forth in comp.os.linux.misc
Quote:> Yah thats rite. Do you have Lokkit automatically create firewall for
> you, if that is the case find out the input chain it uses and add the
> following.
> iptables -L should list all the rules.
I have my rules written in a separate script :
IPTABLES=/sbin/iptables
INSMOD=/sbin/insmod
EXTIF="ppp0"
INTIF="eth0"
echo " External Interface: $EXTIF"
echo " Internal Interface: $INTIF"
LANRANGE="192.168.0.1/24"
TARGETIP="192.168.0.2"
TARGETHTTPPORT="80"
TARGETSSHPORT="22"
TARGETSFTPPORT="115"
TARGETNNTPPORT="119"
TARGETIMAPPORT="143"
TARGETSMTPPORT="25"
TARGETFTPPORT="21"
TARGETTELNETPORT="23"
REJECTPORTS="113"
/sbin/depmod -a
$INSMOD ip_tables
$INSMOD ip_conntrack
$INSMOD ip_conntrack_ftp
$INSMOD ip_conntrack_irc
$INSMOD iptable_nat
$INSMOD ip_nat_ftp
$INSMOD ipt_MASQUERADE
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t nat -A POSTROUTING -d ! $LANRANGE -j MASQUERADE
$IPTABLES -A FORWARD -s $LANRANGE -j ACCEPT
$IPTABLES -A FORWARD -d $LANRANGE -j ACCEPT
$IPTABLES -A FORWARD -s ! $LANRANGE -j DROP
$IPTABLES -A INPUT --protocol udp --source-port $REJECTPORTS -j DROP
$IPTABLES -A INPUT --protocol udp --destination $REJECTPORTS -j DROP
echo "1" > /proc/sys/net/ipv4/ip_forward
$IPTABLES -A PREROUTING -t nat -p tcp -i $EXTIF --dport $TARGETHTTPPORT -j
DNAT --to $TARGETIP:$TARGETHTTPPORT
$IPTABLES -A PREROUTING -t nat -p tcp -i $EXTIF --dport $TARGETSSHPORT -j
DNAT --to $TARGETIP:$TARGETSSHPORT
$IPTABLES -A PREROUTING -t nat -p tcp -i $EXTIF --dport $TARGETSFTPPORT -j
DNAT --to $TARGETIP:$TARGETSFTPPORT
$IPTABLES -A PREROUTING -t nat -p tcp -i $EXTIF --dport $TARGETNNTPPORT -j
DNAT --to $TARGETIP:$TARGETNNTPPORT
$IPTABLES -A PREROUTING -t nat -p tcp -i $EXTIF --dport $TARGETIMAPPORT -j
DNAT --to $TARGETIP:$TARGETIMAPPORT
$IPTABLES -A PREROUTING -t nat -p tcp -i $EXTIF --dport $TARGETSMTPPORT -j
DNAT --to $TARGETIP:$TARGETSMTPPORT
$IPTABLES -A PREROUTING -t nat -p tcp -i $EXTIF --dport $TARGETFTPPORT -j
DNAT --to $TARGETIP:$TARGETFTPPORT
$IPTABLES -A PREROUTING -t nat -p tcp -i $EXTIF --dport $TARGETTELNETPORT -j
DNAT --to $TARGETIP:$TARGETTELNETPORT
The above script is executed in rc.local, once my server boots.
Why should subsequent attempts to permit ports be rejected ?
lokkit does not provide the level of control I need for IP Masquerade etc.
Yes, it is also apparently used by my RH installation, but I have no idea
when.
Quote:> The input rule you have given seems to be rite, but my guess is that it
> gets overwritten by the other rules.
How so ?
by