From: Rowan Reid <rreid@studio3arc.com>
To: 'Antony Stone' <Antony@Soft-Solutions.co.uk>,
netfilter@lists.netfilter.org
Subject: RE: Internal ip exiting network on firewall external nic despight rule
Date: Fri, 20 Sep 2002 14:58:52 -0700 [thread overview]
Message-ID: <000001c260f0$e8e7fb50$0801a8c0@s3ac> (raw)
In-Reply-To: <20020920213602.TMJS295.mta06-svc.ntlworld.com@there>
> >
> > I should have mentioned the internal machine is
> masquaraded. Therefore
> > It should go to the input chain no ?
>
> The INPUT chain is for packets addressed to the firewall itself.
>
> The FORWARD chain is for packets going through the firewall
> to some other
> machine.
>
> Destination NAT is performed in the PREROUTING chain, which
> comes before
> either INPUT or FORWARD, therefore it is the "real" destination which
> determines whether a packet traverses the INPUT or the FORWARD chain.
>
Just when I thought I understood. So returning masqaraded traffic hits
the input rule set no ? Then gets routed through POSTROUTING is it then
routed to the forward ruleset, or is it just sent out. What I'm
realizing is to stop internal machines from accessing the external
interface I need to put drop rule for all insternal traffic on the
FORWARD chain such as below ?
$IPTABLES -A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j drop-and-log-it
$IPTABLES -A FORWARD -i $EXTIF -s $INTNET -d $UNIVERSE -j
drop-and-log-it
Then figure out why exactly my local net machines are accessing my
external IP to exit the net. This confuses me because all these machines
are setup with the gateway being the internal ip
(192.168.1.1/255.255.255.0) as the gateway so these machines shouldn't
even know my external ip/interface exists.
next prev parent reply other threads:[~2002-09-20 21:58 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-09-20 18:37 Internal ip exiting network on firewall external nic despight rule Rowan Reid
2002-09-20 19:05 ` Antony Stone
2002-09-20 20:59 ` Rowan Reid
2002-09-20 21:36 ` Antony Stone
2002-09-20 21:58 ` Rowan Reid [this message]
2002-09-20 22:43 ` Antony Stone
2002-09-20 23:10 ` Rowan Reid
2002-09-20 23:32 ` Antony Stone
2002-09-20 19:13 ` Tom Eastep
2002-09-20 19:11 ` Rowan Reid
2002-09-20 19:34 ` Antony Stone
2002-09-20 19:40 ` Tom Eastep
2002-09-20 21:24 ` Rowan Reid
2002-09-20 21:54 ` Antony Stone
2002-09-20 22:26 ` Rowan Reid
2002-09-20 23:01 ` Antony Stone
2002-09-20 23:13 ` Rowan Reid
2002-09-20 23:37 ` Antony Stone
2002-09-21 1:00 ` Tom Eastep
2002-09-21 13:01 ` Anders Fugmann
2002-09-20 19:36 ` Tom Eastep
2002-09-20 19:53 ` Alistair Tonner
[not found] <000d01c260e8$df710380$0801a8c0@s3ac>
2002-09-20 21:44 ` Antony Stone
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='000001c260f0$e8e7fb50$0801a8c0@s3ac' \
--to=rreid@studio3arc.com \
--cc=Antony@Soft-Solutions.co.uk \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox