I try to run a GUI
> > program on the server to display locally, after a pause I get
> > something like:
> > 
> > 	Geany: cannot open display
> > or
> > 	xterm: Xt error: Can't open display: localhost:10.0
> > 
> > both of which work before I run the iptables commands.
> 
> OK, that leaves little doubt that it's a firewall issue.
> 
> > 
> > Here's what I did (000.000.000.000 is substituted for actual IP
> > address of client machine):
> > 
> > $ sudo iptables -A INPUT -s 000.000.000.000 -j ACCEPT
> > $ sudo iptables -A OUTPUT -d 000.000.000.000 -j ACCEPT
> > $ sudo iptables -P INPUT DROP
> > $ sudo iptables -P OUTPUT DROP
> > 
> > I also tried to add
> > 
> > $ sudo iptables -A INPUT -i lo -j ACCEPT
> 
> You'll also want a lo ACCEPT in the OUTPUT chain.
Which fixed my problem, see my reply to Pascal.
> 
> > 
> > without success.
> > 
> > What do I need to do to get X forwarding to work?
> > 
> 
> Others may know the exact answer in this case. I'll make couple of
> suggestions for future iptables issues.
> 
> 1. Take one of the very basic firewall scripts (there are many around)
> that works statefully i.e. allows everything out, accepts established
> and related state replies, drops invalid packets, accepts lo in and out.
> Start from there, check your X forwarding works, then add IP address
> restrictions as required one by one. When it breaks, you know exactly
> what did it.
> 
> 2. Use -j LOG targets with various --log-prefix values in various
> places to understand what's going on, generally what's being dropped
> by mistake. When you finish with them, comment them out but leave them
> there for future use. Tailor them by address and/or port to look for
> specific issues. In your existing case:
> 
> iptables -A INPUT -j LOG --log-level debug --log-prefix "INPUT dropped:"
> 
> just before the actual DROP judgement, and another for OUTPUT. It will
> generate a lot of stuff quite quickly, so comment it once you have some
> logs to examine. It's amazing what really obvious things you can
> overlook with a firewall, and this will identify them fairly quickly.
> It's a much less tedious job than using a packet capture application,
> which is massive overkill for simple networking problems.
> 
> 3. You may be doing this without telling us here, but when you have a
> script to make your firewall, put in initialisation commands first, to
> remove any existing rules, and set overall DROP defaults in case your
> main iptables logic takes a wrong turn. You'll want at least the -F and
> -X iptables options for filter, nat and mangle tables. If you haven't
> disabled IPv6 altogether, you'll also need corresponding ip6tables
> commands, as IPv6 is wide open by default.
> 

I'm learning.

Thanks for responding!
-- 
Jason

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Simple iptables table doesn't let me forward X windows Jason <electron@emypeople.net> - 2018-01-20 19:20 +0100
  Re: Simple iptables table doesn't let me forward X windows Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-01-20 20:00 +0100
    Re: Simple iptables table doesn't let me forward X windows Jason <electron@emypeople.net> - 2018-01-21 04:40 +0100
  Re: Simple iptables table doesn't let me forward X windows Joe <joe@jretrading.com> - 2018-01-20 20:40 +0100
    Re: Simple iptables table doesn't let me forward X windows deloptes <deloptes@gmail.com> - 2018-01-20 21:50 +0100
    Re: Simple iptables table doesn't let me forward X windows Jason <electron@emypeople.net> - 2018-01-21 04:40 +0100

csiph-web