RE: Hosts.Deny Question??

RE: Hosts.Deny Question??

[Ferry van Steen]

Ofcourse you could use any file to put configuration options in it but I
advise strongly against putting firewall rules into
/etc/hosts.(allow/deny) as they are for TCP Wrappers and NOT for
firewalling. Firewall rules should go in /etc/rc.d/rc.firewall or
/etc/init.d/rc.firewall or whatever your favorite distro uses as start
up scripts.

Concerning the firewall rules itself, Antony Stone already answered
those. 

Kind regards,

Ferry van Steen



-----Original Message-----
From: Niall Murphy [mailto:nmurphy@viking.ie] 
Sent: donderdag 12 september 2002 14:49
To: 'Ferry van Steen'
Subject: RE: Hosts.Deny Question??

thats what i mean sorry!! i have a red hat 7.2 firewall in front of a nt
email and proxy server etc.
but i want to use host.deny in the firewall rules to block certain ip
and
email addresses

-----Original Message-----
From: Ferry van Steen [mailto:ferry.van.steen@infopart.nl]
Sent: Thursday, September 12, 2002 1:48 PM
To: 'Niall Murphy'
Cc: netfilter@lists.netfilter.org
Subject: RE: Hosts.Deny Question??


1. Wrong mailinglist
2. Not enough info (what SMTP server are you running)
3. I don't know of any SMTP server that supports TCP Wrappers (which is
hosts.deny/allow)
4. Only option probably is running your smtp server from inetd and
running it in TCP Wrappers there
5. Why on earth would you want to block IP's to your mailserver
6. If you don't know how to turn off relaying go to your favorite SMTP
server's mailing list
7. You could always deny those IP's by firewall rules, which is, what
this mailinglist is all about.
8. Well uh, I'm out :-)

Kind regards,

Ferry van Steen
InfoPart Automatisering B.V.
Beeksestraat 24
4841 GC Prinsenbeek
The Netherlands
Phone: +31 (0)76 - 5 44 04 11
Fax: +31 (0)76 - 5 41 83 51
Mobile: +31 (0)6 - 28 46 47 45
E-Mail (business): ferry.van.steen@infopart.nl
E-Mail (private): freaky@bananateam.nl
MSN Messenger: freaky@freaky2000.dyndns.org
ICQ (UIN (seldom used)): 191458

Insert your favorite yada yada yada my opinions don't (necessarily)
represent the ones of my company nor do my actions yada yada yada
disclaimer.

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Niall Murphy
Sent: donderdag 12 september 2002 13:38
To: netfilter@lists.netfilter.org
Subject: Hosts.Deny Question??

Hi All,
i want to use hosts.deny to block emails and ip's to my email
server..sounds
easy but i cant seem to get it to work
do i just need to add the emails or ip's to the host.deny and then add a
rule to my script
could some one please explain and maybe give me the rule
thanx in advance
niall

RE: Hosts.Deny Question??

[Ferry van Steen]

Oh wait, you want the mail to go to your NT machine behind the
firewall... How many IP addresses does your internet connection have?

Assuming 1....
a.b.c.d: hosts you want to block
e.f.g.h: NT Server (Internal IP)
w.x.y.z: Your internet IP
eth0: your local netcard interface
ppp0: ur inet connection interface


# DNAT SMTP Traffic to NT machine
iptables -t nat -A PREROUTING -s 0/0 -i ppp0 -d w.x.y.z -p tcp --dport
25 -j DNAT --to-destination e.f.g.h:25

# SNAT IP of NT machine to w.x.y.z (ofcourse we're assuming you have
static IP as you run mailserver) we need to NAT to make connections
possible (assuming you have 1 IP)
iptables -t nat -A POSTROUTING -s e.f.g.h -d 0/0 -o ppp0 -p tcp --sport
25 -j SNAT --to-source w.x.y.z
# This is very strict and only allows SMTP.. or strictly speaking source
port 25

# We need to setup the forward chain so you can allow/deny traffic

# Repeat this first line for every ip/subnet you want to block
iptables -A FORWARD -s a.b.c.d -i ppp0 -d e.f.g.h -o eth0 -p tcp --dport
25 -j DROP
# This one allows all others
iptables -A FORWARD -s 0/0 -i ppp0 -d e.f.g.h -o eth0 -p tcp --dport 25
-j ACCEPT

That should be it, more or less. Not taking other things into
consideration, like NAT'ing the rest of your network, stateful
firewalling and chain policies for example.

Kind regards,

Ferry van Steen
InfoPart Automatisering B.V.
Beeksestraat 24
4841 GC Prinsenbeek
The Netherlands
Phone: +31 (0)76 - 5 44 04 11
Fax: +31 (0)76 - 5 41 83 51
Mobile: +31 (0)6 - 28 46 47 45
E-Mail (business): ferry.van.steen@infopart.nl
E-Mail (private): freaky@bananateam.nl
MSN Messenger: freaky@freaky2000.dyndns.org
ICQ (UIN (seldom used)): 191458



-----Original Message-----
From: Niall Murphy [mailto:nmurphy@viking.ie] 
Sent: donderdag 12 september 2002 14:49
To: 'Ferry van Steen'
Subject: RE: Hosts.Deny Question??

thats what i mean sorry!! i have a red hat 7.2 firewall in front of a nt
email and proxy server etc.
but i want to use host.deny in the firewall rules to block certain ip
and
email addresses

-----Original Message-----
From: Ferry van Steen [mailto:ferry.van.steen@infopart.nl]
Sent: Thursday, September 12, 2002 1:48 PM
To: 'Niall Murphy'
Cc: netfilter@lists.netfilter.org
Subject: RE: Hosts.Deny Question??


1. Wrong mailinglist
2. Not enough info (what SMTP server are you running)
3. I don't know of any SMTP server that supports TCP Wrappers (which is
hosts.deny/allow)
4. Only option probably is running your smtp server from inetd and
running it in TCP Wrappers there
5. Why on earth would you want to block IP's to your mailserver
6. If you don't know how to turn off relaying go to your favorite SMTP
server's mailing list
7. You could always deny those IP's by firewall rules, which is, what
this mailinglist is all about.
8. Well uh, I'm out :-)

Kind regards,

Ferry van Steen
InfoPart Automatisering B.V.
Beeksestraat 24
4841 GC Prinsenbeek
The Netherlands
Phone: +31 (0)76 - 5 44 04 11
Fax: +31 (0)76 - 5 41 83 51
Mobile: +31 (0)6 - 28 46 47 45
E-Mail (business): ferry.van.steen@infopart.nl
E-Mail (private): freaky@bananateam.nl
MSN Messenger: freaky@freaky2000.dyndns.org
ICQ (UIN (seldom used)): 191458

Insert your favorite yada yada yada my opinions don't (necessarily)
represent the ones of my company nor do my actions yada yada yada
disclaimer.

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Niall Murphy
Sent: donderdag 12 september 2002 13:38
To: netfilter@lists.netfilter.org
Subject: Hosts.Deny Question??

Hi All,
i want to use hosts.deny to block emails and ip's to my email
server..sounds
easy but i cant seem to get it to work
do i just need to add the emails or ip's to the host.deny and then add a
rule to my script
could some one please explain and maybe give me the rule
thanx in advance
niall

Re: Hosts.Deny Question??

[Antony Stone]

On Thursday 12 September 2002 2:49 pm, Niall Murphy wrote:

> thats what i mean sorry!! i have a red hat 7.2 firewall in front of a nt
> email and proxy server etc.
> but i want to use host.deny in the firewall rules to block certain ip
> and email addresses

You cannot use hosts.deny to control connections *through* a machine - it can 
only be used to restrict connections *to* the machine, and even then only to 
applications which use TCPwrappers.

As already discussed, use netfilter instead :-)

Antony.

-- 

The difference between theory and practice is that
in theory there is no difference, whereas in practice there is.

RE: Hosts.Deny Question??

[Niall Murphy]

just what i needed
thanx
niall :-)

-----Original Message-----
From: Antony Stone [mailto:Antony@Soft-Solutions.co.uk]
Sent: Thursday, September 12, 2002 12:53 PM
To: netfilter@lists.netfilter.org
Subject: Re: Hosts.Deny Question??


On Thursday 12 September 2002 12:38 pm, Niall Murphy wrote:

> Hi All,
> i want to use hosts.deny to block emails and ip's to my email
> server..sounds easy but i cant seem to get it to work
> do i just need to add the emails or ip's to the host.deny and then add a
> rule to my script

Why not do it with netfilter ? (after all, that's what this list is about
:-)

iptables -A FORWARD -s a.b.c.d -d w.x.y.z -p tcp --dport 25 -j DROP

where a.b.c.d is the remote IP address you want to block (repeat this rule 
for as many addresses as you want to exclude) and w.x.y.z is the IP address 
of your mail server.

Make sure this rule comes before any rule which allows general access to
your 
mail server from the outside world.

You won't be able to use either netfilter or hosts.deny to block actual
email 
addresses - you'd have to do that in your mail server itself.

Antony.

-- 

Having been asked to provide a reference for this man,
I can confidently state that you will be very lucky indeed
if you can get him to work for you.

Hosts.Deny Question??

[Niall Murphy]

Hi All,
i want to use hosts.deny to block emails and ip's to my email server..sounds
easy but i cant seem to get it to work
do i just need to add the emails or ip's to the host.deny and then add a
rule to my script
could some one please explain and maybe give me the rule
thanx in advance
niall

Re: Hosts.Deny Question??

[Antony Stone]

On Thursday 12 September 2002 12:38 pm, Niall Murphy wrote:

> Hi All,
> i want to use hosts.deny to block emails and ip's to my email
> server..sounds easy but i cant seem to get it to work
> do i just need to add the emails or ip's to the host.deny and then add a
> rule to my script

Why not do it with netfilter ? (after all, that's what this list is about :-)

iptables -A FORWARD -s a.b.c.d -d w.x.y.z -p tcp --dport 25 -j DROP

where a.b.c.d is the remote IP address you want to block (repeat this rule 
for as many addresses as you want to exclude) and w.x.y.z is the IP address 
of your mail server.

Make sure this rule comes before any rule which allows general access to your 
mail server from the outside world.

You won't be able to use either netfilter or hosts.deny to block actual email 
addresses - you'd have to do that in your mail server itself.

Antony.

-- 

Having been asked to provide a reference for this man,
I can confidently state that you will be very lucky indeed
if you can get him to work for you.

RE: Hosts.Deny Question??

[Ferry van Steen]

1. Wrong mailinglist
2. Not enough info (what SMTP server are you running)
3. I don't know of any SMTP server that supports TCP Wrappers (which is
hosts.deny/allow)
4. Only option probably is running your smtp server from inetd and
running it in TCP Wrappers there
5. Why on earth would you want to block IP's to your mailserver
6. If you don't know how to turn off relaying go to your favorite SMTP
server's mailing list
7. You could always deny those IP's by firewall rules, which is, what
this mailinglist is all about.
8. Well uh, I'm out :-)

Kind regards,

Ferry van Steen
InfoPart Automatisering B.V.
Beeksestraat 24
4841 GC Prinsenbeek
The Netherlands
Phone: +31 (0)76 - 5 44 04 11
Fax: +31 (0)76 - 5 41 83 51
Mobile: +31 (0)6 - 28 46 47 45
E-Mail (business): ferry.van.steen@infopart.nl
E-Mail (private): freaky@bananateam.nl
MSN Messenger: freaky@freaky2000.dyndns.org
ICQ (UIN (seldom used)): 191458

Insert your favorite yada yada yada my opinions don't (necessarily)
represent the ones of my company nor do my actions yada yada yada
disclaimer.

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Niall Murphy
Sent: donderdag 12 september 2002 13:38
To: netfilter@lists.netfilter.org
Subject: Hosts.Deny Question??

Hi All,
i want to use hosts.deny to block emails and ip's to my email
server..sounds
easy but i cant seem to get it to work
do i just need to add the emails or ip's to the host.deny and then add a
rule to my script
could some one please explain and maybe give me the rule
thanx in advance
niall