* Firewall with 2 Dial in Modems + Port forwarding
@ 2003-08-28 11:44 cKBoy
0 siblings, 0 replies; 4+ messages in thread
From: cKBoy @ 2003-08-28 11:44 UTC (permalink / raw)
To: NetFilter
[-- Attachment #1: Type: text/plain, Size: 2867 bytes --]
this is my sample script
FWVER=0.63
echo -e "\n\nLoading simple rc.firewall version $FWVER..\n"
IPTABLES=/sbin/iptables
EXTIF="eth1"
INTIF1="eth0"
INTIF2="ppp0"
INTIF3="ppp1"
echo " External Interface: $EXTIF"
echo " Internal Interface: $INTIF1"
echo " Internal Interface: $INTIF2"
echo " Internal Interface: $INTIF3"
echo -en " loading modules: "
echo " - Verifying that all kernel modules are ok"
/sbin/depmod -a
echo -en "ip_tables, "
/sbin/insmod ip_tables
echo -en "ip_conntrack, "
/sbin/insmod ip_conntrack
echo -en "ip_conntrack_ftp, "
/sbin/insmod ip_conntrack_ftp
echo -en "ip_conntrack_irc, "
/sbin/insmod ip_conntrack_irc
echo -en "iptable_nat, "
/sbin/insmod iptable_nat
echo -en "ip_nat_ftp, "
/sbin/insmod ip_nat_ftp
echo ". Done loading modules."
echo " enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo " enabling DynamicAddr.."
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
echo " clearing any existing rules and setting default policy.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
echo " FWD: Allow all connections OUT and only existing and related ones IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF1 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF2 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF2 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF3 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF3 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
echo -e "\nrc.firewall-2.4 v$FWVER done.\n"
[root@delllinux rc.d]# !ip
iptables -L FORWARD
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level warning
[root@delllinux rc.d]# iptables -t nat -A PREROUTING --dst 192.168.2.90 -p tcp --dport 4899 -j DNAT --to-destination 192.168.1.2
My problem is for the iptables command above to work I have to issue the command "iptables -P FORWARD ACCEPT" Can anyone tell me how to allow just certain forwarding so I can set the default to DENY? And is this firewall script secure enough?
[-- Attachment #2: Type: text/html, Size: 5069 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Firewall with 2 Dial in Modems + Port forwarding
@ 2003-09-01 1:08 Power
0 siblings, 0 replies; 4+ messages in thread
From: Power @ 2003-09-01 1:08 UTC (permalink / raw)
To: NetFilter
[-- Attachment #1: Type: text/plain, Size: 2867 bytes --]
this is my sample script
FWVER=0.63
echo -e "\n\nLoading simple rc.firewall version $FWVER..\n"
IPTABLES=/sbin/iptables
EXTIF="eth1"
INTIF1="eth0"
INTIF2="ppp0"
INTIF3="ppp1"
echo " External Interface: $EXTIF"
echo " Internal Interface: $INTIF1"
echo " Internal Interface: $INTIF2"
echo " Internal Interface: $INTIF3"
echo -en " loading modules: "
echo " - Verifying that all kernel modules are ok"
/sbin/depmod -a
echo -en "ip_tables, "
/sbin/insmod ip_tables
echo -en "ip_conntrack, "
/sbin/insmod ip_conntrack
echo -en "ip_conntrack_ftp, "
/sbin/insmod ip_conntrack_ftp
echo -en "ip_conntrack_irc, "
/sbin/insmod ip_conntrack_irc
echo -en "iptable_nat, "
/sbin/insmod iptable_nat
echo -en "ip_nat_ftp, "
/sbin/insmod ip_nat_ftp
echo ". Done loading modules."
echo " enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo " enabling DynamicAddr.."
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
echo " clearing any existing rules and setting default policy.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
echo " FWD: Allow all connections OUT and only existing and related ones IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF1 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF2 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF2 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF3 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF3 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
echo -e "\nrc.firewall-2.4 v$FWVER done.\n"
[root@delllinux rc.d]# !ip
iptables -L FORWARD
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level warning
[root@delllinux rc.d]# iptables -t nat -A PREROUTING --dst 192.168.2.90 -p tcp --dport 4899 -j DNAT --to-destination 192.168.1.2
My problem is for the iptables command above to work I have to issue the command "iptables -P FORWARD ACCEPT" Can anyone tell me how to allow just certain forwarding so I can set the default to DENY? And is this firewall script secure enough?
[-- Attachment #2: Type: text/html, Size: 5113 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Firewall with 2 Dial in Modems + Port forwarding
@ 2003-09-02 0:51 Power
0 siblings, 0 replies; 4+ messages in thread
From: Power @ 2003-09-02 0:51 UTC (permalink / raw)
To: NetFilter
[-- Attachment #1: Type: text/plain, Size: 2867 bytes --]
this is my sample script
FWVER=0.63
echo -e "\n\nLoading simple rc.firewall version $FWVER..\n"
IPTABLES=/sbin/iptables
EXTIF="eth1"
INTIF1="eth0"
INTIF2="ppp0"
INTIF3="ppp1"
echo " External Interface: $EXTIF"
echo " Internal Interface: $INTIF1"
echo " Internal Interface: $INTIF2"
echo " Internal Interface: $INTIF3"
echo -en " loading modules: "
echo " - Verifying that all kernel modules are ok"
/sbin/depmod -a
echo -en "ip_tables, "
/sbin/insmod ip_tables
echo -en "ip_conntrack, "
/sbin/insmod ip_conntrack
echo -en "ip_conntrack_ftp, "
/sbin/insmod ip_conntrack_ftp
echo -en "ip_conntrack_irc, "
/sbin/insmod ip_conntrack_irc
echo -en "iptable_nat, "
/sbin/insmod iptable_nat
echo -en "ip_nat_ftp, "
/sbin/insmod ip_nat_ftp
echo ". Done loading modules."
echo " enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo " enabling DynamicAddr.."
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
echo " clearing any existing rules and setting default policy.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
echo " FWD: Allow all connections OUT and only existing and related ones IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF1 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF2 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF2 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF3 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF3 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
echo -e "\nrc.firewall-2.4 v$FWVER done.\n"
[root@delllinux rc.d]# !ip
iptables -L FORWARD
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level warning
[root@delllinux rc.d]# iptables -t nat -A PREROUTING --dst 192.168.2.90 -p tcp --dport 4899 -j DNAT --to-destination 192.168.1.2
My problem is for the iptables command above to work I have to issue the command "iptables -P FORWARD ACCEPT" Can anyone tell me how to allow just certain forwarding so I can set the default to DENY? And is this firewall script secure enough?
[-- Attachment #2: Type: text/html, Size: 5157 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Firewall with 2 Dial in Modems + Port forwarding
@ 2003-09-03 1:14 cKBoy
0 siblings, 0 replies; 4+ messages in thread
From: cKBoy @ 2003-09-03 1:14 UTC (permalink / raw)
To: NetFilter
[-- Attachment #1: Type: text/plain, Size: 2867 bytes --]
this is my sample script
FWVER=0.63
echo -e "\n\nLoading simple rc.firewall version $FWVER..\n"
IPTABLES=/sbin/iptables
EXTIF="eth1"
INTIF1="eth0"
INTIF2="ppp0"
INTIF3="ppp1"
echo " External Interface: $EXTIF"
echo " Internal Interface: $INTIF1"
echo " Internal Interface: $INTIF2"
echo " Internal Interface: $INTIF3"
echo -en " loading modules: "
echo " - Verifying that all kernel modules are ok"
/sbin/depmod -a
echo -en "ip_tables, "
/sbin/insmod ip_tables
echo -en "ip_conntrack, "
/sbin/insmod ip_conntrack
echo -en "ip_conntrack_ftp, "
/sbin/insmod ip_conntrack_ftp
echo -en "ip_conntrack_irc, "
/sbin/insmod ip_conntrack_irc
echo -en "iptable_nat, "
/sbin/insmod iptable_nat
echo -en "ip_nat_ftp, "
/sbin/insmod ip_nat_ftp
echo ". Done loading modules."
echo " enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward
echo " enabling DynamicAddr.."
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
echo " clearing any existing rules and setting default policy.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -t nat -F
echo " FWD: Allow all connections OUT and only existing and related ones IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF1 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF2 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF2 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF3 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF3 -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
echo -e "\nrc.firewall-2.4 v$FWVER done.\n"
[root@delllinux rc.d]# !ip
iptables -L FORWARD
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
LOG all -- anywhere anywhere LOG level warning
[root@delllinux rc.d]# iptables -t nat -A PREROUTING --dst 192.168.2.90 -p tcp --dport 4899 -j DNAT --to-destination 192.168.1.2
My problem is for the iptables command above to work I have to issue the command "iptables -P FORWARD ACCEPT" Can anyone tell me how to allow just certain forwarding so I can set the default to DENY? And is this firewall script secure enough?
[-- Attachment #2: Type: text/html, Size: 5157 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2003-09-03 1:14 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-08-28 11:44 Firewall with 2 Dial in Modems + Port forwarding cKBoy
-- strict thread matches above, loose matches on Subject: below --
2003-09-01 1:08 Power
2003-09-02 0:51 Power
2003-09-03 1:14 cKBoy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox