|
|||||||||
|
|||||||||
| |||||||||
|
|
|
| |||||||||
 |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
Dev Shed Forums Sponsor:
|
|
Stop making mediocre tutorials.The best tutorials are video! Camtasia Studio makes it easy to create engaging, buzz-building screen videos at any size, in any popular format. Download the free trial!
|
|
#1
April 16th, 2008, 05:11 PM
|
|||
|
|||
|
Some iptables help
I'm trying to make an iptables rule that blocks connections established by an outside source, other than connections made to ports 20-23 and the ftp data port. Here is my rule:
Code:
iptables -A INPUT -p tcp -m state --state NEW --src ! 127.0.0.1 --dst 127.0.0.1 -m multiport --destination-port ! 20:23,ftp-data -j REJECT --reject-with icmp-host-prohibited But it doesn't work, I can still access port 80 from other computers. Also, I am wondering if the ftp-data port will still work if the client is using passive FTP?
|
|
#2
April 17th, 2008, 07:29 AM
|
||||
|
||||
|
I'm not an iptables guru by any means. But what I would do and do with all my machines now is make them restrictive by default. I drop all packets on the INPUT and FORWARD chains by default. Then I specifically allow the ports that I want to open
Code:
IPTABLES=/sbin/iptables # set default policies $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -P OUTPUT ACCEPT # allow any connections from localhost $IPTABLES -A INPUT -i lo -j ACCEPT # allow established connections $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # allow connections on the following ports $IPTABLES -A INPUT -p tcp -m state --state NEW -m tcp --dport 20:23,ftp_data -j ACCEPT
__________________
  Spread Ubuntu (\ /) (O.o) (> <) This is Bunny. Copy Bunny into your signature to help him on his way to world domination. Last edited by compmodder26 : April 18th, 2008 at 08:14 AM. Reason: Forgot to add a rule for established connections
|
|
#3
May 1st, 2008, 05:12 PM
|
||||
|
||||
|
most user friendly distros have some user friendly tool to do the IP tables stuff. It tends to get complex quickly, and if you do it wrong, you can leave serious holes.
ubuntu and most debians have guarddog mandriva has shorewall I would not recommend doing it by hand until you become an old pro
|
|
| Viewing: Dev Shed Forums > Operating Systems > Linux Help > Some iptables help |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
|
 |
|
|
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Simpy
Y! MyWeb
Linear Mode
