All of lore.kernel.org
 help / color / mirror / Atom feed
From: mouss <mouss@netoyen.net>
To: netfilter@vger.kernel.org
Subject: Re: iptables block samba or not?
Date: Thu, 24 Jan 2008 22:13:22 +0100	[thread overview]
Message-ID: <4798FF72.2020609@netoyen.net> (raw)
In-Reply-To: <200801242017.m0OKH0lJ011470@indigo.cs.bgu.ac.il>

Eial Czerwacki wrote:
> I've got this too has part of the rules
>
> -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
>   

but not for output. what if your linux box initiates the connection?

Also, as I said before, allow for icmp (echo if you add a stateful 
accept for output icmp's if you don't have the stateful rule).
>
> On Thu 24 Jan 0:00 2008 Dzianis Kahanovich wrote:
>   
>> Eial Czerwacki wrote:
>>
>>     
>>> -A INPUT -p tcp -m state --state NEW --dport 135 -s 132.72.144.0/20 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 139 -s 132.72.144.0/20 -j ACCEPT
>>> -A INPUT -p udp -m state --state NEW --dport 137:138 -s 132.72.144.0/20 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 426 -s 132.72.144.0/20 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 445 -s 132.72.144.0/20 -j ACCEPT
>>>
>>> -A INPUT -p tcp -m state --state NEW --dport 135 -s 192.168.114.0/24 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 139 -s 192.168.114.0/24 -j ACCEPT
>>> -A INPUT -p udp -m state --state NEW --dport 137:138 -s 192.168.114.0/24 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 426 -s 192.168.114.0/24 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 445 -s 192.168.114.0/24 -j ACCEPT
>>>
>>> # up to 5 Bit-torrent connections
>>> -A INPUT -p tcp -m state --state NEW --dport 6881:6886 -j ACCEPT
>>>
>>> #else
>>> -A INPUT -j REJECT --reject-with icmp-port-unreachable
>>>       
>> You ACCEPTing only NEW connection state - initial packets for every session.
>> Remove "-m state -- state NEW".
>>
>>
>> -- 
>> WBR,
>> Denis Kaganovich,  mahatma@eu.by  http://mahatma.bspu.unibel.by
>>
>> -
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>
>>     
>
>
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>   


  reply	other threads:[~2008-01-24 21:13 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-01-21 22:33 iptables block samba or not? Eial Czerwacki
2008-01-22  1:52 ` Leonardo Rodrigues Magalhães
2008-01-23 22:00 ` Dzianis Kahanovich
2008-01-24 20:16   ` mouss
2008-01-24 20:17   ` Eial Czerwacki
2008-01-24 21:13     ` mouss [this message]
2008-01-24 21:37       ` Martijn Lievaart
2008-01-25 10:40       ` Eial Czerwacki
2008-01-25 11:49         ` mouss
2008-01-25 13:35           ` Eial Czerwacki
2008-01-25 13:42             ` mouss
2008-01-25 14:27               ` Eial Czerwacki
2008-01-25 15:15                 ` mouss
2008-01-25 16:02                   ` Eial Czerwacki
2008-01-25 16:13                     ` mouss
2008-01-25 16:53                       ` Eial Czerwacki
2008-01-25 19:02                         ` Martijn Lievaart
2008-01-25 16:04                   ` Steven Ayre

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4798FF72.2020609@netoyen.net \
    --to=mouss@netoyen.net \
    --cc=netfilter@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.