Hoping someone with some expertise in iptables can help me adjust my settings on my TomatoUSB router.
GRE packets are being dropped by the router, and I think all I have to do is add an entry for the wanin chain.
This is what I get in my logs when attempting a VPN to my Windows 2008 R2 server.
Oct 6 08:45:41 ? user.warn kernel: DROP IN=vlan1 OUT= MAC=58:6d:8f:0f:f9:4e:d8:5d:4c:a7:18:99:08:00:45:00:00:3c SRC=222.153.223.87 DST=MYIPAddress LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=3090 DF PROTO=47TomatoUSB has all the required ports forwarded, but there is nothing for the GRE protocol.
This is my iptables output
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- br0 * 0.0.0.0/0 123.255.41.36
0 0 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
17 1865 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 112 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 logaccept udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
0 0 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
0 0 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
26 6126 restrict all -- * vlan1 0.0.0.0/0 0.0.0.0/0
26 6126 monitor all -- * vlan1 0.0.0.0/0 0.0.0.0/0
48 9681 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
6 749 wanin all -- vlan1 * 0.0.0.0/0 0.0.0.0/0
0 0 wanout all -- * vlan1 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0
6 749 upnp all -- vlan1 * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 31 packets, 13934 bytes)
pkts bytes target prot opt in out source destination
Chain logaccept (24 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW limit: avg 1/sec burst 5 LOG flags 6 level 4 prefix `ACCEPT '
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain logdrop (2 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW limit: avg 1/sec burst 5 LOG flags 6 level 4 prefix `DROP '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain logreject (0 references)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 6 level 4 prefix `REJECT '
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset
Chain monitor (1 references)
pkts bytes target prot opt in out source destination
0 0 all -- * * 0.0.0.0/0 0.0.0.0/0 WEBMON --max_domains 300 --max_searches 300
Chain rdev01 (0 references)
pkts bytes target prot opt in out source destination
0 0 rres01 all -- * * 10.0.0.7 0.0.0.0/0 [goto]
0 0 rres01 all -- * * 10.0.0.6 0.0.0.0/0 [goto]
0 0 rres01 all -- * * 10.0.0.14 0.0.0.0/0 [goto]
0 0 rres01 all -- * * 10.0.0.15 0.0.0.0/0 [goto]
0 0 rres01 all -- * * 10.0.0.113 0.0.0.0/0 [goto]
0 0 rres01 all -- * * 10.0.0.5 0.0.0.0/0 [goto]
Chain restrict (1 references)
pkts bytes target prot opt in out source destination
26 6126 rres02 all -- * * 0.0.0.0/0 0.0.0.0/0
Chain rres01 (6 references)
pkts bytes target prot opt in out source destination
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 web --hore "facebook myspace yaba bepo fbcdn" reject-with tcp-reset
Chain rres02 (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 destination IP range 0.0.1.0-0.0.255.255
Chain upnp (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 10.0.0.8 tcp dpt:38449
6 749 ACCEPT udp -- * * 0.0.0.0/0 10.0.0.8 udp dpt:38449
Chain wanin (1 references)
pkts bytes target prot opt in out source destination
0 0 logaccept tcp -- * * xx.xx.xx.xx/18 10.0.0.2 tcp dpt:1025
0 0 logaccept udp -- * * xx.xx.xx.xx/18 10.0.0.2 udp dpt:1025
0 0 logaccept tcp -- * * xx.xx.xx.xx 10.0.0.2 tcp dpts:5060:5062
0 0 logaccept udp -- * * xx.xx.xx.xx 10.0.0.2 udp dpts:5060:5062
0 0 logaccept tcp -- * * xx.xx.xx.xx/13 10.0.0.12 tcp dpt:21
0 0 logaccept tcp -- * * xx.xx.xx.xx 10.0.0.2 tcp dpt:1025
0 0 logaccept udp -- * * xx.xx.xx.xx 10.0.0.2 udp dpt:1025
0 0 logaccept tcp -- * * xx.xx.xx.xx 10.0.0.2 tcp dpts:5060:5062
0 0 logaccept udp -- * * xx.xx.xx.xx 10.0.0.2 udp dpts:5060:5062
0 0 logaccept tcp -- * * xx.xx.xx.xx 10.0.0.2 tcp dpts:50600:50610
0 0 logaccept udp -- * * xx.xx.xx.xx 10.0.0.2 udp dpts:50600:50610
0 0 logaccept tcp -- * * xx.xx.xx.xx 10.0.0.2 tcp dpts:50600:50610
0 0 logaccept udp -- * * xx.xx.xx.xx 10.0.0.2 udp dpts:50600:50610
0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:123
0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:80
0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:1723
0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:443
0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.8 tcp dpt:44871
0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:1701
0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.12 tcp dpt:500
0 0 logaccept udp -- * * 0.0.0.0/0 10.0.0.12 udp dpt:500
0 0 logaccept tcp -- * * 0.0.0.0/0 10.0.0.3 tcp dpt:25
0 0 logaccept udp -- * * 0.0.0.0/0 10.0.0.12 udp dpt:4500
Chain wanout (1 references)
