Tuesday, 6 August 2013

CentOS - IPTables - Allow nodes on subnet full access

CentOS - IPTables - Allow nodes on subnet full access

I am using linode.com and they provide the ability to assign a private IP
to each vps. What I am trying to do is setup each node's firewall to allow
access from other nodes on the network, but I don't seem to have much
success.
For example, I am trying to allow access to server1:1337 from server2,
both are setup as follows:
server1:
ifcfg-eth0:
DEVICE="eth0"
IPADDR="1.1.1.1"
NETMASK="255.255.255.0"
ifcfg-eth0:0:
DEVICE="eth0:0"
IPADDR="192.168.132.96"
NETMASK="255.255.128.0"
server2:
ifcfg-eth0:
DEVICE="eth0"
IPADDR="1.1.1.2"
NETMASK="255.255.255.0"
ifcfg-eth0:0:
DEVICE="eth0:0"
IPADDR="192.168.132.97"
NETMASK="255.255.128.0"
And the IPTables ruleset on server1:
# Initialize policy
iptables -P INPUT DROP
#-----
# Flush all current rules from iptables#
#-----
iptables -F
iptables -F -t nat
#-----
#-----
# Set access for localhost
#-----
iptables -A INPUT -i lo -j ACCEPT
# !! Tried to allow all nodes on the subnet access to everything, but
still didn't work !!
iptables -A INPUT -s 192.168.0.0/17 -j ACCEPT
#-----
#-----
# Accept packets belonging to established and related connections
#-----
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#-----
# !! Tried to allow access to the port directly !!
iptables -A INPUT -i eth0:0 -p tcp -s 192.168.0.0/17 --dport 1337 -j ACCEPT
#-----
# Lock everything down
#-----
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
#-----
I did stumble across a couple of old forums stating that iptables cannot
use the -i eth0:0 call, as the virtual settings share parent settings, but
I wasn't able to confirm this fully.

No comments:

Post a Comment