From: Jim Laurino <nfcan.x.jimlaur@dfgh.net>
To: netfilter@lists.netfilter.org
Subject: Re: Problems Pinging the Internet w/this script (nfcan: addressed to exclusive sender for this address)
Date: Sat, 11 Sep 2004 21:15:08 -0400 [thread overview]
Message-ID: <20040912011508.GA8425@salty> (raw)
In-Reply-To: <41439912.2090701@juno.com> (from Jesse rv on Sat, Sep 11, 2004 at 20:32:18 -0400)
On 2004.09.11 20:32, Jesse rv wrote:
> Here's a script I'm using to create some tables which will only allow in on
> ports I'm running services. One of the problems I'm havng is that I can't
> ping the Internet with a DNS address from this machine. I've allowed
> everything in the OUTPUT table and can ping the Internet when using a
> straight IP, but when I type in "ping google.com" the machine hangs for a
> few seconds and gives me a server request error. I know it's something with
> my rules because when I flush them all I can ping google.com just fine. Any
> ideas would be greatly appreciated. I'm guessing it's something trivial but
> can't put my finger on it yet.
>
> thanks
........
>
> # Adding Permittable Network/Hosts/Ports to Input Table on Internal
> Interface
>
> # Allowing DNS,FTP,SSH,Webmin,HTTP,SWAT,and Samba to Server
>
> $RULE -A INPUT -i $INSIDEINT --proto icmp --icmp-type any -j ACCEPT
.......
> $RULE -A INPUT -i $INSIDEINT --proto tcp --dport 53 -d $INSIDEIP -j ACCEPT
.......
One thing, at least, is that you have to allow DNS on both tcp and upd.
So you also need a rule like this:
$RULE -A INPUT -i $INSIDEINT --proto udp --dport 53 -d $INSIDEIP -j ACCEPT
HTH
Jim
next prev parent reply other threads:[~2004-09-12 1:15 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-09-12 0:32 Problems Pinging the Internet w/this script Jesse
2004-09-12 1:15 ` Jim Laurino [this message]
2004-09-12 1:24 ` Jason Opperisano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20040912011508.GA8425@salty \
--to=nfcan.x.jimlaur@dfgh.net \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.