From: Jesse <marshall28@juno.com>
To: netfilter@lists.netfilter.org
Subject: Problems Pinging the Internet w/this script
Date: Sat, 11 Sep 2004 17:32:18 -0700 [thread overview]
Message-ID: <41439912.2090701@juno.com> (raw)
Here's a script I'm using to create some tables which will only allow in
on ports I'm running services. One of the problems I'm havng is that I
can't ping the Internet with a DNS address from this machine. I've
allowed everything in the OUTPUT table and can ping the Internet when
using a straight IP, but when I type in "ping google.com" the machine
hangs for a few seconds and gives me a server request error. I know it's
something with my rules because when I flush them all I can ping
google.com just fine. Any ideas would be greatly appreciated. I'm
guessing it's something trivial but can't put my finger on it yet.
thanks
#!/bin/bash
########## Beginning
###########################################################
# Define Interfaces/Networks
# Inside/Intranet Interface
INSIDEIP="192.168.7.55"
INSIDEINT="eth0"
# External/Internet Interface
# OUTSIDEIP=
# OUTSIDEINT=
# LAN Network
LAN="192.168.7.0/24"
# Admin Host
ADMIN="192.168.7.51"
# Define other Variables
RULE="/usr/sbin/iptables"
# Flushing All rules/chains
$RULE -A INPUT LOG
$RULE -A OUTPUT LOG
$RULE -A FORWARD LOG
$RULE -P INPUT DROP
$RULE -P OUTPUT DROP
$RULE -P FORWARD DROP
$RULE -F INPUT
$RULE -F OUTPUT
$RULE -F FORWARD
# Adding Permittable Network/Hosts/Ports to Input Table on Internal
Interface
# Allowing DNS,FTP,SSH,Webmin,HTTP,SWAT,and Samba to Server
$RULE -A INPUT -i $INSIDEINT --proto icmp --icmp-type any -j ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp --dport 21 -d $INSIDEIP -j ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp -s $ADMIN --dport 22 -d
$INSIDEIP -j ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp --dport 53 -d $INSIDEIP -j ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp --dport 80 -d $INSIDEIP -j ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp --dport 137 -d $INSIDEIP -j
ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp --dport 138 -d $INSIDEIP -j
ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp --dport 139 -d $INSIDEIP -j
ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp --dport 445 -d $INSIDEIP -j
ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp -s $ADMIN --dport 901 -d
$INSIDEIP -j ACCEPT
$RULE -A INPUT -i $INSIDEINT --proto tcp -s $ADMIN --dport 10000 -d
$INSIDEIP -j ACCEPT
# Denying Everything on Local Network
# Adding entry to allow everything originating from Internal Interface out
$RULE -A OUTPUT -j ACCEPT
########## END
################################################################
next reply other threads:[~2004-09-12 0:32 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-09-12 0:32 Jesse [this message]
2004-09-12 1:15 ` Problems Pinging the Internet w/this script (nfcan: addressed to exclusive sender for this address) Jim Laurino
2004-09-12 1:24 ` Problems Pinging the Internet w/this script Jason Opperisano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=41439912.2090701@juno.com \
--to=marshall28@juno.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.