Re: I cant flush rules

["Jörg Harmuth" <harmuth@mnemon.de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
Hi,

your port 8000 - and all others - can be accessed, because you allowed
it. First:

iptables -A INPUT -s 195.140.140.100 -j ACCEPT

you accept all connections from this box: Second:

iptables -A INPUT -p tcp --syn -m limit --limit 5/s -j ACCEPT

you allow 5 connections per second from everywhere, including the
internet. This is the second rule and as ACCEPT is a terminating
target, chain traversing stops right here. So your services are all
available to the whole world.

You can remove the second rule or do it more specifically, e.g. with
interfaces or ports like this:

iptables -A INPUT -p tcp -i ethn -m limit ... # if you have at least 2
interfaces

or

iptables -A INPUT -p tcp --dport 8000 -m limit ...

In the last rule you should specify addresses, that may connect to
port 8000. You can also combine it like this:

iptables -A INPUT -p tcp -i ethn --dport 8000 -s SOME_ADDRESS -m limit
....

HTH

Jörg



Rakotomandimby (R12y) Mihamina schrieb:

| Hello, I have one big problem with my iptables 1.2.11 on a Debian
| testing box. Though I explicitely drop, some connections can be
| done. The iptables-save output is also strange.
|
| http://www.etud-orleans.fr/Members/mihamina/divers/rules.txt/file_view
|
|
| And here is the output of iptables-save:
|
http://www.etud-orleans.fr/Members/mihamina/divers/ipt-save.txt/file_view
|
|
| As you see, although I tried to flush, ...
|
| The critical thing is I'm running a test daemon listening on port
| 8000, and it can be accessed though I told to DROP by default...
|
| What did I do wrong ?



- --
- -----------------------------------------------------------------------
mnemon
Jörg Harmuth
Marie-Curie.Str. 1
53359 Rheinbach

Tel.: (+49) 22 26  87 18 12
Fax:  (+49) 22 26 87 18 19
mail: harmuth@mnemon.de
Web:  http://www.mnemon.de
PGP-Key: http://www.mnemon.de/keys/harmuth_mnemon.asc
PGP-Fingerprint: 692E 4476 0838 60F8 99E2  7F5D B7D7 E48E 267B 204F
- -----------------------------------------------------------------------
Diese Mail wurde vor dem Versenden auf Viren und andere schädliche
Software untersucht. Es wurde keine maliziöse Software gefunden.

This Mail was checked for virusses and other malicious software before
sending. No malicious software was detected.
- -----------------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
 
iD8DBQFCLDfqt9fkjiZ7IE8RAvHKAJ9Yr3pag9qVc6bMkaI4+ygYYSBVtACgnT2L
EJ4zynj5SFWXYi9fx4uHVoA=
=OF65
-----END PGP SIGNATURE-----