From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Robert Jenkins" Subject: RE: diald slow to be useful... Date: Thu, 30 May 2002 14:51:43 +0100 Sender: linux-diald-owner@vger.kernel.org Message-ID: <000001c207e1$228d8050$e239832c@jrws2> References: <3CF61115.90700@purplet.demon.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3CF61115.90700@purplet.demon.co.uk> List-Id: Content-Type: text/plain; charset="us-ascii" To: 'Mike Jagdis' Cc: linux-diald@vger.kernel.org Hi Mike, This is basically what I'm using for the firewall (I've changed my Ip addresses & trimmed out some port forwards & other junk). It's based on a template I found on the internet, but I can't remember where... Using iptables makes it a fraction of the size of my old ipchains firewall! Regards, Robert Jenkins. mailto:raj@jrw.co.uk #!/bin/bash # #Point this to your copy of ip_tables IPT="/sbin/iptables" #Load the modules. (Moved to rc.local) #modprobe ip_tables #echo 1 > /proc/sys/net/ipv4/ip_forward #Flush old rules, delete the firewall chain if it exists $IPT -F $IPT -F -t nat $IPT -X firewall #Setup Masquerading. Change the IP to your internal network and uncomment #this in order to enable it. $IPT -A POSTROUTING -t nat -s 192.168.0.0/24 -j MASQUERADE $IPT -P FORWARD ACCEPT #Set up the firewall chain $IPT -N firewall $IPT -A firewall -j LOG --log-level info --log-prefix "Firewall:" $IPT -A firewall -j DROP #Accept ourselves $IPT -A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT #If you're using IP Masquerading, change this IP to whatever your internl #IP addres is and uncomment it $IPT -A INPUT -s 192.168.0.0/24 -d 0/0 -j ACCEPT #Accept DNS $IPT -A INPUT -p udp --source-port 53 -j ACCEPT #And NTP $IPT -A INPUT -p udp --source-port 123 --destination-port 123 -j ACCEPT $IPT -A INPUT -p tcp --source-port 123 --destination-port 123 -j ACCEPT #Allow ftp to send data back and forth. $IPT -A INPUT -p tcp ! --syn --source-port 20 --destination-port 1024:65535 -j ACCEPT #Accept SSH. #$IPT -A INPUT -p tcp --destination-port 22 -j ACCEPT #Send everything else to the firewall. $IPT -A INPUT -p icmp -j firewall $IPT -A INPUT -p tcp --syn -j firewall $IPT -A INPUT -p udp -j firewall # # End. #