From: mouss <mouss@netoyen.net>
To: netfilter@vger.kernel.org
Subject: Re: iptables block samba or not?
Date: Thu, 24 Jan 2008 22:13:22 +0100 [thread overview]
Message-ID: <4798FF72.2020609@netoyen.net> (raw)
In-Reply-To: <200801242017.m0OKH0lJ011470@indigo.cs.bgu.ac.il>
Eial Czerwacki wrote:
> I've got this too has part of the rules
>
> -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
>
but not for output. what if your linux box initiates the connection?
Also, as I said before, allow for icmp (echo if you add a stateful
accept for output icmp's if you don't have the stateful rule).
>
> On Thu 24 Jan 0:00 2008 Dzianis Kahanovich wrote:
>
>> Eial Czerwacki wrote:
>>
>>
>>> -A INPUT -p tcp -m state --state NEW --dport 135 -s 132.72.144.0/20 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 139 -s 132.72.144.0/20 -j ACCEPT
>>> -A INPUT -p udp -m state --state NEW --dport 137:138 -s 132.72.144.0/20 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 426 -s 132.72.144.0/20 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 445 -s 132.72.144.0/20 -j ACCEPT
>>>
>>> -A INPUT -p tcp -m state --state NEW --dport 135 -s 192.168.114.0/24 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 139 -s 192.168.114.0/24 -j ACCEPT
>>> -A INPUT -p udp -m state --state NEW --dport 137:138 -s 192.168.114.0/24 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 426 -s 192.168.114.0/24 -j ACCEPT
>>> -A INPUT -p tcp -m state --state NEW --dport 445 -s 192.168.114.0/24 -j ACCEPT
>>>
>>> # up to 5 Bit-torrent connections
>>> -A INPUT -p tcp -m state --state NEW --dport 6881:6886 -j ACCEPT
>>>
>>> #else
>>> -A INPUT -j REJECT --reject-with icmp-port-unreachable
>>>
>> You ACCEPTing only NEW connection state - initial packets for every session.
>> Remove "-m state -- state NEW".
>>
>>
>> --
>> WBR,
>> Denis Kaganovich, mahatma@eu.by http://mahatma.bspu.unibel.by
>>
>> -
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at http://vger.kernel.org/majordomo-info.html
>>
>>
>
>
>
>
> -
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
next prev parent reply other threads:[~2008-01-24 21:13 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-01-21 22:33 iptables block samba or not? Eial Czerwacki
2008-01-22 1:52 ` Leonardo Rodrigues Magalhães
2008-01-23 22:00 ` Dzianis Kahanovich
2008-01-24 20:16 ` mouss
2008-01-24 20:17 ` Eial Czerwacki
2008-01-24 21:13 ` mouss [this message]
2008-01-24 21:37 ` Martijn Lievaart
2008-01-25 10:40 ` Eial Czerwacki
2008-01-25 11:49 ` mouss
2008-01-25 13:35 ` Eial Czerwacki
2008-01-25 13:42 ` mouss
2008-01-25 14:27 ` Eial Czerwacki
2008-01-25 15:15 ` mouss
2008-01-25 16:02 ` Eial Czerwacki
2008-01-25 16:13 ` mouss
2008-01-25 16:53 ` Eial Czerwacki
2008-01-25 19:02 ` Martijn Lievaart
2008-01-25 16:04 ` Steven Ayre
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4798FF72.2020609@netoyen.net \
--to=mouss@netoyen.net \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.