Re: blocking ports outbound

[Joseph Sirucka <jsirucka@connectingyou.com.au>]

[-- Attachment #1: Type: text/plain, Size: 2243 bytes --]

Hi

Maybe I got my question wrong.

I'm very new to iptables coming from a ipfilter background. In ipfilter 
I just state block all in and then open the ports I wish to allow 
through. Is there something similiar in iptables.

I wish to stop the outside world from seeing the ports upon the 
firewall/proxy and beyond into my internal network.

My problem is I cannot join certain irc servers due to there open proxy 
policy.

So really how do I block all ports internally while allowing a something 
like a connection internally to go outbound and recieve the packets back.

My current iptables config is

> #!/bin/bash
> /bin/echo "Firewall rules starting up now..."
> /sbin/modprobe ipt_MASQUERADE
> /usr/local/sbin/iptables -F
> /usr/local/sbin/iptables -t nat
> /usr/local/sbin/iptables -t mangle -F
> /usr/local/sbin/iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
> /bin/echo 1 > /proc/sys/net/ipv4/ip_forward
> /usr/local/sbin/iptables -A OUTPUT --dport 3128 -j DENY
> /usr/local/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 
> 80 -j REDIRECT --to-port 3128
> /usr/local/sbin/iptables -t nat -A PREROUTING -i eth2 -p tcp --dport 
> 80 -j REDIRECT --to-port 3128

Pl,ease pick apart my rules and tell me what I'm doing wrong.

As I stated, I'm a complete newbie to iptables.

My system is a firewall/proxy unit with a adsl connection running pppoe 
to the outside world. I recieve a permanent ip upon te ppp0 interface.

I hope I make some sense.

thanks

Joseph

Rob Sterenborg wrote:

>>I would like to know the rule to block ports outbound.
>>
>>I am trying to block port 3128 my squid/proxy port.
>>    
>>
>
>Soo, ehm, you want to prevent outbound packets from squid ?
>If you don't want that squid is sending packets, then why start squid at
>all.
>
>Well, if that's what you really want to :
>iptables -A OUTPUT -p tcp --sport 3128 -j REJECT --reject-with tcp-reset
>or simply
>iptables -A OUTPUT -p tcp --sport 3128 -j DROP
>
>
>Or don't you want users from the outside (internet) to connect ?
>
># Drops everything by default
>iptables -P INPUT DROP
>
># Accepts anything coming in on your LAN interface,
># but you may want something more secure.
>iptables -A INPUT -i <if_lan> -j ACCEPT
>
>
>Rob
>
>
>  
>


[-- Attachment #2: Type: text/html, Size: 2778 bytes --]