From: Mail Lists <lists@sapience.com>
To: netfilter@lists.netfilter.org
Subject: Re: subnet problem
Date: Sun, 18 Jul 2004 18:10:08 -0400 [thread overview]
Message-ID: <20040718221008.GB7576@sapience.com> (raw)
In-Reply-To: <200407182202.20404.Antony@Soft-Solutions.co.uk>
Right - thanks for any insights - more details below.
On Sun, Jul 18, 2004 at 10:02:20PM +0100, Antony Stone wrote:
> On Sunday 18 July 2004 9:50 pm, Mail Lists wrote:
>
> > cRES_LDROP all -- 172.16.0.0/12 0.0.0.0/0
> > which I would expect to block 172.16 to 172.31.
> > ... blocked on 172.139.140.122
> > ...
> Please post your ruleset so we can see everything relating to cRES_LDROP.
>
Hi:
More details - firewall generated by a script - this is the
what the script actually runs ... I've removed some (hopefully)
not relevant bits and heres the remainder of script output.
If its easier I'm happy to post the script itself.
#Starting iptables firewall ...
# Initializing Iptables Firewall ...
# ** Entering Test mode - nothing is actually run now
iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X # Remove any existing user-defined chains.
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# User defined Chains ...
# [ ... delete non-relevant stuff ]
iptables --new cRES_LDROP
iptables -F cRES_LDROP
iptables -A cRES_LDROP -j LOG --log-level info --log-prefix [FW Drop-Res]
iptables -A cRES_LDROP -j DROP
# [ ... Drop self ips on outside i/f, accept local and so on ]
# [ ... Closed outbound Ports ..., nfs, X11, IRC, MSFT, etc ]
# [ ... NAT - whats allowed - the ususal established related etc ]
# [ ... Local traffic allowed ... ]
# Drop reserved, broadcast rfc 1918 etc
iptables -A INPUT -d 0.0.0.0 -i eth1 -j cRES_LDROP
iptables -A FORWARD -d 0.0.0.0 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -s 0.0.0.0 -o eth1 -j cRES_LDROP
iptables -A FORWARD -s 0.0.0.0 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 10.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 10.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 10.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 10.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 172.16.0.0/12 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 172.16.0.0/12 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 172.16.0.0/12 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 172.16.0.0/12 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 224.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 224.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 224.0.0.0/4 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 224.0.0.0/4 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 255.255.255.255 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 255.255.255.255 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 255.255.255.255 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 255.255.255.255 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 1.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 1.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 1.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 1.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 2.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 2.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 2.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 2.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 5.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 5.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 5.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 5.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 7.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 7.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 7.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 7.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 23.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 23.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 23.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 23.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 27.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 27.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 27.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 27.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 31.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 31.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 31.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 31.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 36.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 36.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 36.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 36.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 37.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 37.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 37.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 37.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 39.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 39.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 39.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 39.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 41.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 41.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 41.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 41.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 42.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 42.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 42.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 42.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 71.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 71.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 71.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 71.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 72.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 72.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 72.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 72.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 73.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 73.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 73.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 73.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 74.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 74.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 74.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 74.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 75.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 75.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 75.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 75.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 76.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 76.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 76.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 76.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 77.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 77.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 77.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 77.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 78.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 78.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 78.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 78.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 79.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 79.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 79.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 79.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 89.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 89.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 89.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 89.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 90.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 90.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 90.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 90.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 91.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 91.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 91.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 91.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 92.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 92.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 92.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 92.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 93.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 93.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 93.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 93.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 94.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 94.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 94.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 94.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 95.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 95.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 95.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 95.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 96.0.0.0/3 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 96.0.0.0/3 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 96.0.0.0/3 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 96.0.0.0/3 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 173.0.0.0/5 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 173.0.0.0/5 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 173.0.0.0/5 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 173.0.0.0/5 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 181.0.0.0/6 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 181.0.0.0/6 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 181.0.0.0/6 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 181.0.0.0/6 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 185.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 185.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 185.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 185.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 187.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 187.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 187.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 187.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 189.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 189.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 189.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 189.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 197.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 197.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 197.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 197.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 223.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 223.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 223.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 223.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 224.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 224.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 224.0.0.0/4 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 224.0.0.0/4 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 240.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 240.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 240.0.0.0/4 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 240.0.0.0/4 -o eth1 -j cRES_LDROP
# [... Allow Local SERVER offerings (smtp, http, etc) ]
# [... Any services which are forwarded ... ]
# [... Allow some ICMP ... ]
iptables -A INPUT -i eth1 -j cLDROP
iptables -A FORWARD -i eth1 -j cLDROP
# FW script done
next prev parent reply other threads:[~2004-07-18 22:10 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-07-18 20:50 subnet problem Mail Lists
2004-07-18 21:02 ` Antony Stone
2004-07-18 22:10 ` Mail Lists [this message]
2004-07-19 9:12 ` Antony Stone
2004-07-20 3:15 ` Mail Lists
2004-07-21 23:46 ` Mail Lists
2004-07-19 10:52 ` John A. Sullivan III
2004-07-20 3:17 ` Mail Lists
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20040718221008.GB7576@sapience.com \
--to=lists@sapience.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.