From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Imran Alvi" Subject: port blocking Date: Wed, 28 May 2003 13:43:51 +0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000801c324f5$43d536e0$0100a8c0@NE> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0005_01C3251F.2C9A7600" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0005_01C3251F.2C9A7600 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, I want some help on iptables, i have one ick with one priamry and one = secondry ip and i want secondry interface to hear all requests except = www (80) requests, Note:=20 i have primary interface running for transparent proxy. Plz help me in this regard it will be very gr8ful of u. Regards Imran Alvi ------=_NextPart_000_0005_01C3251F.2C9A7600 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hi,
I want some help on iptables, i have = one ick with=20 one priamry and one secondry ip and i want secondry interface to hear = all=20 requests except www (80) requests, Note:
i have primary interface running for = transparent=20 proxy.
Plz help me in this regard it will be = very gr8ful=20 of u.
 
Regards
Imran Alvi
------=_NextPart_000_0005_01C3251F.2C9A7600-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Manish Subject: port blocking Date: Fri, 25 Mar 2005 04:00:12 -0800 (PST) Message-ID: <20050325120012.38609.qmail@web51910.mail.yahoo.com> Mime-Version: 1.0 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org Hi, I am having 5 network inteface card on my server, 2 connected to ethernet and 3 connected to wireless. i am also running webserver on port 10000 in the same machine. I only wanted the users from eth1 to be able to connect to my web server. users from other interface i.e eth0, eth2.eth3 and eth4 will not be able to connect to my web server. What iptables rule should i use. Thanks. --------------------------------- Do you Yahoo!? Yahoo! Mail - 250MB free storage. Do more. Manage less. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Petrisor Bobalca Subject: Re: port blocking Date: Fri, 25 Mar 2005 16:05:27 +0200 Message-ID: <1215179231.20050325160527@gmail.com> References: <20050325120012.38609.qmail@web51910.mail.yahoo.com> Reply-To: Petrisor Bobalca Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable In-Reply-To: <20050325120012.38609.qmail@web51910.mail.yahoo.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Hello, usually you can bind the webserver on a specific IP address (for apache use BindAddress in httpd.conf). if not, use this iptables rule before accepting packets on eth0, eth2, eth3, eth4: iptables -A INPUT -p tcp -i ! eth1 --dport 10000 -j DROP On Friday, March 25, 2005, 2:00:12 PM, Manish wrote: > Hi, =20 > I am having 5 network inteface card on my server, 2 connected to > ethernet and 3 connected to wireless. i am also running webserver on > port 10000 in the same machine. I only wanted the users from eth1 to > be able to connect to my web server. users from other interface i.e > eth0, eth2.eth3 and eth4 will not be able to connect to my web > server. What iptables rule should i use. =20 > Thanks. =09=09 > --------------------------------- > Do you Yahoo!? > Yahoo! Mail - 250MB free storage. Do more. Manage less. --=20 Best regards, Petrisor mailto:petry.b@gmail.com From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason Opperisano Subject: Re: port blocking Date: Fri, 25 Mar 2005 10:00:30 -0500 Message-ID: <1111762830.4745.3.camel@hubcap.ljm.dom> References: <20050325120012.38609.qmail@web51910.mail.yahoo.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit In-Reply-To: <20050325120012.38609.qmail@web51910.mail.yahoo.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Fri, 2005-03-25 at 07:00, Manish wrote: > Hi, > > I am having 5 network inteface card on my server, 2 connected to ethernet and 3 connected to wireless. i am also running webserver on port 10000 in the same machine. I only wanted the users from eth1 to be able to connect to my web server. users from other interface i.e eth0, eth2.eth3 and eth4 will not be able to connect to my web server. What iptables rule should i use. run a default drop policy, and then allow what you want: iptables -P INPUT DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --syn --dport 10000 -j ACCEPT -j -- "Man, you go through life, you try to be nice to people, you struggle to resist the urge to punch 'em in the face, and for what?" --The Simpsons From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Klemen Kecman" Subject: RE: port blocking Date: Fri, 25 Mar 2005 14:57:12 +0100 Message-ID: <20050325135715.09751396825@smtp.amis.net> References: <20050325120012.38609.qmail@web51910.mail.yahoo.com> Reply-To: klemen.kecman@sting.si Mime-Version: 1.0 Content-Transfer-Encoding: 7bit In-Reply-To: <20050325120012.38609.qmail@web51910.mail.yahoo.com> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org -----Original Message----- From: netfilter-bounces@lists.netfilter.org [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Manish Sent: 25. marec 2005 13:00 To: netfilter@lists.netfilter.org Subject: port blocking Hi, I am having 5 network inteface card on my server, 2 connected to ethernet and 3 connected to wireless. i am also running webserver on port 10000 in the same machine. I only wanted the users from eth1 to be able to connect to my web server. users from other interface i.e eth0, eth2.eth3 and eth4 will not be able to connect to my web server. What iptables rule should i use. Thanks. --------------------------------- Do you Yahoo!? Yahoo! Mail - 250MB free storage. Do more. Manage less. iptables -A INPUT -i eth0 -p tcp --dport 10000 -j DROP iptables -A INPUT -i eth2 -p tcp --dport 10000 -j DROP iptables -A INPUT -i eth3 -p tcp --dport 10000 -j DROP iptables -A INPUT -i eth4 -p tcp --dport 10000 -j DROP and so on .. But its better if you go other way around, set policy to drop, and then specify what to allow in. Greets, Klemen