From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Eric McAfee" Subject: simple config question Date: Sat, 27 Mar 2004 20:58:52 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000a01c41470$9dbe3ec0$8a361645@Earthlink.net> Reply-To: "Eric McAfee" Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C4143E.4F1DD6E0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0007_01C4143E.4F1DD6E0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I need to know the iptables command that would restrict all access to my = server except for my computer's Dreamweaver program and ccbill's access = to my password file. I know it would be some variation of: iptables -A INPUT -i ppp0 -p tcp --syn -j DROP ------=_NextPart_000_0007_01C4143E.4F1DD6E0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

I need to know the iptables command = that would=20 restrict all access to my server except for my computer's Dreamweaver = program=20 and ccbill's access to my password file. I know it would be some = variation=20 of:

iptables -A INPUT -i ppp0 -p tcp --syn = -j=20 DROP

------=_NextPart_000_0007_01C4143E.4F1DD6E0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: simple config question Date: Sun, 28 Mar 2004 09:17:34 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200403280917.34504.Antony@Soft-Solutions.co.uk> References: <000a01c41470$9dbe3ec0$8a361645@Earthlink.net> Reply-To: Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <000a01c41470$9dbe3ec0$8a361645@Earthlink.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Sunday 28 March 2004 3:58 am, Eric McAfee wrote: > I need to know the iptables command that would restrict all access to my > server except for my computer's Dreamweaver program and ccbill's access to > my password file. I know it would be some variation of: > iptables -A INPUT -i ppp0 -p tcp --syn -j DROP That rule will definitely block all TCP access via ppp0 to the machine. All you need to do next is insert before that rule something suitable to allow the connections you mentioned. I can't quite figure out from the description you gave what network protocols you are talking about however, so I can't suggest what rules they need to be, however if you're not sure either, a simple LOGging rule should help you work out what is needed: iptables -I INPUT -i ppp0 -p tcp -s a.b.c.d -j LOG where a.b.c.d is the IP address of a machine you want to allow access. The LOG will show you what packets arrive, just before they get DROPped, so you should be able to work out from that what rule to add to ACCEPT them instead. Regards, Antony. -- This is not a rehearsal. This is Real Life. Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Frederic de Villamil Subject: Re: simple config question Date: Sun, 28 Mar 2004 11:53:50 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20040328095350.GA6334@jesus.seclab.jp> References: <000a01c41470$9dbe3ec0$8a361645@Earthlink.net> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="HcAYCG3uE/tztfnV" Return-path: Content-Disposition: inline In-Reply-To: <000a01c41470$9dbe3ec0$8a361645@Earthlink.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Eric McAfee Cc: netfilter@lists.netfilter.org --HcAYCG3uE/tztfnV Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Sat, 27 Mar 2004, Eric McAfee wrote: > I need to know the iptables command that would restrict all access to my server except for my computer's Dreamweaver program and ccbill's access to my password file. I know it would be some variation of: > iptables -A INPUT -i ppp0 -p tcp --syn -j DROP Hi, what you're going to do is drop every new TCP connection to your interface ppp0. What you want to to should be something like that iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -A INPUT -s 127.0.0.1 -j ACCEPT iptables -A OUTPUT -s 127.0.0.1 -j ACCEPT iptables -A INPUT -s $MACHINE -j ACCEPT iptables -A OUTPUT -s $MACHINE -j ACCEPT $machine is your machine IP address. regards Frederic -- http://www.seclab.jp --HcAYCG3uE/tztfnV Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (FreeBSD) iD8DBQFAZqCuYBnsNILdO64RAlOHAJ99bo5g4Hf/wRvy46Sv0IMRUIwPAQCfaERE DjsjDnaRHGY92aiw1DOYJ+4= =MgQJ -----END PGP SIGNATURE----- --HcAYCG3uE/tztfnV--