I have been migrating older local sysadmin content, with a
goal of 'no more iptables' ruleset manipulation. Part of the
load is getting outgoing email redirect into a single exit
machine, so I can get logging (and identification of
compromised hosts propagating virus and such )-- working. We
take traffic counts by originating host IP, and regularly find
'phishing' compromised internal host sending large volumes of
email -- the traffic counts spike up and go 'through the roof'
The standby script from long ago which I wrote is:
[herrold@centos-7 rc.d]$ cat mailfunnel.sh
#!/bin/sh
# mailfunnel.sh
NATHOST="172.168.33.2"
INSIDE="172.168.33.105"
LOCALNET="172.168.33.0/24"
LOCALHOST="127.0.0.1"
WORLD="0.0.0.0/0"
MAILPORT="25"
IPTABLES="/sbin/iptables "
# pass content initiating on 'lo'
$IPTABLES -t nat -A PREROUTING \
-s $LOCALHOST -d $WORLD \
-j ACCEPT
$IPTABLES -t nat -A POSTROUTING \
-s $LOCALHOST -d $WORLD \
-j ACCEPT
# hand off a portforward of the backside email traffic
# to the logging host
$IPTABLES -t nat -A PREROUTING -p tcp \
-s ! $INSIDE -d $WORLD --dport $MAILPORT \
-j DNAT --to-destination $INSIDE
# I suspect this rule is never hit
$IPTABLES -t nat -A POSTROUTING -p tcp \
-s ! $INSIDE -d $WORLD --dport $MAILPORT \
-j SNAT --to $NATHOST
[herrold@centos-7 rc.d]$
looks like I've not touched the one for that site in a long
time:
-rwxr-xr-x. 1 herrold herrold 1050 Feb 2 2005 mailfunnel.sh
This was a mixture of NAT and port forwarding
It would not harm my feelings if both the NATHOST and the
INSIDE (mail destination) were on the same IP, and indeed that
that destination was the gateway. That was my first attempt,
with trying to get 'transparent redirect' into the gateway
'squid' to catch even hosts not explicitly set to use the
proxy
I had tried and failed to add to a NAT barrier host, a
'catchall' rule to feed all port 80 traffic from the
'backside' network over to port 3128 -- squid -- on the
localhost, but I am missing what is wrong with this command:
[root@router squid]# firewall-cmd --zone=internal
--add-rule-rich='rule family="ipv4" forward-port
to-port="3128" to-addr="127.0.0.1" port="80" protocol="tcp" '
usage: see firewall-cmd man page
firewall-cmd: error: unrecognized arguments:
--add-rule-rich=rule family="ipv4" forward-port to-port="3128"
to-addr="127.0.0.1" port="80" protocol="tcp"
ehh? that example was lifted right out of the 'man' page
What approach to convert this set of rules is most direct? I
suspect my answer in each case will involve reference
firewalld.richlanguage
from its man page. I tried to follow Example 5. I adjusted it
to a general rule
[root@router squid]# firewall-cmd --zone=internal
--add-rule-rich='rule family="ipv4" forward-port to-port="25"
to-addr="10.16.0.1" port="25" protocol="tcp" '
usage: see firewall-cmd man page
firewall-cmd: error: unrecognized arguments:
--add-rule-rich=rule family="ipv4" forward-port to-port="25"
to-addr="10.16.0.1" port="25" protocol="tcp"
So clearly I am missing something
Thoughts? Pointers? (My Google-fu does not produce useful
pointers)
-- Russ herrold
