Using default policy drop in FORWARD chainīs

Hello Guys

Nowdays, I īve been working  in a firewall configuration. I
want use default 
policy DROP, for the INPUT,FORWARD,OUTPUT chainīs.  I using
the redwall 
firewall, it has support for l7-protocols. I need to block
msn, but when I 
apply the ruler to the forward chain it isnīt block.

But when y change de default policy in Forward chainīs  to
ACCEPT, tha same 
ruler block the msn traffic.

I appreciate some advices

Cheerio!

IPTABLES=/sbin/iptables

$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -X
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP


$IPTABLES  -A FORWARD -p tcp -m tcp -m layer7 --l7proto
msnmessenger
-j DROP




$IPTABLES -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type
destination-unreachable -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j
ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type
destination-unreachable -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j
ACCEPT

#$IPTABLES -A FORWARD -s 10.0.109.20 -j DROP

$IPTABLES -A INPUT   -i eth2 -p tcp -m tcp --dport 22 -j
ACCEPT
$IPTABLES -A OUTPUT  -o eth2 -p tcp -m tcp --sport 22 -m
state --state 
RELATED,ESTABLISHED -j ACCEPT



$IPTABLES -A FORWARD -p tcp -m tcp --sport 80 -j ACCEPT
$IPTABLES -A FORWARD -p tcp -m tcp --dport 80 -j ACCEPT

$IPTABLES -A FORWARD -p tcp -m tcp --sport 80 -m layer7
--l7proto 
msnmessenger -j DROP
$IPTABLES -A FORWARD -p tcp -m tcp --dport 80 -m layer7
--l7proto 
msnmessenger -j DROP
$IPTABLES -A FORWARD -p tcp -m tcp --sport 443 -j ACCEPT
$IPTABLES -A FORWARD -p tcp -m tcp --dport 443 -j ACCEPT

$IPTABLES -A FORWARD -p udp -m udp --sport 53 -j ACCEPT
$IPTABLES -A FORWARD -p udp -m udp --dport 53 -j ACCEPT

Juan Santamaria wrote:
> Hello Guys

Hi Juan,

> 
> Nowdays, I īve been working  in a firewall
configuration. I want use 
> default policy DROP, for the INPUT,FORWARD,OUTPUT
chainīs.  I using the 
> redwall firewall, it has support for l7-protocols. I
need to block msn, 
> but when I apply the ruler to the forward chain it
isnīt block.
> 
> But when y change de default policy in Forward chainīs 
to ACCEPT, tha 
> same ruler block the msn traffic.
> 
> I appreciate some advices
> 
> Cheerio!
> 
> IPTABLES=/sbin/iptables
> 
> $IPTABLES -F
> $IPTABLES -t nat -F
> $IPTABLES -X
> $IPTABLES -P INPUT DROP
> $IPTABLES -P OUTPUT DROP
> $IPTABLES -P FORWARD DROP
> 
> 
> $IPTABLES  -A FORWARD -p tcp -m tcp -m layer7 --l7proto
msnmessenger
> -j DROP
> 
> 
> 
> 
> $IPTABLES -A INPUT -p icmp --icmp-type echo-reply -j
ACCEPT
> $IPTABLES -A INPUT -p icmp --icmp-type
destination-unreachable -j ACCEPT
> $IPTABLES -A INPUT -p icmp --icmp-type echo-request -j
ACCEPT
> $IPTABLES -A OUTPUT -p icmp --icmp-type echo-reply -j
ACCEPT
> $IPTABLES -A OUTPUT -p icmp --icmp-type
destination-unreachable -j ACCEPT
> $IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j
ACCEPT
> 
> #$IPTABLES -A FORWARD -s 10.0.109.20 -j DROP
> 
> $IPTABLES -A INPUT   -i eth2 -p tcp -m tcp --dport 22
-j ACCEPT
> $IPTABLES -A OUTPUT  -o eth2 -p tcp -m tcp --sport 22
-m state --state 
> RELATED,ESTABLISHED -j ACCEPT
> 

I think the problem occurs here.  It's important to put the
more 
specific rules in front of the more general rules or they
will never be 
seen because the condition has already been matched.  Move
the following 
two rules to after those of "layer7" and all
should be well.

Hope this is useful.

> 
> 
> $IPTABLES -A FORWARD -p tcp -m tcp --sport 80 -j ACCEPT
> $IPTABLES -A FORWARD -p tcp -m tcp --dport 80 -j ACCEPT
> 
> $IPTABLES -A FORWARD -p tcp -m tcp --sport 80 -m layer7
--l7proto 
> msnmessenger -j DROP
> $IPTABLES -A FORWARD -p tcp -m tcp --dport 80 -m layer7
--l7proto 
> msnmessenger -j DROP
> $IPTABLES -A FORWARD -p tcp -m tcp --sport 443 -j
ACCEPT
> $IPTABLES -A FORWARD -p tcp -m tcp --dport 443 -j
ACCEPT
> 
> $IPTABLES -A FORWARD -p udp -m udp --sport 53 -j ACCEPT
> $IPTABLES -A FORWARD -p udp -m udp --dport 53 -j ACCEPT
> 
> 
> 
> 
>