From: Payal Rathod <payal-iptables@staticky.com>
To: netfilter@lists.netfilter.org
Subject: FORWARD rules
Date: Wed, 10 Sep 2003 23:22:53 +0530 [thread overview]
Message-ID: <20030910175253.GA2752@linux.local> (raw)
Hi,
I had kept the default policy of FORWARD as drop.
Now, I wanted to see an internal machine from internet. So, I used
DNAT as,
iptables -A PREROUTING -t nat -d <ext ip> -j DNAT --to <int ip>
It didn't work. When I set the default FORWARD policy to ACCEPT it
worked.
What is a better approach? I want to have a default DROP in FORWARD
chain. My FORWARD chain looked like this,
$IPTABLES -A FORWARD -s 125.125.125.0/32 -p tcp -m tcp --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -s 125.125.125.0/32 -p udp -m tcp --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -s 125.125.125.0/32 -p tcp -m tcp --dport 80 -j ACCEPT
$IPTABLES -A FORWARD -s 125.125.125.0/32 -p tcp -m tcp --dport 110 -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
What more do I add to allow natting as well as a secure FORWARD policy?
Is the position of ESTABLISHED rule ok?
Thanks a lot for the help in advance and waiting eagerly for the mails.
With warm regards,
-Payal
--
"Visit GNU/Linux Success Stories"
http://payal.staticky.com
Guest-Book Section Updated.
next reply other threads:[~2003-09-10 17:52 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-09-10 17:52 Payal Rathod [this message]
2003-09-10 18:44 ` FORWARD rules Ramin Dousti
2003-09-11 2:15 ` netfilter
2003-09-10 18:47 ` Vladimir Potapov
2003-09-11 6:09 ` Vishwanatn T. K.
2003-09-12 10:09 ` Payal Rathod
2003-09-12 10:45 ` Cedric Blancher
2003-09-12 14:36 ` Arnt Karlsen
2003-09-12 14:51 ` Cedric Blancher
2003-09-12 18:14 ` Arnt Karlsen
2003-09-13 2:26 ` Payal Rathod
2003-09-13 6:42 ` Arnt Karlsen
2003-09-15 7:56 ` Cedric Blancher
2003-09-15 16:32 ` Arnt Karlsen
2003-09-15 17:34 ` Cedric Blancher
2003-09-16 4:28 ` Payal Rathod
2003-09-16 23:31 ` Arnt Karlsen
2003-09-12 10:35 ` Cedric Blancher
-- strict thread matches above, loose matches on Subject: below --
2003-09-16 4:28 Payal Rathod
2003-11-28 19:18 Forward rules Alejandro Cabrera Obed
2003-11-28 20:03 ` Jeffrey Laramie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030910175253.GA2752@linux.local \
--to=payal-iptables@staticky.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.