Re: correct net fitler rule

[Ralph Blach <rcblach@gmail.com>]

Ok,

Let me explain more precisely what I am trying to accomplish

I have sshd open on my firewall and it forwards ports to my linux 
server.  My firewall is is a linksys wireless router and does not have
the capability to block networks.



For my local 10.0.0.0/24 network on the interface wlan0, I just want 
traffic to pass
For the the external name servers, I just want traffic to pass

Since I get attached, I want to drop and log from any attaching network.

This happens on a daily bassis, so I am constally updating the list.

What is the best set of rules to accomplish this

How have people on the list sovled this problem. 

Thanks




Mart Frauenlob wrote:
> Ralph Blach wrote:
>> I want to log all drop packets but just pass some packets
>>
>> I wrote these rules.
>> '
>> Will these test of rules allow all packets on the input of wlan allow 
>> packets with source address in the 10.0.0.0/255.255.255.0
>> and drop/log the selected networks>
>>
>> Thanks
>> Chip
>>
>> /sbin/iptables -F
>> /sbin/iptables -N LOGDROP
>> /sbin/iptables -A LOGDROP    -i wlan0  -j LOG --log-level 7
>> /sbin/iptables -A LOGDROP -j DROP
>> /sbin/iptables -A INPUT  -i wlan -s     10.0.0.0/255.255.255.0 -j 
>> RETURN  #return
>> /sbin/iptables -A INPUT  -i wlan -s      24.25.5.148 -j RETURN  
>> /sbin/iptables -A INPUT  -i wlan -s      24.25.5.147 -j RETURN  
>> /sbin/iptables -A INPUT -i wlan0 -s    58.102.198.29/255.255.255.0 -j 
>> LOGDROP  # log and drop
> you should really take more care to get your facts straight, imho. 
> it's not the first time you try to request on that issue...
> you also should read the iptables tutorial:
> http://www.frozentux.net/documents/iptables-tutorial/
>
> still having a hard time to figure out what you want, this is my best 
> guess:
>
>
> #!/bin/bash
>
> ipt=/sbin/iptables
> if_wlan=wlan0
> allow_net=10.0.0.0/24
> allow_hosts="24.25.5.148 24.25.5.147"
>
> # first set INPUT policy to DROP
> $ipt -P INPUT DROP
>
> # allow from allowed network
> $ipt -A INPUT -i $if_wlan -s $allow_net -j ACCEPT
>
> # allow from certain hosts
> for host in ${allow_hosts}; do
>    $ipt -A INPUT -s $host -j ACCEPT
> done
>
> # log what is left, as the policy will drop it afterwards
> $ipt -A INPUT -j LOG --log-level 7 --log-prefix "INPUT_POLICY_DROP: "
>
>
> Regards
>
> Mart
>
> -- 
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html