From: Payal Rathod <payal-iptables@staticky.com>
To: "Vishwanatn T. K." <tkvishy@yahoo.com>
Cc: netfilter@lists.netfilter.org
Subject: Re: FORWARD rules
Date: Fri, 12 Sep 2003 15:39:57 +0530 [thread overview]
Message-ID: <20030912100957.GA3360@linux.local> (raw)
In-Reply-To: <1063260568.26703.1.camel@risingsun.penguindia.com>
On Thu, Sep 11, 2003 at 06:09:29AM +0000, Vishwanatn T. K. wrote:
> > $IPTABLES -A FORWARD -s 125.125.125.0/32 -p tcp -m tcp --dport 110 -j ACCEPT
> > $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> >
> > What more do I add to allow natting as well as a secure FORWARD policy?
> > Is the position of ESTABLISHED rule ok?
> >
>
> You need to add NEW state in the above FORWARD rule for this to work.
>
> $IPTABLES -A FORWARD -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
Just confirming this from all. Please check whether this is ok.
$IPTABLES -I PREROUTING -t nat -p tcp -d 202.x.x.x -j DNAT --to 125.125.125.2
$IPTABLES -A INPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -s 125.125.125.0/32 -p tcp -m tcp --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -s 125.125.125.0/32 -p udp -m tcp --dport 53 -j ACCEPT
$IPTABLES -A FORWARD -s 125.125.125.0/32 -p tcp -m tcp --dport 80 -j ACCEPT
$IPTABLES -A FORWARD -s 125.125.125.0/32 -p tcp -m tcp --dport 110 -j ACCEPT
echo "1" > /proc/sys/net/ipv4/ip_forward
$IPTABLES -P FORWARD ACCEPT
^^^^^^
$IPTABLES -A INPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
Can I now change the ACCEPT statement to DROP without any fear?
Thanks a lot in advance and bye.
With warm regards,
-Payal
--
"Visit GNU/Linux Success Stories"
http://payal.staticky.com
Guest-Book Section Updated.
next prev parent reply other threads:[~2003-09-12 10:09 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-09-10 17:52 FORWARD rules Payal Rathod
2003-09-10 18:44 ` Ramin Dousti
2003-09-11 2:15 ` netfilter
2003-09-10 18:47 ` Vladimir Potapov
2003-09-11 6:09 ` Vishwanatn T. K.
2003-09-12 10:09 ` Payal Rathod [this message]
2003-09-12 10:45 ` Cedric Blancher
2003-09-12 14:36 ` Arnt Karlsen
2003-09-12 14:51 ` Cedric Blancher
2003-09-12 18:14 ` Arnt Karlsen
2003-09-13 2:26 ` Payal Rathod
2003-09-13 6:42 ` Arnt Karlsen
2003-09-15 7:56 ` Cedric Blancher
2003-09-15 16:32 ` Arnt Karlsen
2003-09-15 17:34 ` Cedric Blancher
2003-09-16 4:28 ` Payal Rathod
2003-09-16 23:31 ` Arnt Karlsen
2003-09-12 10:35 ` Cedric Blancher
-- strict thread matches above, loose matches on Subject: below --
2003-09-16 4:28 Payal Rathod
2003-11-28 19:18 Forward rules Alejandro Cabrera Obed
2003-11-28 20:03 ` Jeffrey Laramie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030912100957.GA3360@linux.local \
--to=payal-iptables@staticky.com \
--cc=netfilter@lists.netfilter.org \
--cc=tkvishy@yahoo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.