Re: Internal ip exiting network on firewall external nic despight rule

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Friday 20 September 2002 10:24 pm, Rowan Reid wrote:

> http://www.e-infomax.com/ipmasq/howto/examples/rc.firewall-2.4-stronger
>
> My firewall ruleset is a slight modification of the above link.

From what you have said so far, I don't think your ruleset is the problem 
(except possibly for a certain misunderstanding about the difference between 
INPUT and FORWARD chains...?).

I just had a look at that ruleset, and I'm very surprised at the use of 
$UNIVERSE all over the place - as I mentioned in a previous mail in this 
thread, it is quite redundant no matter where it appears (in other words, 
leaving it out of any rule creates precisely the same meaning, and is 
generally easier to understand), and in several of the examples where it 
appears it is actually rather pointless, eg:

iptables -A INPUT -s $somewhere -d $universe -j DROP

There is absolutely no purpose in having $universe (= 0.0.0.0/0) in such a 
rule.


I think the problem is your physical network setup - you should not have a 
direct link between the internal and external interfaces of your firewall.

Antony.

-- 

Most people are aware that the Universe is big.

 - Paul Davies, Professor of Theoretical Physics