Re: myfirewall help

[Jason Opperisano <opie@817west.com>]

On Thu, 2005-01-27 at 05:13, varun_saa@vsnl.net wrote:
> Hello,
>       My server is Mandrake 10.1
> eth0 is WAN with static IP connected to 512k DSL
> eth1 is LAN
> 
> I am trying to write iptables rules and I am 
> stuck with some error.
> 
> My iptable file is as follows :
> 
> # Generated by iptables-save v1.2.9 on Thu Oct 21 05:32:36 2004
> *nat
> :OUTPUT ACCEPT [0:0]
> :PREROUTING ACCEPT [0:0]
> :POSTROUTING ACCEPT [0:0]
> -A POSTROUTING -o eth0 -j MASQUERADE
> COMMIT
> # Completed on Thu Oct 21 05:32:36 2004
> # Generated by iptables-save v1.2.9 on Thu Oct 21 05:32:36 2004
> *mangle
> :PREROUTING ACCEPT [32056:3889577]
> :INPUT ACCEPT [32010:3885659]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [31637:4617585]
> :POSTROUTING ACCEPT [31639:4618071]
> COMMIT
> # Completed on Thu Oct 21 05:32:36 2004
> # Generated by iptables-save v1.2.9 on Thu Oct 21 05:32:36 2004
> *filter
> :FORWARD ACCEPT [0:0]
> :INPUT DROP [0:0]
> :OUTPUT ACCEPT [0:0]
> -A INPUT -j ACCEPT
> -A INPUT -s 127.0.0.1 -j ACCEPT
> -A INPUT -p tcp -m tcp -i eth1 -o eth0 --dport 3128 --sport 80 -j ACCEPT
> -A INPUT -p udp -m udp -i eth1 -o eth0 --dport 3128 --sport 80 -j ACCEPT
> COMMIT
> # Completed on Thu Oct 21 05:32:36 2004
> 
> When I am trying to save I get the following error :
> 
> iptables-restore v1.2.9: Can't use -o with INPUT
> 
> Error occurred at line: 25
> Try `iptables-restore -h' or 'iptables-restore --help' for more information.
> 
> Can anybody guide me ?

yeah--you can't use "-o" with INPUT.

if you are under the impression that the traffic you're trying to filter
has both an inbound and outbound interface and that the packet is
FORWARD-ed from one to the other--you should be adding that rule to the
FORWARD chain, not the INPUT chain.

btw--what traffic do you believe has a source port of 80 and a
destination port of 3128?

-j

--
"Oh, people can come up with statistics to prove anything, Kent. 14%
 of people know that."
	--The Simpsons