From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Chris Partsenidis" Subject: Re: Allowing select IPs access to a single port Date: Sun, 9 Feb 2003 17:58:48 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000f01c2d054$24171d00$0100a8c0@admin> References: <020901c2cfc7$9d1955c0$52453e44@cc292729a> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000C_01C2D064.E5475700" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: security@grossepointe.com, netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_000C_01C2D064.E5475700 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Assining the service your remote hosts are trying to access are on the = firewall box and its a service that uses the TCP transport protocol, you = could try something like the following: iptables -A INPUT -s remoteip -p tcp -d yourfirewallip --dport 3306 -j = ACCEPT If the service is on another pc on the internal network: iptables -A PREROUTING -t nat -s remoteip -p tcp -d yourfirewallip = --dport 3306 -j DNAT --to internalhostip and in the case your internal service is running on a different port, = e.g 4000: iptables -A PREROUTING -t nat -s remoteip -p tcp -d yourfirewallip = --dport 3306 -j DNAT --to internalhostip:4000 Hope this helps. I'll soon be covering IPTables on my website so you can = check in a few weeks times, hopefully I'll have it posted by then: www.Firewall.cx Cheers, __________________________ Chris Partsenidis. Systems Network Administrator Email: Chris@firewall.cx http://www.firewall.cx =20 __________________________ ----- Original Message -----=20 From: security@grossepointe.com=20 To: netfilter@lists.netfilter.org=20 Sent: Sunday, February 09, 2003 1:12 AM Subject: Allowing select IPs access to a single port=20 Hello,=20 What would be the best way to only open port 3306 to 1 or 2 IPs for = remote connection? I was hoping someone could provide an iptable command = that would achieve this. I have tried a few things but I am a newbie and have yet to figure = this one out. Any resources or assistance would be appreciated. Thanks in advance.=20 Doug ------=_NextPart_000_000C_01C2D064.E5475700 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Assining the service your remote hosts are trying to = access=20 are on the firewall box and its a service that uses the TCP transport = protocol,=20 you could try something like the following:
 
 
iptables -A INPUT  -s remoteip -p tcp -d = yourfirewallip=20 --dport 3306 -j ACCEPT
 
If the service is on another pc on the internal=20 network:
 
iptables -A PREROUTING -t nat -s remoteip -p tcp -d=20 yourfirewallip --dport 3306 -j DNAT --to internalhostip
 
and in the case your internal service is running on = a=20 different port, e.g 4000:
 
iptables -A PREROUTING -t nat -s remoteip -p tcp -d=20 yourfirewallip --dport 3306 -j DNAT --to = internalhostip:4000
 
Hope this helps. I'll soon be covering IPTables on = my website=20 so you can check in a few weeks times, hopefully I'll have it posted by=20 then:
www.Firewall.cx
 
Cheers,
__________________________
Chris Partsenidis.
Systems Network = Administrator
Email: Chris@firewall.cx
http://www.firewall.cx =20
__________________________
----- Original Message -----
From:=20 security@grossepointe.com =
To: netfilter@lists.netfilter.o= rg=20
Sent: Sunday, February 09, 2003 = 1:12=20 AM
Subject: Allowing select IPs = access to a=20 single port

Hello, =

What would be=20 the best way to only open port 3306 to 1 or 2 IPs for remote = connection? I was=20 hoping someone could provide an iptable command that would achieve=20 this.

I have tried a few things but I am a newbie = and have yet=20 to figure this one out.  Any resources or assistance would be=20 appreciated.

Thanks in advance.=20

Doug

------=_NextPart_000_000C_01C2D064.E5475700--