Re: I cant flush rules

["Rakotomandimby (R12y) Mihamina" <mihamina@mail.rktmb.org>]

On Mon, 2005-03-07 at 12:15 +0100, Jörg Harmuth wrote:

> Hi,

Hi

> your port 8000 - and all others - can be accessed, because you allowed
> it. First:
> 
> iptables -A INPUT -s 195.140.140.100 -j ACCEPT

I need to allow that machine.

> you accept all connections from this box: Second:
> 
> iptables -A INPUT -p tcp --syn -m limit --limit 5/s -j ACCEPT
> you allow 5 connections per second from everywhere, including the
> internet. This is the second rule and as ACCEPT is a terminating
> target, chain traversing stops right here. So your services are all
> available to the whole world.


Oooooooh yes! that was my mistake.

> You can remove the second rule or do it more specifically, e.g. with
> interfaces or ports like this:

I choose to remove it.
> In the last rule you should specify addresses, that may connect to
> port 8000. You can also combine it like this:


> iptables -A INPUT -p tcp -i ethn --dport 8000 -s SOME_ADDRESS -m limit

No. It's an Icecast server behind (Web Radio, broadcasting music). All
the world needs to acces from that port.

It really helped. Thank you.
-- 
ASPO Infogérance       http://aspo.rktmb.org/activites/infogerance
Unofficial FAQ fcolc   http://faq.fcolc.eu.org/
LUG sur Orléans et alentours (France).
Tél : 02 34 08 26 04 / 06 33 26 13 14