Bug 30191

Summary:	NAT configuration wizard is broken
Product:	Mageia	Reporter:	JWD van Maanen <gfaerie>
Component:	Installer	Assignee:	Mageia tools maintainers <mageiatools>
Status:	NEW ---	QA Contact:
Severity:	major
Priority:	Normal	CC:	davidwhodgins
Version:	8
Target Milestone:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Source RPM:	drakconf 13.27-1mga8 noarch	CVE:
Status comment:

Description JWD van Maanen 2022-03-18 17:19:07 CET

Description of problem: MCC internet connection sharing Installed on a firewall/router system with muliple nic's installed Bind, DHCP-server and Squid 
and told me eveything was configured correctly.... but didn't


Version-Release number of selected component (if applicable):
Drakconf 13.27-1mga8 noarch 

How reproducible: PC x64
NetXtreme BCM5752 Gigabit Ethernet PCI Express/ LAN 
RTL8169 PCI Gigabit Ethernet Controller/ ICP

Mageia 8 clean install as firewall/router in secure mode
The ICP connection is in bridged mode

Steps to Reproduce:
1. internet connection sharing is started correctly
2. Internet nic is correctly recognized 
3. Lan nic is selected withe a 192.168.1.1, standard configuration
4. Bind, DHCP-server & Squid are installed, seems like normal
5. Installation is finnished and the network connections restart automatically like normal.
6. The first thing i Noticed is that from the server i had still internet. normally I get an Squid proxy page danying me internet acces.
7. The LAN connection is good. DHCP works fine exept there's no NAT configuration.
The standard iptables look as if untouched by the MCC configuration wizard:
# Completed on Thu Mar 17 19:06:36 2022
# Generated by iptables-save v1.8.7 on Thu Mar 17 19:06:36 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:Ifw - [0:0]
:dynamic - [0:0]
:enp1s4_fwd - [0:0]
:enp1s4_in - [0:0]
:enp1s4_out - [0:0]
:enp1s9_fwd - [0:0]
:enp1s9_in - [0:0]
:enp1s9_out - [0:0]
:fw-fw - [0:0]
:fw-loc - [0:0]
:fw-net - [0:0]
:loc-fw - [0:0]
:loc-net - [0:0]
:loc_frwd - [0:0]
:logdrop - [0:0]
:logflags - [0:0]
:logreject - [0:0]
:net-fw - [0:0]
:net-loc - [0:0]
:net_frwd - [0:0]
:reject - [0:0]
:sfilter - [0:0]
:sha-lh-74b4a0d88b08308c0105 - [0:0]
:sha-rh-ea13dde65a77b03a2d29 - [0:0]
:shorewall - [0:0]
:tcpflags - [0:0]
:tun6to4_fwd - [0:0]
:tun6to4_in - [0:0]
:tun6to4_out - [0:0]
-A INPUT -j Ifw
-A INPUT -i enp31s0 -j loc-fw
-A INPUT -i enp1s4 -j enp1s4_in
-A INPUT -i enp1s9 -j enp1s9_in
-A INPUT -i tun6to4 -j tun6to4_in
-A INPUT -i lo -j ACCEPT
-A INPUT -m addrtype --dst-type BROADCAST -j DROP
-A INPUT -m addrtype --dst-type ANYCAST -j DROP
-A INPUT -m addrtype --dst-type MULTICAST -j DROP
-A INPUT -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 --hashlimit-mode srcip --hashlimit-name lograte -j LOG --log-prefix "INPUT REJECT " --log-level 6
-A INPUT -g reject
-A INPUT -s 192.168.0.1/32 -j ACCEPT
-A FORWARD -i enp31s0 -j loc_frwd
-A FORWARD -i enp1s4 -j enp1s4_fwd
-A FORWARD -i enp1s9 -j enp1s9_fwd
-A FORWARD -i tun6to4 -j tun6to4_fwd
-A FORWARD -m addrtype --dst-type BROADCAST -j DROP
-A FORWARD -m addrtype --dst-type ANYCAST -j DROP
-A FORWARD -m addrtype --dst-type MULTICAST -j DROP
-A FORWARD -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 --hashlimit-mode srcip --hashlimit-name lograte -j LOG --log-prefix "FORWARD REJECT " --log-level 6
-A FORWARD -g reject
-A OUTPUT -o enp31s0 -j fw-loc
-A OUTPUT -o enp1s4 -j enp1s4_out
-A OUTPUT -o enp1s9 -j enp1s9_out
-A OUTPUT -o tun6to4 -j tun6to4_out
-A OUTPUT -o lo -j fw-fw
-A OUTPUT -m addrtype --dst-type BROADCAST -j DROP
-A OUTPUT -m addrtype --dst-type ANYCAST -j DROP
-A OUTPUT -m addrtype --dst-type MULTICAST -j DROP
-A OUTPUT -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 --hashlimit-mode srcip --hashlimit-name lograte -j LOG --log-prefix "OUTPUT REJECT " --log-level 6
-A OUTPUT -g reject
-A OUTPUT -d 192.168.0.1/32 -j ACCEPT
-A Ifw -m set --match-set ifw_wl src -j RETURN
-A Ifw -m set --match-set ifw_bl src -j DROP
-A Ifw -m conntrack --ctstate INVALID,NEW -m psd--psd-weight-threshold 10 --psd-delay-threshold 10000 --psd-lo-ports-weight 2 --psd-hi-ports-weight 1  -j IFWLOG--log-prefix "SCAN"
-A enp1s4_fwd -o enp1s4 -g sfilter
-A enp1s4_fwd -m conntrack --ctstate INVALID,NEW,UNTRACKED -j dynamic
-A enp1s4_fwd -p tcp -j tcpflags
-A enp1s4_fwd -j net_frwd
-A enp1s4_in -m conntrack --ctstate INVALID,NEW,UNTRACKED -j dynamic
-A enp1s4_in -p tcp -j tcpflags
-A enp1s4_in -j net-fw
-A enp1s4_out -j fw-net
-A enp1s9_fwd -o enp1s9 -g sfilter
-A enp1s9_fwd -m conntrack --ctstate INVALID,NEW,UNTRACKED -j dynamic
-A enp1s9_fwd -p tcp -j tcpflags
-A enp1s9_fwd -j net_frwd
-A enp1s9_in -m conntrack --ctstate INVALID,NEW,UNTRACKED -j dynamic
-A enp1s9_in -p tcp -j tcpflags
-A enp1s9_in -j net-fw
-A enp1s9_out -j fw-net
-A fw-fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A fw-fw -p tcp -m tcp --dport 3128 -m conntrack --ctorigdstport 80 -j ACCEPT
-A fw-fw -j ACCEPT
-A fw-loc -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A fw-loc -j ACCEPT
-A fw-net -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A fw-net -p tcp -m tcp --dport 80 -m owner --uid-owner 979 -j ACCEPT
-A fw-net -j ACCEPT
-A loc-fw -m conntrack --ctstate INVALID,NEW,UNTRACKED -j dynamic
-A loc-fw -p tcp -j tcpflags
-A loc-fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A loc-fw -p tcp -m tcp --dport 3128 -m conntrack --ctorigdstport 80 -j ACCEPT
-A loc-fw -j ACCEPT
-A loc-net -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A loc-net -j ACCEPT
-A loc_frwd -o enp31s0 -g sfilter
-A loc_frwd -m conntrack --ctstate INVALID,NEW,UNTRACKED -j dynamic
-A loc_frwd -p tcp -j tcpflags
-A loc_frwd -o enp1s4 -j loc-net
-A loc_frwd -o enp1s9 -j loc-net
-A loc_frwd -o tun6to4 -j loc-net
-A logdrop -j DROP
-A logflags -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 --hashlimit-mode srcip --hashlimit-name lograte -j LOG --log-prefix "logflags DROP " --log-level 6 --log-ip-options
-A logflags -j DROP
-A logreject -j reject
-A net-fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A net-fw -m addrtype --dst-type BROADCAST -j DROP
-A net-fw -m addrtype --dst-type ANYCAST -j DROP
-A net-fw -m addrtype --dst-type MULTICAST -j DROP
-A net-fw -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 --hashlimit-mode srcip --hashlimit-name lograte -j LOG --log-prefix "net-fw DROP " --log-level 6
-A net-fw -j DROP
-A net-loc -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A net-loc -m addrtype --dst-type BROADCAST -j DROP
-A net-loc -m addrtype --dst-type ANYCAST -j DROP
-A net-loc -m addrtype --dst-type MULTICAST -j DROP
-A net-loc -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 --hashlimit-mode srcip --hashlimit-name lograte -j LOG --log-prefix "net-loc DROP " --log-level 6
-A net-loc -j DROP
-A net_frwd -o enp31s0 -j net-loc
-A net_frwd -o enp1s4 -j ACCEPT
-A net_frwd -o enp1s9 -j ACCEPT
-A net_frwd -o tun6to4 -j ACCEPT
-A reject -m addrtype --src-type BROADCAST -j DROP
-A reject -s 224.0.0.0/4 -j DROP
-A reject -p igmp -j DROP
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -p udp -j REJECT --reject-with icmp-port-unreachable
-A reject -p icmp -j REJECT --reject-with icmp-host-unreachable
-A reject -j REJECT --reject-with icmp-host-prohibited
-A sfilter -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 10 --hashlimit-mode srcip --hashlimit-name lograte -j LOG --log-prefix "sfilter DROP " --log-level 6
-A sfilter -j DROP
-A shorewall -m recent --set --name %CURRENTTIME --mask 255.255.255.255 --rsource
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g logflags
-A tcpflags -p tcp -m tcp --tcp-flags FIN,PSH,ACK FIN,PSH -g logflags
-A tcpflags -p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g logflags
-A tun6to4_fwd -o tun6to4 -g sfilter
-A tun6to4_fwd -m conntrack --ctstate INVALID,NEW,UNTRACKED -j dynamic
-A tun6to4_fwd -p tcp -j tcpflags
-A tun6to4_fwd -j net_frwd
-A tun6to4_in -m conntrack --ctstate INVALID,NEW,UNTRACKED -j dynamic
-A tun6to4_in -p tcp -j tcpflags
-A tun6to4_in -j net-fw
-A tun6to4_out -j fw-net
COMMIT

Comment 1 Lewis Smith 2022-03-20 20:03:31 CET

Thank you for the report, and sorry for the angst.
There is no way I can check this out.
> The standard iptables look as if untouched by the MCC configuration wizard
looks the root of the problem.

Assigning this to mageiatools, CC'ing DaveH in case he has any helpful observations.

Source RPM: Drakconf 13.27-1mga8 noarch => drakconf 13.27-1mga8 noarch
CC: (none) => davidwhodgins, lewyssmith
Assignee: bugsquad => mageiatools

Comment 2 Dave Hodgins 2022-03-20 20:38:04 CET

None of my systems have more than one network interface, so I have no experience
in this area.

Lewis Smith 2022-03-21 21:14:17 CET

CC: lewyssmith => (none)