RE: upgrade to iptabels from ipchains

RE: upgrade to iptabels from ipchains

[George Vieira]

Yes you can? You haven't reasearch much have you?

Do this...

IPCHAINS="/sbin/iptables"   # ;)

Just remember that iptables structure is different to ipchains in that INPUT is no longer part of the forwarding line.. it handles packets destined for itself ONLY..

Thanks,
____________________________________________
George Vieira
Systems Manager
georgev@citadelcomputer.com.au

Citadel Computer Systems Pty Ltd
http://www.citadelcomputer.com.au

 

-----Original Message-----
From: Esteban [mailto:eribicic@sinectis.com]
Sent: Wednesday, May 28, 2003 8:02 AM
To: netfilter@lists.netfilter.org
Subject: upgrade to iptabels from ipchains


i used to have this:

$IPCHAINS -N soporte
$IPCHAINS -A FORWARD -s 10.0.0.0/25  -j soporte
$IPCHAINS -A soporte -s 10.0.1.1 -j MASQUERADE
$IPCHAINS -A soporte -j DENY

how can i do this with iptables?
the idea is to use chains for each group.

thanks!

RE: upgrade to iptabels from ipchains

[Esteban]

$IPCHAINS -A soporte -s 10.0.1.1 -j MASQUERADE
$IPCHAINS -A soporte -j DENY

this rules does not work!
(the second should be DROP, but what about the first one?)

thanks!

On Tue, 2003-05-27 at 20:11, George Vieira wrote:
> Yes you can? You haven't reasearch much have you?
> 
> Do this...
> 
> IPCHAINS="/sbin/iptables"   # ;)
> 
> Just remember that iptables structure is different to ipchains in that INPUT is no longer part of the forwarding line.. it handles packets destined for itself ONLY..
> 
> Thanks,
> ____________________________________________
> 
> -----Original Message-----
> From: Esteban [mailto:eribicic@sinectis.com]
> Sent: Wednesday, May 28, 2003 8:02 AM
> To: netfilter@lists.netfilter.org
> Subject: upgrade to iptabels from ipchains
> 
> 
> i used to have this:
> 
> $IPCHAINS -N soporte
> $IPCHAINS -A FORWARD -s 10.0.0.0/25  -j soporte
> $IPCHAINS -A soporte -s 10.0.1.1 -j MASQUERADE
> $IPCHAINS -A soporte -j DENY
> 
> how can i do this with iptables?
> the idea is to use chains for each group.
> 
> thanks!
> 
> 
> 

Re: upgrade to iptabels from ipchains

[Leonardo Rodrigues Magalhães]

    This set of ipchains rules:

$IPCHAINS -N soporte
$IPCHAINS -A FORWARD -s 10.0.0.0/25  -j soporte
$IPCHAINS -A soporte -s 10.0.1.1 -j MASQUERADE
$IPCHAINS -A soporte -j DENY

    would became this in iptables

iptables -N soporte
iptables -A soporte -s 10.0.1.1 -j ACCEPT
iptables -A soporte -j DROP
iptables -A FORWARD -s 10.0.0.0/25 -j soporte
iptables -t nat -A POSTROUTING -s 10.0.1.1 -j MASQUERADE


    Some explanations

    In ipchains, the decision to allow or not forwarding was done in forward
rule, as well as the decision of forward it with the original address or NAT
it. This has changed in iptables. FORWARD rule only take the decision of
allowing or not the forwarding of the packet. NAT is done in POSTROUTING
rule of nat table. You should also note that when you do not specify which
table, you're working with filter table. So 'iptables -N soporte' and
'iptables -t filter -N soporte' would do exactly the same thing.


    Well, hope this helps ....

    Sincerily,
    Leonardo Rodrigues

RE: upgrade to iptabels from ipchains

[John Friel III]

>     would became this in iptables
> 
> iptables -N soporte
> iptables -A soporte -s 10.0.1.1 -j ACCEPT
> iptables -A soporte -j DROP
> iptables -A FORWARD -s 10.0.0.0/25 -j soporte
> iptables -t nat -A POSTROUTING -s 10.0.1.1 -j MASQUERADE

And it should be noted that with these rules in place, all packets that get
forwarded to the soporte chain will get DROPPED because the forward rule
only forwards IP's in the range of 10.0.0.0-10.0.0.127 and the accept range
is restricted to -only- IP 10.0.1.1.  

The 4th rule should be:

iptables -A FORWARD -s 10.0.0.0/16 -j soporte




Cheers!
John Friel III
Frieltek Consulting, Inc.

upgrade to iptabels from ipchains

[Esteban]

i used to have this:

$IPCHAINS -N soporte
$IPCHAINS -A FORWARD -s 10.0.0.0/25  -j soporte
$IPCHAINS -A soporte -s 10.0.1.1 -j MASQUERADE
$IPCHAINS -A soporte -j DENY

how can i do this with iptables?
the idea is to use chains for each group.

thanks!