From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Ben Tan" Subject: setup firewall to allow Remote Desktop in XP??? Date: Sun, 27 Oct 2002 23:05:00 +0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000f01c27dca$38bb9b00$1801010a@demo> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000C_01C27E0D.46C7F7A0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_000C_01C27E0D.46C7F7A0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable hi, I am considering to setup a firewall to allow the remote desktop = connection for internet. which ports to allow for INPUT, FORWARD, = OUTPUT? There will be a DNAT for each connecton request to the internal = client. thanxs. ------=_NextPart_000_000C_01C27E0D.46C7F7A0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

hi,

I am considering to = setup a=20 firewall to allow the remote desktop connection for internet. which = ports to=20 allow for INPUT, FORWARD, OUTPUT?

There will be a DNAT = for each=20 connecton request to the internal client.

thanxs.

------=_NextPart_000_000C_01C27E0D.46C7F7A0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: setup firewall to allow Remote Desktop in XP??? Date: Mon, 28 Oct 2002 14:47:54 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200210281447.g9SElxe08646@vulcan.rissington.net> References: <000f01c27dca$38bb9b00$1801010a@demo> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <000f01c27dca$38bb9b00$1801010a@demo> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Sunday 27 October 2002 3:05 pm, Ben Tan wrote: > hi, > I am considering to setup a firewall to allow the remote desktop > connection for internet. which ports to allow for INPUT, FORWARD, OUTPUT? > > There will be a DNAT for each connecton request to the internal client. You do not require any ports open in your INPUT and OUTPUT chains because these are only for packets to/from the netfilter machine - which obviously is not the machine running the service if you're talking about XP. Try the following rules in your FORWARD chain, and use the logged results to tell you what additional rules you need to allow in order to let the packets through: iptables -A FORWARD -s a.b.c.d -d w.x.y.z -j LOG iptables -A FORWARD -d a.b.c.d -s w.y.x.z -j LOG Where a.b.c.d and w.x.y.z are the two machines you're trying to get to talk to each other. Antony. -- Anyone that's normal doesn't really achieve much. - Mark Blair, Australian rocket engineer