Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #191371 > unrolled thread

Simple iptables table doesn't let me forward X windows

Back to article view | Back to linux.debian.user

Contents

  Simple iptables table doesn't let me forward X windows Jason <electron@emypeople.net> - 2018-01-20 19:20 +0100
    Re: Simple iptables table doesn't let me forward X windows Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-01-20 20:00 +0100
      Re: Simple iptables table doesn't let me forward X windows Jason <electron@emypeople.net> - 2018-01-21 04:40 +0100
    Re: Simple iptables table doesn't let me forward X windows Joe <joe@jretrading.com> - 2018-01-20 20:40 +0100
      Re: Simple iptables table doesn't let me forward X windows deloptes <deloptes@gmail.com> - 2018-01-20 21:50 +0100
      Re: Simple iptables table doesn't let me forward X windows Jason <electron@emypeople.net> - 2018-01-21 04:40 +0100

#191371 — Simple iptables table doesn't let me forward X windows

Hi,

I am trying to setup (what should be) a simple iptables table between
two machines on a local network, both with static IP addresses. The
machine I want to set up the iptables on is a headless server which I
access using ssh. I want to cut off all communications except with the
machine I ssh from. What I did works except when I try to run a GUI
program on the server to display locally, after a pause I get
something like:

	Geany: cannot open display
or
	xterm: Xt error: Can't open display: localhost:10.0

both of which work before I run the iptables commands.

Here's what I did (000.000.000.000 is substituted for actual IP
address of client machine):

$ sudo iptables -A INPUT -s 000.000.000.000 -j ACCEPT
$ sudo iptables -A OUTPUT -d 000.000.000.000 -j ACCEPT
$ sudo iptables -P INPUT DROP
$ sudo iptables -P OUTPUT DROP

I also tried to add

$ sudo iptables -A INPUT -i lo -j ACCEPT

without success.

What do I need to do to get X forwarding to work?

Thanks!
-- 
Jason

[toc] | [next] | [standalone]

#191373

Le 20/01/2018 à 19:13, Jason a écrit :
> 
> I am trying to setup (what should be) a simple iptables table

I don't think so. In iptables, "tables" are preexisting data structures 
containing chains, and chains contain rules that you create. The set of 
rules in these chains and tables is called, well, a ruleset.

> between
> two machines on a local network, both with static IP addresses.

Nonsense. A ruleset is set up on one machine, not between two machines.

> The machine I want to set up the iptables on

As I wrote : on one machine.

> is a headless server which I
> access using ssh. I want to cut off all communications except with the
> machine I ssh from.

I guess you use X tunnelling with ssh -X or -Y ?

> What I did works except when I try to run a GUI
> program on the server to display locally, after a pause I get
> something like:
> 
> 	Geany: cannot open display
> or
> 	xterm: Xt error: Can't open display: localhost:10.0
> 
> both of which work before I run the iptables commands.
> 
> Here's what I did (000.000.000.000 is substituted for actual IP
> address of client machine):

You really should not use that kind of address for substitution. 0.0.0.0 
has a special meaning. You could use addresses in 192.0.2.0/24 which 
are reserved for examples and documentation instead.

> $ sudo iptables -A INPUT -s 000.000.000.000 -j ACCEPT
> $ sudo iptables -A OUTPUT -d 000.000.000.000 -j ACCEPT
> $ sudo iptables -P INPUT DROP
> $ sudo iptables -P OUTPUT DROP
> 
> I also tried to add
> 
> $ sudo iptables -A INPUT -i lo -j ACCEPT
> 
> without success.
> 
> What do I need to do to get X forwarding to work?

Add

iptables -A OUTPUT -o lo -j ACCEPT

Note that this ruleset allows much more than just SSH and X forwarding 
between the two machines.

[toc] | [prev] | [next] | [standalone]

#191385

On Sat, Jan 20, 2018 at 07:58:27PM +0100, Pascal Hambourg wrote:
> Le 20/01/2018 à 19:13, Jason a écrit :
> >
> >I am trying to setup (what should be) a simple iptables table
> 
> I don't think so. In iptables, "tables" are preexisting data structures
> containing chains, and chains contain rules that you create. The set of
> rules in these chains and tables is called, well, a ruleset.

Thanks for the clarification. This is my first experience using
iptables and my knowledge of it is elementary at best.

> 
> >between
> >two machines on a local network, both with static IP addresses.
> 
> Nonsense. A ruleset is set up on one machine, not between two machines.

I had thought after I wrote it that the wording probably wasn't correct.

> 
> >The machine I want to set up the iptables on
> 
> As I wrote : on one machine.
> 
> >is a headless server which I
> >access using ssh. I want to cut off all communications except with the
> >machine I ssh from.
> 
> I guess you use X tunnelling with ssh -X or -Y ?

Yes, with -X.

> >What I did works except when I try to run a GUI
> >program on the server to display locally, after a pause I get
> >something like:
> >
> >	Geany: cannot open display
> >or
> >	xterm: Xt error: Can't open display: localhost:10.0
> >
> >both of which work before I run the iptables commands.
> >
> >Here's what I did (000.000.000.000 is substituted for actual IP
> >address of client machine):
> 
> You really should not use that kind of address for substitution. 0.0.0.0 has
> a special meaning. You could use addresses in 192.0.2.0/24 which are
> reserved for examples and documentation instead.

Okay, making a note of it.

> >$ sudo iptables -A INPUT -s 000.000.000.000 -j ACCEPT
> >$ sudo iptables -A OUTPUT -d 000.000.000.000 -j ACCEPT
> >$ sudo iptables -P INPUT DROP
> >$ sudo iptables -P OUTPUT DROP
> >
> >I also tried to add
> >
> >$ sudo iptables -A INPUT -i lo -j ACCEPT
> >
> >without success.
> >
> >What do I need to do to get X forwarding to work?
> 
> Add
> 
> iptables -A OUTPUT -o lo -j ACCEPT

That works, thanks a lot Pascal!
> 
> Note that this ruleset allows much more than just SSH and X forwarding
> between the two machines.

Which is fine in this case.
Thanks again!

-- 
Jason

[toc] | [prev] | [next] | [standalone]

#191375

On Sat, 20 Jan 2018 12:13:12 -0600
Jason <electron@emypeople.net> wrote:

> Hi,
> 
> I am trying to setup (what should be) a simple iptables table between
> two machines on a local network, both with static IP addresses. The
> machine I want to set up the iptables on is a headless server which I
> access using ssh. I want to cut off all communications except with the
> machine I ssh from. What I did works except when I try to run a GUI
> program on the server to display locally, after a pause I get
> something like:
> 
> 	Geany: cannot open display
> or
> 	xterm: Xt error: Can't open display: localhost:10.0
> 
> both of which work before I run the iptables commands.

OK, that leaves little doubt that it's a firewall issue.

> 
> Here's what I did (000.000.000.000 is substituted for actual IP
> address of client machine):
> 
> $ sudo iptables -A INPUT -s 000.000.000.000 -j ACCEPT
> $ sudo iptables -A OUTPUT -d 000.000.000.000 -j ACCEPT
> $ sudo iptables -P INPUT DROP
> $ sudo iptables -P OUTPUT DROP
> 
> I also tried to add
> 
> $ sudo iptables -A INPUT -i lo -j ACCEPT

You'll also want a lo ACCEPT in the OUTPUT chain.

> 
> without success.
> 
> What do I need to do to get X forwarding to work?
> 

Others may know the exact answer in this case. I'll make couple of
suggestions for future iptables issues.

1. Take one of the very basic firewall scripts (there are many around)
that works statefully i.e. allows everything out, accepts established
and related state replies, drops invalid packets, accepts lo in and out.
Start from there, check your X forwarding works, then add IP address
restrictions as required one by one. When it breaks, you know exactly
what did it.

2. Use -j LOG targets with various --log-prefix values in various
places to understand what's going on, generally what's being dropped
by mistake. When you finish with them, comment them out but leave them
there for future use. Tailor them by address and/or port to look for
specific issues. In your existing case:

iptables -A INPUT -j LOG --log-level debug --log-prefix "INPUT dropped:"

just before the actual DROP judgement, and another for OUTPUT. It will
generate a lot of stuff quite quickly, so comment it once you have some
logs to examine. It's amazing what really obvious things you can
overlook with a firewall, and this will identify them fairly quickly.
It's a much less tedious job than using a packet capture application,
which is massive overkill for simple networking problems.

3. You may be doing this without telling us here, but when you have a
script to make your firewall, put in initialisation commands first, to
remove any existing rules, and set overall DROP defaults in case your
main iptables logic takes a wrong turn. You'll want at least the -F and
-X iptables options for filter, nat and mangle tables. If you haven't
disabled IPv6 altogether, you'll also need corresponding ip6tables
commands, as IPv6 is wide open by default.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#191379

Joe wrote:

> OK, that leaves little doubt that it's a firewall issue.

usually xauth missing or wrong xauth

people do upgrade, then just press yes and pile up mess over mess and then
come here to ask for help.

it's fun

regards

[toc] | [prev] | [next] | [standalone]

#191386

On Sat, Jan 20, 2018 at 07:30:09PM +0000, Joe wrote:
> On Sat, 20 Jan 2018 12:13:12 -0600
> Jason <electron@emypeople.net> wrote:
> 
> > Hi,
> > 
> > I am trying to setup (what should be) a simple iptables table between
> > two machines on a local network, both with static IP addresses. The
> > machine I want to set up the iptables on is a headless server which I
> > access using ssh. I want to cut off all communications except with the
> > machine I ssh from. What I did works except when I try to run a GUI
> > program on the server to display locally, after a pause I get
> > something like:
> > 
> > 	Geany: cannot open display
> > or
> > 	xterm: Xt error: Can't open display: localhost:10.0
> > 
> > both of which work before I run the iptables commands.
> 
> OK, that leaves little doubt that it's a firewall issue.
> 
> > 
> > Here's what I did (000.000.000.000 is substituted for actual IP
> > address of client machine):
> > 
> > $ sudo iptables -A INPUT -s 000.000.000.000 -j ACCEPT
> > $ sudo iptables -A OUTPUT -d 000.000.000.000 -j ACCEPT
> > $ sudo iptables -P INPUT DROP
> > $ sudo iptables -P OUTPUT DROP
> > 
> > I also tried to add
> > 
> > $ sudo iptables -A INPUT -i lo -j ACCEPT
> 
> You'll also want a lo ACCEPT in the OUTPUT chain.
Which fixed my problem, see my reply to Pascal.
> 
> > 
> > without success.
> > 
> > What do I need to do to get X forwarding to work?
> > 
> 
> Others may know the exact answer in this case. I'll make couple of
> suggestions for future iptables issues.
> 
> 1. Take one of the very basic firewall scripts (there are many around)
> that works statefully i.e. allows everything out, accepts established
> and related state replies, drops invalid packets, accepts lo in and out.
> Start from there, check your X forwarding works, then add IP address
> restrictions as required one by one. When it breaks, you know exactly
> what did it.
> 
> 2. Use -j LOG targets with various --log-prefix values in various
> places to understand what's going on, generally what's being dropped
> by mistake. When you finish with them, comment them out but leave them
> there for future use. Tailor them by address and/or port to look for
> specific issues. In your existing case:
> 
> iptables -A INPUT -j LOG --log-level debug --log-prefix "INPUT dropped:"
> 
> just before the actual DROP judgement, and another for OUTPUT. It will
> generate a lot of stuff quite quickly, so comment it once you have some
> logs to examine. It's amazing what really obvious things you can
> overlook with a firewall, and this will identify them fairly quickly.
> It's a much less tedious job than using a packet capture application,
> which is massive overkill for simple networking problems.
> 
> 3. You may be doing this without telling us here, but when you have a
> script to make your firewall, put in initialisation commands first, to
> remove any existing rules, and set overall DROP defaults in case your
> main iptables logic takes a wrong turn. You'll want at least the -F and
> -X iptables options for filter, nat and mangle tables. If you haven't
> disabled IPv6 altogether, you'll also need corresponding ip6tables
> commands, as IPv6 is wide open by default.
> 

I'm learning.

Thanks for responding!
-- 
Jason

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web