From: Gavin Hamill <gdh@acentral.co.uk>
To: netfilter@lists.netfilter.org
Subject: Re: comments about lokkit default script
Date: Fri, 12 Sep 2003 09:02:41 +0100 [thread overview]
Message-ID: <200309120902.41066.gdh@acentral.co.uk> (raw)
In-Reply-To: <Pine.LNX.4.44.0309120210280.1054-100000@Chrestomanci>
On Friday 12 September 2003 07:11, Faheem Mitha wrote:
> Dear People,
>
> Are the lines
>
> iptables -A RH-Lokkit-0-50-INPUT -p udp -m udp -s 207.69.188.18*
> --sport 53 -d 0/0 -j ACCEPT
>
> allowing through the DHCP connection? The 207.69.188.18* are
> Earthlink servers, they look like nameservers.
Your second hunch is right - they are for Eathlink's nameservers, since that's
what will be defined in /etc/resolv.conf... DNS lookups reply using a UDP
source port of 53, hence the lines added by lokkit..
I would be wary of the fact that DHCP (which uses UDP ports 67 and 68) is
currently blocked, so if you start to get connection problems in the near
future, you'll know why - you should probably see messages from your DHCP
client that it was unable to renew the lease...
iptables -A INPUT -p UDP -i eth0 --dport 67 --sport 68 -j ACCEPT
is what I use to ensure that the DHCP traffic is permitted from the outside
world.
Cheers,
Gavin.
next prev parent reply other threads:[~2003-09-12 8:02 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-09-12 6:11 comments about lokkit default script Faheem Mitha
2003-09-12 8:02 ` Gavin Hamill [this message]
2003-09-12 17:26 ` Faheem Mitha
2003-09-12 18:38 ` Stephen Smoogen
2003-09-12 19:01 ` Faheem Mitha
2003-09-12 19:36 ` Stephen Smoogen
-- strict thread matches above, loose matches on Subject: below --
2003-09-11 15:10 Faheem Mitha
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200309120902.41066.gdh@acentral.co.uk \
--to=gdh@acentral.co.uk \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox