iptables: exe

iptables: exe

[Tasha Smith]

Ok...i have my own iptables script trying to get it
going...here what i have soo far in it...just starting
 
SPECS: 
RedHat 7.2 
2.4.19 Kernel 
iptables-1.2.3 

####################################### 
#!/bin/bash 

echo 1 = > /proc/sys/net/ipv4//ip_forward 
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 

# Remove any existing rules from all chains. 
iptables --flush 
iptables -t nat --flush 

# Unlimited access on the loopback interface 
iptables -A INPUT -i lo -j ACCEPT 
iptables -A OUPUT -o lo -j ACCPET 

# Set the fefault policy to Drop 
iptables --policy INPUT DROP 
####################################### 
Now... to get this to run on start-up here is what i
did but it didnt start up it gave me an error. 
chown root.root /etc/init.d/firewall 
chmod u=rwx /etc/init.d /firewall 

And when i restart I GET ERROR... which is 
"iptables: execvp: Permission Denied 
rc. Starting iptables: Failed"  

I also have this line sh /etc/init.d/firewall at the
end of my "rc.local" file 

HOW CAN I FIX THIS OR GET THEM TO START-UP PROPERLY?
EDIT: > OOPPPPPPSS guys  i forgot to mention the
original iptables script that came installed already
on my system in the "/etc/init.d/" i moved that to
somewhere else.... was i suppose to do that or just
leave them there???



=====

Image by MackDaddy

__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

Re: iptables: exe

[Antony Stone]

On Saturday 21 September 2002 10:12 pm, Tasha Smith wrote:

> Ok...i have my own iptables script trying to get it
> going...here what i have soo far in it...just starting
>
> SPECS:
> RedHat 7.2

I think the major problem you report is RedHat specific, which I don't use, 
so I hope someone else here can answer that, but I just wanted to make a 
couple of comments on your netfilter script anyway...

> 2.4.19 Kernel
> iptables-1.2.3

Seems like a strange combination ?   Modern kernel and rather old iptables.   
Still, I don't think it'll cause you any troubles...

> #######################################
> #!/bin/bash
>
> echo 1 = > /proc/sys/net/ipv4//ip_forward

1. Remove the = from that command.   It's not doing any harm, but it 
shouldn't be there.

2. Move the command altogether to the end of your firewall script.   You 
shouldn't enable packet forwarding until after you've set up the filtering 
rules - otherwise there's a short period of time when you are forwarding 
packets with no filtering = open router = bad idea :-)

> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
>
> # Remove any existing rules from all chains.
> iptables --flush
> iptables -t nat --flush
>
> # Unlimited access on the loopback interface
> iptables -A INPUT -i lo -j ACCEPT
> iptables -A OUPUT -o lo -j ACCPET

Was that a typo when you sent this email, or do you need to edit your script 
file ?

> # Set the fefault policy to Drop
> iptables --policy INPUT DROP

Shouldn't you be setting your FORWARD policy to DROP here as well ?

I suppose you might have only one interface, and you're not forwarding 
packets, but then you don't need the echo > ip_forward command at the top 
which I suggested you move....

> #######################################

> Now... to get this to run on start-up here is what i
> did but it didnt start up it gave me an error.
> chown root.root /etc/init.d/firewall
> chmod u=rwx /etc/init.d /firewall
>
> And when i restart I GET ERROR... which is
> "iptables: execvp: Permission Denied
> rc. Starting iptables: Failed"

This is the RedHat specific part which I can't help with - sorry.   Anyone 
else here care to step in at this point please ?

> I also have this line sh /etc/init.d/firewall at the
> end of my "rc.local" file
>
> HOW CAN I FIX THIS OR GET THEM TO START-UP PROPERLY?
> EDIT: > OOPPPPPPSS guys  i forgot to mention the
> original iptables script that came installed already
> on my system in the "/etc/init.d/" i moved that to
> somewhere else.... was i suppose to do that or just
> leave them there???

Antony.

-- 

Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.

Re: iptables: exe

[Tasha Smith]

Thanks Anthony for your tips..:) im just starting out
with iptables soo it is really helping..and yes i have
2 interfaces soo i will move the forwarding rule to
the end, and add these rules:
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP
iptables -t nat --policy PREROUTING DROP
iptables -t nat --policy OUTPUT DROP
iptables -t nat --policy FORWARD DROP

HEHEHE...now only if i could get them to startup :)
properly!!


--- Tasha Smith <natasha3641@yahoo.com> wrote:
> Ok...i have my own iptables script trying to get it
> going...here what i have soo far in it...just
> starting
>  
> SPECS: 
> RedHat 7.2 
> 2.4.19 Kernel 
> iptables-1.2.3 
> 
> ####################################### 
> #!/bin/bash 
> 
> echo 1 = > /proc/sys/net/ipv4//ip_forward 
> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
> 
> 
> # Remove any existing rules from all chains. 
> iptables --flush 
> iptables -t nat --flush 
> 
> # Unlimited access on the loopback interface 
> iptables -A INPUT -i lo -j ACCEPT 
> iptables -A OUPUT -o lo -j ACCPET 
> 
> # Set the fefault policy to Drop 
> iptables --policy INPUT DROP 
> ####################################### 
> Now... to get this to run on start-up here is what i
> did but it didnt start up it gave me an error. 
> chown root.root /etc/init.d/firewall 
> chmod u=rwx /etc/init.d /firewall 
> 
> And when i restart I GET ERROR... which is 
> "iptables: execvp: Permission Denied 
> rc. Starting iptables: Failed"  
> 
> I also have this line sh /etc/init.d/firewall at the
> end of my "rc.local" file 
> 
> HOW CAN I FIX THIS OR GET THEM TO START-UP PROPERLY?
> EDIT: > OOPPPPPPSS guys  i forgot to mention the
> original iptables script that came installed already
> on my system in the "/etc/init.d/" i moved that to
> somewhere else.... was i suppose to do that or just
> leave them there???
> 
> 
> 
> =====
> 
> Image by MackDaddy
> 
> __________________________________________________
> Do you Yahoo!?
> New DSL Internet Access from SBC & Yahoo!
> http://sbc.yahoo.com
> 


__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

Re: iptables: exe

[Antony Stone]

On Saturday 21 September 2002 11:07 pm, Tasha Smith wrote:

> Thanks Antony for your tips..:) im just starting out
> with iptables so it is really helping..and yes i have
> 2 interfaces so i will move the forwarding rule to
> the end, and add these rules:
> iptables --policy OUTPUT DROP

I would recommend you don't add that policy until everything else is working, 
because you are likely to block stuff getting out of your machine with this 
policy and it's better to have a system which works, then you add this rule 
and fix what gets broken, instead of putting this in at the beginning and 
getting too many problems to fix all at once.

> iptables --policy FORWARD DROP

Good.   Then you add the rules to your FORWARD chain to allow the packets you 
want.

> iptables -t nat --policy PREROUTING DROP

No !!!!!!   Don't do that !!!!   Setting a DROP policy, or even creating a 
DROP rule, in a nat table is a really *bad* idea.   You will block *all 
sorts* of traffic from getting through your machine and it simply won't work.

Do not filter packets in the nat tables - use those for address translating.  
Do your filtering in the filter tables - mainly in the INPUT and FORWARD 
chains, depending on where the packets are going.

> iptables -t nat --policy OUTPUT DROP

Remove this rule for the same reason given above.

> iptables -t nat --policy FORWARD DROP

There is no nat table in the FORWARD chain, so you couldn't even do this one 
if you tried :-)

> HEHEHE...now only if i could get them to startup :)
> properly!!

Like I said earlier, I hope someone else here can help with that - there are 
plenty of RedHat users on the list.   Unfortunately (for you) I'm not one of 
them.

Antony.

-- 

This email was created using 100% recycled electrons.

RE: iptables: exe

[Stewart Thompson]

Hi Tasha:

	The latest Kernel for Redhat 7.2 is 2.4.9-34.
I would recommend that you upgrade to it. Also,
Iptables 1.24 shipped with 7.2 not 1.23. Also.
1.25 is available on their site. The latest from Netfilter
is 1.27a, but unless you need one of the new features,
you don't require it. I am using 1.24 with great success.
The other thing is to make sure all your packages are up
to date, Iptables is just part of the security. Disable any
functions you don't need on the server.
	Now to your problems. Redhat 7.2 shipped with
Ipchains set up as the firewall. Have you disabled it?
They can't both be active at the same time.
Try chown root:root firewall and chmod 775 firewall,
and see if it executes ok on startup. This is in addition
to the advice from Antony.
Hope that helps.

Stu......


-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Tasha Smith
Sent: September 21, 2002 2:13 PM
To: netfilter@lists.netfilter.org
Subject: iptables: exe

Ok...i have my own iptables script trying to get it
going...here what i have soo far in it...just starting

SPECS:
RedHat 7.2
2.4.19 Kernel
iptables-1.2.3

#######################################
#!/bin/bash

echo 1 = > /proc/sys/net/ipv4//ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Remove any existing rules from all chains.
iptables --flush
iptables -t nat --flush

# Unlimited access on the loopback interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUPUT -o lo -j ACCPET

# Set the fefault policy to Drop
iptables --policy INPUT DROP
#######################################
Now... to get this to run on start-up here is what i
did but it didnt start up it gave me an error.
chown root.root /etc/init.d/firewall
chmod u=rwx /etc/init.d /firewall

And when i restart I GET ERROR... which is
"iptables: execvp: Permission Denied
rc. Starting iptables: Failed"

I also have this line sh /etc/init.d/firewall at the
end of my "rc.local" file

HOW CAN I FIX THIS OR GET THEM TO START-UP PROPERLY?
EDIT: > OOPPPPPPSS guys  i forgot to mention the
original iptables script that came installed already
on my system in the "/etc/init.d/" i moved that to
somewhere else.... was i suppose to do that or just
leave them there???



=====

Image by MackDaddy

__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

RE: iptables: exe

[Tasha Smith]

Ok guys: i think they started up with out any errors:)
"chmod 755 firewall" Then i went to my "rc.local" file
and put "sh /etc/init.d/firewall" at the end and
rebooted and i got no error but COULD NOT see anywhere
saying "firewall starting      OK"  but when i logged
in and tryed the command "iptables vL" I GOT THIS 
----------------------------------------------------
Chain INPUT (policy 0 packets, 0 bytes)
pkts bytes target prt opt in out source destination
0 0  ACCEPT  all   --lo    any      anwhere    anwhere

CHain FOrward (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prt opt in out source destination

Chain OUPUT (policy ACCEPT 14 packetts, 1047bytes)
pkts bytes target prt opt in out source destination
0 0  ACCEPT  all   --lo    any      anwhere    anwhere
------------------------------------------------------
Soo does this mean they started right??? 


--- Stewart Thompson <stewart.thompson@shaw.ca> wrote:
> Hi Tasha:
> 
> 	The latest Kernel for Redhat 7.2 is 2.4.9-34.
> I would recommend that you upgrade to it. Also,
> Iptables 1.24 shipped with 7.2 not 1.23. Also.
> 1.25 is available on their site. The latest from
> Netfilter
> is 1.27a, but unless you need one of the new
> features,
> you don't require it. I am using 1.24 with great
> success.
> The other thing is to make sure all your packages
> are up
> to date, Iptables is just part of the security.
> Disable any
> functions you don't need on the server.
> 	Now to your problems. Redhat 7.2 shipped with
> Ipchains set up as the firewall. Have you disabled
> it?
> They can't both be active at the same time.
> Try chown root:root firewall and chmod 775 firewall,
> and see if it executes ok on startup. This is in
> addition
> to the advice from Antony.
> Hope that helps.
> 
> Stu......
> 
> 
> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org]On
> Behalf Of Tasha Smith
> Sent: September 21, 2002 2:13 PM
> To: netfilter@lists.netfilter.org
> Subject: iptables: exe
> 
> Ok...i have my own iptables script trying to get it
> going...here what i have soo far in it...just
> starting
> 
> SPECS:
> RedHat 7.2
> 2.4.19 Kernel
> iptables-1.2.3
> 
> #######################################
> #!/bin/bash
> 
> echo 1 = > /proc/sys/net/ipv4//ip_forward
> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
> 
> # Remove any existing rules from all chains.
> iptables --flush
> iptables -t nat --flush
> 
> # Unlimited access on the loopback interface
> iptables -A INPUT -i lo -j ACCEPT
> iptables -A OUPUT -o lo -j ACCPET
> 
> # Set the fefault policy to Drop
> iptables --policy INPUT DROP
> #######################################
> Now... to get this to run on start-up here is what i
> did but it didnt start up it gave me an error.
> chown root.root /etc/init.d/firewall
> chmod u=rwx /etc/init.d /firewall
> 
> And when i restart I GET ERROR... which is
> "iptables: execvp: Permission Denied
> rc. Starting iptables: Failed"
> 
> I also have this line sh /etc/init.d/firewall at the
> end of my "rc.local" file
> 
> HOW CAN I FIX THIS OR GET THEM TO START-UP PROPERLY?
> EDIT: > OOPPPPPPSS guys  i forgot to mention the
> original iptables script that came installed already
> on my system in the "/etc/init.d/" i moved that to
> somewhere else.... was i suppose to do that or just
> leave them there???
> 
> 
> 
> =====
> 
> Image by MackDaddy
> 
> __________________________________________________
> Do you Yahoo!?
> New DSL Internet Access from SBC & Yahoo!
> http://sbc.yahoo.com
> 


__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

RE: iptables: exe

[Tasha Smith]

Ok guys: i think they started up with out any errors:)
"chmod 755 firewall" Then i went to my "rc.local" file
and put "sh /etc/init.d/firewall" at the end and
rebooted and i got no error but COULD NOT see anywhere
saying "firewall starting      OK"  but when i logged
in and tryed the command "iptables vL" I GOT THIS 
----------------------------------------------------
Chain INPUT (policy 0 packets, 0 bytes)
pkts bytes target prt opt in out source destination
0 0  ACCEPT  all   --lo    any      anwhere    anwhere

CHain FOrward (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prt opt in out source destination

Chain OUPUT (policy ACCEPT 14 packetts, 1047bytes)
pkts bytes target prt opt in out source destination
0 0  ACCEPT  all   --lo    any      anwhere    anwhere
------------------------------------------------------
Soo does this mean they started right??? 


--- Stewart Thompson <stewart.thompson@shaw.ca> wrote:
> Hi Tasha:
> 
> 	The latest Kernel for Redhat 7.2 is 2.4.9-34.
> I would recommend that you upgrade to it. Also,
> Iptables 1.24 shipped with 7.2 not 1.23. Also.
> 1.25 is available on their site. The latest from
> Netfilter
> is 1.27a, but unless you need one of the new
> features,
> you don't require it. I am using 1.24 with great
> success.
> The other thing is to make sure all your packages
> are up
> to date, Iptables is just part of the security.
> Disable any
> functions you don't need on the server.
> 	Now to your problems. Redhat 7.2 shipped with
> Ipchains set up as the firewall. Have you disabled
> it?
> They can't both be active at the same time.
> Try chown root:root firewall and chmod 775 firewall,
> and see if it executes ok on startup. This is in
> addition
> to the advice from Antony.
> Hope that helps.
> 
> Stu......
> 
> 
> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org]On
> Behalf Of Tasha Smith
> Sent: September 21, 2002 2:13 PM
> To: netfilter@lists.netfilter.org
> Subject: iptables: exe
> 
> Ok...i have my own iptables script trying to get it
> going...here what i have soo far in it...just
> starting
> 
> SPECS:
> RedHat 7.2
> 2.4.19 Kernel
> iptables-1.2.3
> 
> #######################################
> #!/bin/bash
> 
> echo 1 = > /proc/sys/net/ipv4//ip_forward
> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
> 
> # Remove any existing rules from all chains.
> iptables --flush
> iptables -t nat --flush
> 
> # Unlimited access on the loopback interface
> iptables -A INPUT -i lo -j ACCEPT
> iptables -A OUPUT -o lo -j ACCPET
> 
> # Set the fefault policy to Drop
> iptables --policy INPUT DROP
> #######################################
> Now... to get this to run on start-up here is what i
> did but it didnt start up it gave me an error.
> chown root.root /etc/init.d/firewall
> chmod u=rwx /etc/init.d /firewall
> 
> And when i restart I GET ERROR... which is
> "iptables: execvp: Permission Denied
> rc. Starting iptables: Failed"
> 
> I also have this line sh /etc/init.d/firewall at the
> end of my "rc.local" file
> 
> HOW CAN I FIX THIS OR GET THEM TO START-UP PROPERLY?
> EDIT: > OOPPPPPPSS guys  i forgot to mention the
> original iptables script that came installed already
> on my system in the "/etc/init.d/" i moved that to
> somewhere else.... was i suppose to do that or just
> leave them there???
> 
> 
> 
> =====
> 
> Image by MackDaddy
> 
> __________________________________________________
> Do you Yahoo!?
> New DSL Internet Access from SBC & Yahoo!
> http://sbc.yahoo.com
> 


__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

RE: iptables: exe

[Stewart Thompson]

Hi Tasha:

	Try iptables -vL -t nat. The only rule I see on
your original post was a Masquerade rule which would
show up in the nat Postrouting Table. Is that your entire
rule set?

Stu......


-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Tasha Smith
Sent: September 21, 2002 3:58 PM
To: netfilter@lists.netfilter.org
Subject: RE: iptables: exe

Ok guys: i think they started up with out any errors:)
"chmod 755 firewall" Then i went to my "rc.local" file
and put "sh /etc/init.d/firewall" at the end and
rebooted and i got no error but COULD NOT see anywhere
saying "firewall starting      OK"  but when i logged
in and tryed the command "iptables vL" I GOT THIS
----------------------------------------------------
Chain INPUT (policy 0 packets, 0 bytes)
pkts bytes target prt opt in out source destination
0 0  ACCEPT  all   --lo    any      anwhere    anwhere

CHain FOrward (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prt opt in out source destination

Chain OUPUT (policy ACCEPT 14 packetts, 1047bytes)
pkts bytes target prt opt in out source destination
0 0  ACCEPT  all   --lo    any      anwhere    anwhere
------------------------------------------------------
Soo does this mean they started right???


--- Stewart Thompson <stewart.thompson@shaw.ca> wrote:
> Hi Tasha:
>
>       The latest Kernel for Redhat 7.2 is 2.4.9-34.
> I would recommend that you upgrade to it. Also,
> Iptables 1.24 shipped with 7.2 not 1.23. Also.
> 1.25 is available on their site. The latest from
> Netfilter
> is 1.27a, but unless you need one of the new
> features,
> you don't require it. I am using 1.24 with great
> success.
> The other thing is to make sure all your packages
> are up
> to date, Iptables is just part of the security.
> Disable any
> functions you don't need on the server.
>       Now to your problems. Redhat 7.2 shipped with
> Ipchains set up as the firewall. Have you disabled
> it?
> They can't both be active at the same time.
> Try chown root:root firewall and chmod 775 firewall,
> and see if it executes ok on startup. This is in
> addition
> to the advice from Antony.
> Hope that helps.
>
> Stu......
>
>
> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org]On
> Behalf Of Tasha Smith
> Sent: September 21, 2002 2:13 PM
> To: netfilter@lists.netfilter.org
> Subject: iptables: exe
>
> Ok...i have my own iptables script trying to get it
> going...here what i have soo far in it...just
> starting
>
> SPECS:
> RedHat 7.2
> 2.4.19 Kernel
> iptables-1.2.3
>
> #######################################
> #!/bin/bash
>
> echo 1 = > /proc/sys/net/ipv4//ip_forward
> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
>
> # Remove any existing rules from all chains.
> iptables --flush
> iptables -t nat --flush
>
> # Unlimited access on the loopback interface
> iptables -A INPUT -i lo -j ACCEPT
> iptables -A OUPUT -o lo -j ACCPET
>
> # Set the fefault policy to Drop
> iptables --policy INPUT DROP
> #######################################
> Now... to get this to run on start-up here is what i
> did but it didnt start up it gave me an error.
> chown root.root /etc/init.d/firewall
> chmod u=rwx /etc/init.d /firewall
>
> And when i restart I GET ERROR... which is
> "iptables: execvp: Permission Denied
> rc. Starting iptables: Failed"
>
> I also have this line sh /etc/init.d/firewall at the
> end of my "rc.local" file
>
> HOW CAN I FIX THIS OR GET THEM TO START-UP PROPERLY?
> EDIT: > OOPPPPPPSS guys  i forgot to mention the
> original iptables script that came installed already
> on my system in the "/etc/init.d/" i moved that to
> somewhere else.... was i suppose to do that or just
> leave them there???
>
>
>
> =====
>
> Image by MackDaddy
>
> __________________________________________________
> Do you Yahoo!?
> New DSL Internet Access from SBC & Yahoo!
> http://sbc.yahoo.com
>


__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

iptables: exe

[Tasha Smith]

Alrightyyyy.. here is my script soooo  far:
#!/bin/bash 

# Remove any existing rules from all chains. 
iptables --flush 
iptables -t nat --flush 

# Unlimited access on the loopback interface 
iptables -A INPUT -i lo -j ACCEPT 
iptables -A OUPUT -o lo -j ACCPET 

# Set the fefault policy to Drop 
iptables --policy INPUT DROP 
iptables --policy FORWARD DROP

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
######################################################'
Here is my output for iptables -vL -t nat

Chain PREROUTING (policy Accept 67 packets, 8497 bytes)
pkts bytes target prt opt in out source destination

CHain POSTROUTING(policy ACCEPT 5 packets, 394 bytes)
pkts bytes target prt opt in out source destination
0 0 MASQUERADE all -- any eth0 anwywhere anwhere

Chain OUPUT (policy ACCEPT 5 packetts, 394bytes)
pkts bytes target prt opt in out source destination
---------------------------------------------------------
Soo does it look like they started ???


P.S.>By they way if anyone can gimme a few more rules for my box i could add i
would really appreciate it just to make it a bit more secure beofore i plug it
in ....  I have 2 INTERFACES and it is acting as FIREWALL/ROUTER




__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

RE: iptables: exe

[Stewart Thompson]

Hi Tasha:

	That looks like it started ok. Your rule is in the
Postrouting Chain as it should be. Have a look at
http://www.linuxguruz.org/iptables/
for some sample scripts that you can get some ideas.
From. They have a number of different ones for different
 situations. There is also lots of good information at.
http://www.netfilter.org/documentation/index.html
Hope that helps.

Stu.......


-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Tasha Smith
Sent: September 21, 2002 6:37 PM
To: netfilter@lists.netfilter.org
Subject: iptables: exe

Alrightyyyy.. here is my script soooo  far:
#!/bin/bash

# Remove any existing rules from all chains.
iptables --flush
iptables -t nat --flush

# Unlimited access on the loopback interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUPUT -o lo -j ACCPET

# Set the fefault policy to Drop
iptables --policy INPUT DROP
iptables --policy FORWARD DROP

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
######################################################'
Here is my output for iptables -vL -t nat

Chain PREROUTING (policy Accept 67 packets, 8497 bytes)
pkts bytes target prt opt in out source destination

CHain POSTROUTING(policy ACCEPT 5 packets, 394 bytes)
pkts bytes target prt opt in out source destination
0 0 MASQUERADE all -- any eth0 anwywhere anwhere

Chain OUPUT (policy ACCEPT 5 packetts, 394bytes)
pkts bytes target prt opt in out source destination
---------------------------------------------------------
Soo does it look like they started ???


P.S.>By they way if anyone can gimme a few more rules for my box i could add
i
would really appreciate it just to make it a bit more secure beofore i plug
it
in ....  I have 2 INTERFACES and it is acting as FIREWALL/ROUTER




__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com