From: "Hard__warE" <hard__ware@hotmail.com>
To: netfilter@lists.samba.org
Subject: Multi Port Tested & Example
Date: Wed, 12 Jun 2002 07:45:38 +1000 [thread overview]
Message-ID: <000d01c21191$53304e40$7b0010ac@dynamicaccess.lan> (raw)
i remember a while back people were screeming for help on multi port
well here what ya .. need
the example is For all SAMBA Ports to be added and DROPED
---------------Start Below This Line---------------------
## Load the Multi Port Modue ##
echo -e "ipt_multiport, "
if [ -z "` $LSMOD | $GREP ipt_multiport | $AWK {'print $1'} `" ]; then
/sbin/insmod ipt_multiport
fi
##########Creat Samba Chain #############
$IPTABLES -N SMB
$IPTABLES -A SMB -m multiport -p tcp --dport 135,136,137,138,139,445 -j DROP
$IPTABLES -A SMB -m multiport -p tcp --dport 135,136,137,138,139,445 -j DROP
$IPTABLES -A SMB -m multiport -p udp --sport 135,136,137,138,139,445 -j DROP
$IPTABLES -A SMB -m multiport -p udp --sport 135,136,137,138,139,445 -j DROP
$IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -j SMB
$IPTABLES -A OUTPUT -s $UNIVERSE -d $UNIVERSE -j SMB
$IPTABLES -A FORWARD -j SMB
To prove it works here is my Chains /sbin/iptbales -L -n -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
2 202 ACCEPT all -- lo * 0.0.0.0/0
0.0.0.0/0
470 49894 ACCEPT all -- eth0 * 172.16.0.0/16
0.0.0.0/0
0 0 drop-and-log-it all -- eth1 * 172.16.0.0/16
0.0.0.0/0
0 0 drop-and-log-it all -- eth1 * 0.0.0.0/0
172.16.0.0/16
0 0 SPOOFED icmp -- eth1 * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT icmp -- eth1 * 0.0.0.0/0
192.168.0.253
16 1395 ACCEPT all -- eth1 * 0.0.0.0/0
192.168.0.253
0 0 ACCEPT all -- eth1 * 0.0.0.0/0
192.168.0.212
0 0 ACCEPT all -- eth1 * 0.0.0.0/0
192.168.0.212 state RELATED,ESTABLISHED
0 0 ACCEPT all -- eth1 * 0.0.0.0/0
192.168.0.213
0 0 ACCEPT all -- eth1 * 0.0.0.0/0
192.168.0.213 state RELATED,ESTABLISHED
0 0 ACCEPT all -- eth1 * 0.0.0.0/0
192.168.0.253 state RELATED,ESTABLISHED
17 1702 SMB all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 drop-and-log-it all -- * * 0.0.0.0/0
0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
67 5190 ACCEPT tcp -- eth1 * 0.0.0.0/0
172.16.0.111 tcp dpt:80
0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0
172.16.0.111 tcp dpt:443
0 0 ACCEPT udp -- eth1 * 0.0.0.0/0
172.16.0.111 udp dpt:443
0 0 ACCEPT tcp -- eth1 * 192.168.0.212
172.16.0.52 tcp
0 0 ACCEPT udp -- eth1 * 192.168.0.212
172.16.0.52 udp
0 0 ACCEPT tcp -- eth1 * 192.168.0.213
172.16.0.53 tcp
0 0 ACCEPT udp -- eth1 * 192.168.0.213
172.16.0.53 udp
334 92708 SMB all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0
0.0.0.0/0 tcp flags:0x16/0x02 limit: avg 1/sec burst 5
0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0
0.0.0.0/0 tcp flags:0x17/0x04 limit: avg 1/sec burst 5
0 0 ACCEPT icmp -- eth1 * 0.0.0.0/0
0.0.0.0/0 icmp type 8 limit: avg 1/sec burst 5
0 0 ACCEPT all -- eth1 eth0 0.0.0.0/0
172.16.0.52 state RELATED,ESTABLISHED
0 0 ACCEPT all -- eth1 eth0 0.0.0.0/0
172.16.0.53 state RELATED,ESTABLISHED
127 32555 ACCEPT all -- eth1 eth0 0.0.0.0/0
0.0.0.0/0 state RELATED,ESTABLISHED
207 60153 ACCEPT all -- eth0 eth1 172.16.0.0/16
0.0.0.0/0
0 0 drop-and-log-it all -- * * 0.0.0.0/0
0.0.0.0/0
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
2 202 ACCEPT all -- * lo 0.0.0.0/0
0.0.0.0/0
392 151K ACCEPT all -- * eth0 172.16.0.253
172.16.0.0/16
0 0 ACCEPT all -- * eth0 192.168.0.253
172.16.0.0/16
0 0 drop-and-log-it all -- * eth1 0.0.0.0/0
172.16.0.0/16
0 0 ACCEPT all -- * eth0 192.168.0.212
172.16.0.0/16
0 0 ACCEPT all -- * eth1 192.168.0.212
0.0.0.0/0
0 0 ACCEPT all -- * eth0 192.168.0.213
172.16.0.0/16
0 0 ACCEPT all -- * eth1 192.168.0.213
0.0.0.0/0
16 1059 ACCEPT all -- * eth1 192.168.0.253
0.0.0.0/0
0 0 SMB all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 drop-and-log-it all -- * * 0.0.0.0/0
0.0.0.0/0
Chain SMB (3 references)
pkts bytes target prot opt in out source
destination
0 0 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport dports 135,136,137,138,139,445
0 0 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 multiport dports 135,136,137,138,139,445
17 1702 DROP udp -- * * 0.0.0.0/0
0.0.0.0/0 multiport sports 135,136,137,138,139,445
0 0 DROP udp -- * * 0.0.0.0/0
0.0.0.0/0 multiport sports 135,136,137,138,139,445
Chain SPOOFED (1 references)
pkts bytes target prot opt in out source
destination
0 0 drop-and-log-it all -- * * 10.0.0.0/8
0.0.0.0/0
0 0 drop-and-log-it all -- * * 172.16.0.0/16
0.0.0.0/0
0 0 drop-and-log-it all -- * * 0.0.0.0/0
10.0.0.0/8
0 0 drop-and-log-it all -- * * 0.0.0.0/0
172.16.0.0/16
Chain drop-and-log-it (10 references)
pkts bytes target prot opt in out source
destination
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 6
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0
next reply other threads:[~2002-06-11 21:45 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-06-11 21:45 Hard__warE [this message]
2002-06-11 21:55 ` Multi Port Tested & Example Ramin Alidousti
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='000d01c21191$53304e40$7b0010ac@dynamicaccess.lan' \
--to=hard__ware@hotmail.com \
--cc=netfilter@lists.samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox