Adding Telnet to a Working Setup

["Alyn Ashworth" <alyn@emph.com>]

I have a working iptables setup that uses the following script, and that I
would like to change to allow telnet connexions from the local network
(eth0) but nor from ppp0. Can anyone suggest the best way to do this
(politely and in words of one sylable, please!), and I would also welcome
any other comments on my script....

#============================SCRIPT STARTS==================================
# Load modules
modprobe ip_tables
modprobe ip_conntrack
modprobe ip_conntrack_ftp

# (1) Policies (default)
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# (2) User-defined chain for ACCEPTed TCP packets - called okay
iptables -N okay
#next line would allow new connections
#iptables -A okay -p TCP --syn -j ACCEPT
iptables -A okay -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A okay -p TCP -j DROP

# (3) INPUT chain rules

# Rules for incoming pakets from LAN
iptables -A INPUT -p ALL -i eth0 -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p ALL -i lo -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p ALL -i lo -s 192.168.0.0/16 -j ACCEPT

#Rules for incoming packets from the Internet

#Packets for established connexions
iptables -A INPUT -p ALL -i ppp0 -m state --state ESTABLISHED,RELATED -j
ACCEPT

#TCP rules (not used as pres as no services running over net)

#UDP rules
iptables -A INPUT -p UDP -i ppp0 -s 0/0 --destination-port 53 -j ACCEPT
iptables -A INPUT -p UDP -i ppp0 -s 0/0 --destination-port 2074 -j ACCEPT
iptables -A INPUT -p UDP -i ppp0 -s 0/0 --destination-port 4000 -j ACCEPT

#ICMP rules
iptables -A INPUT -p ICMP -i ppp0 -s 0/0 --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP -i ppp0 -s 0/0 --icmp-type 11 -j ACCEPT

# (4) FORWARD chain rules
# Accept packets we want to forward
iptables -A FORWARD -i eth0 -s 192.168.0.0/16 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# (5) OUTPUT chain rules
# only output packets with local addreses (no spoofing)
iptables -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -p ALL -s 192.168.0.88 -j ACCEPT
iptables -A OUTPUT -p ALL -s 192.168.0.0/24 -j ACCEPT

# (6) POSTROUTING chain rules
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
#==========================================================SCRIPT ENDS
==================

Many thanks

Alyn.


Alyn W. Ashworth