From: Greg Cope <gregcope@gmail.com>
To: netfilter@lists.netfilter.org
Subject: Re: Help debugging iptables firewall....
Date: Tue, 25 Jan 2005 18:18:05 +0000 [thread overview]
Message-ID: <c0e9781f050125101836a66c7f@mail.gmail.com> (raw)
In-Reply-To: <27594E8BA9D5CA458F5EF87D88B6B48F01991E@pxtvjoexd01.pxt.primeexalia.com>
Removing my original rule I get logged:
Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
SYN URGP=0
Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] after: IN=eth1
OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
SYN URGP=0
Jan 25 18:13:19 gateway kernel: FORWARD DENY: IN=eth1 OUT=eth2
SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63
ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00 SYN
URGP=0
Greg
On Tue, 25 Jan 2005 10:09:43 -0800, Gary W. Smith <gary@primeexalia.com> wrote:
> Crap, I had a typo. It should have been -i, not -o for the lan
> interface
>
> $IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT
>
> Try that and let us know.
>
> Gary Wayne Smith
>
>
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> Sent: Tuesday, January 25, 2005 9:59 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: Help debugging iptables firewall....
>
> I think we are getting there:
>
> The one you suggested gives an error:
>
> Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not allowed
>
> Looking at tcpdump on a few machines it looks like the packets are
> getting through - but nothing gets sent:
>
> 17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S
> 965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024
> 0,nop,wscale 0> (DF) [tos 0x10]
>
> And then nothing else - sadly I am not a tcpdump expert.....
>
> Any clues? I am at a loss as to why this was working and now it does
> not.....
>
> Greg
>
>
next prev parent reply other threads:[~2005-01-25 18:18 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-01-25 18:09 Help debugging iptables firewall Gary W. Smith
2005-01-25 18:18 ` Greg Cope [this message]
-- strict thread matches above, loose matches on Subject: below --
2005-01-25 22:11 Gary W. Smith
2005-01-26 7:19 ` Greg Cope
2005-01-25 20:00 Gary W. Smith
2005-01-25 22:06 ` Greg Cope
2005-01-25 18:31 Gary W. Smith
2005-01-25 19:08 ` Greg Cope
2005-01-25 17:46 Gary W. Smith
2005-01-25 17:59 ` Greg Cope
2005-01-25 17:13 Gary W. Smith
2005-01-25 17:24 ` Greg Cope
2005-01-25 16:53 Greg Cope
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c0e9781f050125101836a66c7f@mail.gmail.com \
--to=gregcope@gmail.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.