All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jesse <marshall28@juno.com>
To: netfilter@lists.netfilter.org
Subject: Problems Pinging the Internet w/this script
Date: Sat, 11 Sep 2004 17:32:18 -0700	[thread overview]
Message-ID: <41439912.2090701@juno.com> (raw)

Here's a script I'm using to create some tables which will only allow in 
on ports I'm running services. One of the problems I'm havng is that I 
can't ping the Internet with a DNS address from this machine. I've 
allowed everything in the OUTPUT table and can ping the Internet when 
using a straight IP, but when I type in "ping google.com" the machine 
hangs for a few seconds and gives me a server request error. I know it's 
something with my rules because when I flush them all I can ping 
google.com just fine. Any ideas would be greatly appreciated. I'm 
guessing it's something trivial but can't put my finger on it yet.

thanks

#!/bin/bash
########## Beginning 
###########################################################

# Define Interfaces/Networks

    # Inside/Intranet Interface
      INSIDEIP="192.168.7.55"
      INSIDEINT="eth0"

    # External/Internet Interface   
    # OUTSIDEIP=
    # OUTSIDEINT=

    # LAN Network
      LAN="192.168.7.0/24"

    # Admin Host
      ADMIN="192.168.7.51"

# Define other Variables

    RULE="/usr/sbin/iptables"

# Flushing All rules/chains
  $RULE -A INPUT LOG
  $RULE -A OUTPUT LOG
  $RULE -A FORWARD LOG
  $RULE -P INPUT DROP
  $RULE -P OUTPUT DROP
  $RULE -P FORWARD DROP
  $RULE -F INPUT
  $RULE -F OUTPUT
  $RULE -F FORWARD

# Adding Permittable Network/Hosts/Ports to Input Table on Internal 
Interface

  # Allowing DNS,FTP,SSH,Webmin,HTTP,SWAT,and Samba to Server

  $RULE -A INPUT -i $INSIDEINT --proto icmp --icmp-type any -j ACCEPT
  $RULE -A INPUT -i $INSIDEINT --proto tcp --dport 21 -d $INSIDEIP -j ACCEPT
  $RULE -A INPUT -i $INSIDEINT --proto tcp -s $ADMIN --dport 22 -d 
$INSIDEIP -j ACCEPT
  $RULE -A INPUT -i $INSIDEINT --proto tcp --dport 53 -d $INSIDEIP -j ACCEPT
  $RULE -A INPUT -i $INSIDEINT --proto tcp --dport 80 -d $INSIDEIP -j ACCEPT
  $RULE -A INPUT -i $INSIDEINT --proto tcp --dport 137 -d $INSIDEIP -j 
ACCEPT
  $RULE -A INPUT -i $INSIDEINT --proto tcp --dport 138 -d $INSIDEIP -j 
ACCEPT
  $RULE -A INPUT -i $INSIDEINT --proto tcp --dport 139 -d $INSIDEIP -j 
ACCEPT
  $RULE -A INPUT -i $INSIDEINT --proto tcp --dport 445 -d $INSIDEIP -j 
ACCEPT
  $RULE -A INPUT -i $INSIDEINT --proto tcp -s $ADMIN --dport 901 -d 
$INSIDEIP -j ACCEPT
  $RULE -A INPUT -i $INSIDEINT --proto tcp -s $ADMIN  --dport 10000 -d 
$INSIDEIP -j ACCEPT

# Denying Everything on Local Network

# Adding entry to allow everything originating from Internal Interface out
   
  $RULE -A OUTPUT -j ACCEPT

########## END 
################################################################



             reply	other threads:[~2004-09-12  0:32 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2004-09-12  0:32 Jesse [this message]
2004-09-12  1:15 ` Problems Pinging the Internet w/this script (nfcan: addressed to exclusive sender for this address) Jim Laurino
2004-09-12  1:24 ` Problems Pinging the Internet w/this script Jason Opperisano

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=41439912.2090701@juno.com \
    --to=marshall28@juno.com \
    --cc=netfilter@lists.netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.