In short: I'd like to be able to telnet to my modem from my PC via my router.
There is a simple home router on 192.168.33.1
. It is running OpenWrt. It has the following interfaces defined:
br-lan Link encap:Ethernet HWaddr 00:23:CD:20:C3:B0
eth0 Link encap:Ethernet HWaddr 00:23:CD:20:C3:B0
lan1 Link encap:Ethernet HWaddr 00:23:CD:20:C3:B0
lan2 Link encap:Ethernet HWaddr 00:23:CD:20:C3:B0
lan3 Link encap:Ethernet HWaddr 00:23:CD:20:C3:B0
lan4 Link encap:Ethernet HWaddr 00:23:CD:20:C3:B0
lo Link encap:Local Loopback
pppoe-wan Link encap:Point-to-Point Protocol
wan Link encap:Ethernet HWaddr 00:23:CD:20:C3:B0
I think only one or two have relevance here:
root@TIBERIUS: ~ > ifconfig wan
wan Link encap:Ethernet HWaddr 00:23:CD:20:C3:B0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2295 errors:0 dropped:1 overruns:0 frame:0
TX packets:2740 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:270389 (264.0 KiB) TX bytes:245297 (239.5 KiB)
root@TIBERIUS: ~ > ifconfig eth0
eth0 Link encap:Ethernet HWaddr 00:23:CD:20:C3:B0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6252 errors:0 dropped:0 overruns:83 frame:0
TX packets:4725 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:863045 (842.8 KiB) TX bytes:667374 (651.7 KiB)
Interrupt:4
None has an IP address assigned to it. But pppoe-wan
does. And that's the way Internet access works on this box, via PPPoE.
The DSL modem is connected to the router on the WAN port. The one labeled such on the casing. (I do not understand why there are both eth0
and wan
.) It has a built-in IP address of 192.168.1.1
. It can be audited via telnet.
The first step to do so is to set up an interface on the router box to reach the modem through.
root@TIBERIUS: ~ > ifconfig eth0 192.168.1.220
root@TIBERIUS: ~ > ping 192.168.1.1 -I eth0
PING 192.168.1.1 (192.168.1.1): 56 data bytes
^C
This adds a route, but doesn't work, not even adding the -I
switch. Must be the wrong interface. (I don't know what eth0
corresponds to on this box. Maybe the LAN part, not the WAN part?) Anyway, I then reset the network settings (/etc/init.d/network restart
) and repeat the procedure for wan
, and that does work:
root@TIBERIUS: ~ > ifconfig wan 192.168.1.222
root@TIBERIUS: ~ > ping 192.168.1.1 -I wan
PING 192.168.1.1 (192.168.1.1): 56 data bytes
64 bytes from 192.168.1.1: seq=0 ttl=64 time=1.205 ms
64 bytes from 192.168.1.1: seq=1 ttl=64 time=0.496 ms
Audit via telnet
also works.
Now I'd like to also work from my PC on the LAN. My PC is on 192.168.33.152
. Trying to telnet
the modem from the PC results in "connection refused". And I can't ping the modem either ("Antwort von 192.168.33.1: Zielport nicht erreichbar." = "destination port not reachable").
From what I understand about iptables
from various docs and graphical schemas floating about the net, packets from the LAN to the modem will enter PREROUTING
chain on the router (no destination NAT needed), then after routing (hopefully) the FORWARDING
chain, and then (hopefully) the POSTROUTING
chain (source NAT required).
However, I don't have a clue how to fit this in with the various chains predefined by OpenWrt. There's a couple of them in nat
:
root@TIBERIUS: ~ > iptables -S -t nat
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N nat_reflection_in
-N nat_reflection_out
-N postrouting_rule
-N prerouting_lan
-N prerouting_rule
-N prerouting_wan
-N zone_lan_nat
-N zone_lan_prerouting
-N zone_wan_nat
-N zone_wan_prerouting
-A PREROUTING -j prerouting_rule
-A PREROUTING -i br-lan -j zone_lan_prerouting
-A PREROUTING -i pppoe-wan -j zone_wan_prerouting
-A POSTROUTING -j postrouting_rule
-A POSTROUTING -o br-lan -j zone_lan_nat
-A POSTROUTING -o pppoe-wan -j zone_wan_nat
-A postrouting_rule -j nat_reflection_out
-A prerouting_rule -j nat_reflection_in
-A zone_lan_prerouting -j prerouting_lan
-A zone_wan_nat ! -d 192.168.1.0/24 -j MASQUERADE
-A zone_wan_prerouting -j prerouting_wan
And many more in filter
:
root@TIBERIUS: ~ > iptables -S -t filter
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N forward
-N forwarding_lan
-N forwarding_rule
-N forwarding_wan
-N input
-N input_lan
-N input_rule
-N input_wan
-N nat_reflection_fwd
-N output
-N output_rule
-N reject
-N syn_flood
-N zone_lan
-N zone_lan_ACCEPT
-N zone_lan_DROP
-N zone_lan_REJECT
-N zone_lan_forward
-N zone_wan
-N zone_wan_ACCEPT
-N zone_wan_DROP
-N zone_wan_REJECT
-N zone_wan_forward
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j syn_flood
-A INPUT -j input_rule
-A INPUT -j input
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j forwarding_rule
-A FORWARD -j forward
-A FORWARD -j reject
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j output_rule
-A OUTPUT -j output
-A forward -i br-lan -j zone_lan_forward
-A forward -i pppoe-wan -j zone_wan_forward
-A forwarding_rule -j nat_reflection_fwd
-A input -i br-lan -j zone_lan
-A input -i pppoe-wan -j zone_wan
-A output -j zone_wan_ACCEPT
-A output -j zone_lan_ACCEPT
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -j REJECT --reject-with icmp-port-unreachable
-A syn_flood -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 25/sec --limit-burst 50 -j RETURN
-A syn_flood -j DROP
-A zone_lan -j input_lan
-A zone_lan -j zone_lan_ACCEPT
-A zone_lan_ACCEPT -o br-lan -j ACCEPT
-A zone_lan_ACCEPT -i br-lan -j ACCEPT
-A zone_lan_DROP -o br-lan -j DROP
-A zone_lan_DROP -i br-lan -j DROP
-A zone_lan_REJECT -o br-lan -j reject
-A zone_lan_REJECT -i br-lan -j reject
-A zone_lan_forward -j zone_wan_ACCEPT
-A zone_lan_forward -j forwarding_lan
-A zone_lan_forward -j zone_lan_REJECT
-A zone_wan -p udp -m udp --dport 68 -j ACCEPT
-A zone_wan -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A zone_wan -j input_wan
-A zone_wan -j zone_wan_REJECT
-A zone_wan_ACCEPT -o pppoe-wan -j ACCEPT
-A zone_wan_ACCEPT -i pppoe-wan -j ACCEPT
-A zone_wan_DROP -o pppoe-wan -j DROP
-A zone_wan_DROP -i pppoe-wan -j DROP
-A zone_wan_REJECT -o pppoe-wan -j reject
-A zone_wan_REJECT -i pppoe-wan -j reject
-A zone_wan_forward -j forwarding_wan
-A zone_wan_forward -j zone_wan_REJECT
How can I file my rules in this set of chains?
(Feeling encouraged to ask this here because another user was similarly bewildered by the set of default chains in OpenWrt.)