Help creating a RULE

Help creating a RULE

[Jojo Solis]

[-- Attachment #1: Type: text/plain, Size: 876 bytes --]

Hi Everyone,
 
 
We have firewall with 3 LAN Card, Eth0 is connected to my LAN, eth1 is
Connected to Internet, and eth2 is connected to our Sister companies
WAN.
 
Since I am new to IPtables i dont know how to create a Rule to make the
packet successfully reach its destination. This setup was made by a
former sysad but left the firewall especially the connection going to
the Sister Companies WAN un-configured. So that's the reason why Im here
to seek help creating a rule for this firewall.
 
Basically I want to achive the following.
 
1. Allow any IN and OUT traffic from eth0 to eth2 and vice versa.
2. Allow IN and OUT http traffic from eth0 to eth1.
3. Allow IN and OUT SMTP traffic from eth0 to eth1.
4. Allow Outgoing FTP traffic from eth0 to Eth1, Plus allow ESTABLISHED
and RELATED FTP connection.
 
 
Thanks,
 
 
 
 
 
 
 
 
 
 

Re: Help creating a RULE

[Edmundo Carmona]

There are many things you have to consider (IPs and routing)... but:

iptables -P FORWARD DROP
iptables -A FORWARD -i eth0 -o eth2 -j ACCEPT
iptables -A FORWARD -i eth2 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport http -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport smtp -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -p udp --dport smtp -j ACCEPT

# FTP? I'd rather allow ssh and then you can use sftp... what do you
think, rob0?
# one way or another, if you are masquerading, active plain FTP won't work.

iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

On 9/18/05, Jojo Solis <jojo.solis@summitmedia.com.ph> wrote:
> Hi Everyone,
> 
> 
> We have firewall with 3 LAN Card, Eth0 is connected to my LAN, eth1 is
> Connected to Internet, and eth2 is connected to our Sister companies
> WAN.
> 
> Since I am new to IPtables i dont know how to create a Rule to make the
> packet successfully reach its destination. This setup was made by a
> former sysad but left the firewall especially the connection going to
> the Sister Companies WAN un-configured. So that's the reason why Im here
> to seek help creating a rule for this firewall.
> 
> Basically I want to achive the following.
> 
> 1. Allow any IN and OUT traffic from eth0 to eth2 and vice versa.
> 2. Allow IN and OUT http traffic from eth0 to eth1.
> 3. Allow IN and OUT SMTP traffic from eth0 to eth1.
> 4. Allow Outgoing FTP traffic from eth0 to Eth1, Plus allow ESTABLISHED
> and RELATED FTP connection.
> 
> 
> Thanks,
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
>

Re: Help creating a RULE

[John A. Sullivan III]

On Mon, 2005-09-19 at 08:39 +0800, Jojo Solis wrote:
> Hi Everyone,
>  
> 
> We have firewall with 3 LAN Card, Eth0 is connected to my LAN, eth1 is
> Connected to Internet, and eth2 is connected to our Sister companies
> WAN.
>  
> Since I am new to IPtables i dont know how to create a Rule to make the
> packet successfully reach its destination. This setup was made by a
> former sysad but left the firewall especially the connection going to
> the Sister Companies WAN un-configured. So that's the reason why Im here
> to seek help creating a rule for this firewall.
>  
> Basically I want to achive the following.
>  
> 1. Allow any IN and OUT traffic from eth0 to eth2 and vice versa.
> 2. Allow IN and OUT http traffic from eth0 to eth1.
> 3. Allow IN and OUT SMTP traffic from eth0 to eth1.
> 4. Allow Outgoing FTP traffic from eth0 to Eth1, Plus allow ESTABLISHED
> and RELATED FTP connection.
<snip>
For something this basic, you are best off reading a good tutorial.
There is an excellent one by Oskar Andreasson at
http://iptables-tutorial.frozentux.net/iptables-tutorial.html and it
makes for very quick reading.  You can also find some slightly dated
training slide shows in the training section of
http://iscs.sourceforge.net - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@opensourcedevel.com

Financially sustainable open source development
http://www.opensourcedevel.com