From: Ralf Spenneberg <lists@spenneberg.org>
To: Payal Rathod <payal-iptables@staticky.com>
Cc: Netfilter <netfilter@lists.netfilter.org>
Subject: Re: default policy
Date: 25 Aug 2003 10:59:42 +0200 [thread overview]
Message-ID: <1061801982.1507.38.camel@kermit> (raw)
In-Reply-To: <20030826083534.GA1573@linux.local>
Am Die, 2003-08-26 um 10.35 schrieb Payal Rathod:
> $IPTABLES -P INPUT DROP
> $IPTABLES -P OUTPUT ACCEPT
> $IPTABLES -P FORWARD DROP
>
> $IPTABLES -t nat -A POSTROUTING -j MASQUERADE
>
> $IPTABLES -A FORWARD -s 125.125.125.0/24 -p tcp -m tcp --dport 21 -j ACCEPT
> $IPTABLES -A FORWARD -s 125.125.125.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
> $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> $IPTABLES -A FORWARD -p icmp --icmp-type 0 -j ACCEPT
>
> When I make FORWARD POLICY as ACCEPT it works, but not when I make it
> to DROP? Is there any bad rule anywhere?
Yes, apply masquerading only to the external interface, like
$IPTABLES -t nat -A POSTROUTING -o eth1 -j MASQUERADE
If 125.125.125.0 is your internal ip-range you should be able to browse
to:
http://217.160.128.61
But since you do not allow any DNS traffic you can't resolve any
hostnames.
Cheers,
Ralf
--
Ralf Spenneberg
RHCE, RHCX
Book: Intrusion Detection für Linux Server http://www.spenneberg.com
IPsec-Howto http://www.ipsec-howto.org
Honeynet Project Mirror: http://honeynet.spenneberg.org
next prev parent reply other threads:[~2003-08-25 8:59 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-08-26 8:35 default policy Payal Rathod
2003-08-25 8:59 ` Ralf Spenneberg [this message]
2003-08-25 14:56 ` Payal Rathod
-- strict thread matches above, loose matches on Subject: below --
2002-12-21 13:16 Default policy system
2002-12-21 13:28 ` Rob Sterenborg
2002-12-21 18:12 ` Giorgio Zarrelli
2002-11-01 3:58 default policy Rob
2002-11-01 23:22 ` Robert P. J. Day
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1061801982.1507.38.camel@kermit \
--to=lists@spenneberg.org \
--cc=netfilter@lists.netfilter.org \
--cc=payal-iptables@staticky.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox