help required

help required

[venky b]

Hi All,

Need help on a specific requirement.

I want to enable the stateful inspection only for few
chains.

I do not want iptables to maintain state inof for the
rest of the chains as it is not needed.

Any thoughts on this ?

Cheers
Venkatesh


__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree

Re: help required

[SBlaze]

You need to be way more specific on what it is you want to know. I don't think
anyone can really help you since your didn't provide any information on what it
is you really want to provided stateful inspection on.

SBlaze

--- venky b <bvr96@yahoo.com> wrote:
> Hi All,
> 
> Need help on a specific requirement.
> 
> I want to enable the stateful inspection only for few
> chains.
> 
> I do not want iptables to maintain state inof for the
> rest of the chains as it is not needed.
> 
> Any thoughts on this ?
> 
> Cheers
> Venkatesh
> 
> 
> __________________________________
> Do you Yahoo!?
> Protect your identity with Yahoo! Mail AddressGuard
> http://antispam.yahoo.com/whatsnewfree
> 


=====
In the absence of order there will be chaos.

__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree

Re: help required

[venky b]

Hi,

Thanks for responding.

My requirement is as follows

I have a site with two IP subnets A and B.

A is connected to eth0 of IPtables firewall and B is
connected to eth1 interface.

For accessing machines in other locations A must cross
the firewall and go through the router in subnet B,
i.e. WAN connectivity is through subnet B.

I want to implement access control for traffic between
A and B with stateful rules as B is not trusted by A.

Rest of the traffic which is not from/to A
specifically, i.e. coming from or going to other
location should be allowed with ACCEPT target.

There are so many application servers in other
locations which will be accesed by subnet A users,
around 400.

So I do not want IPtables to keep connection tracking
entries for this traffic as it hogs the memory and
cpu.

But at the same time it should keep track of
communication betweeb A <-> B.

Is there a way to turn off/on connection tracking for
specific rules or chains ? 

Hope this make everybody clear.

Thanks,
Venkatesh



 


--- SBlaze <dagent.geo@yahoo.com> wrote:
> You need to be way more specific on what it is you
> want to know. I don't think
> anyone can really help you since your didn't provide
> any information on what it
> is you really want to provided stateful inspection
> on.
> 
> SBlaze
> 
> --- venky b <bvr96@yahoo.com> wrote:
> > Hi All,
> > 
> > Need help on a specific requirement.
> > 
> > I want to enable the stateful inspection only for
> few
> > chains.
> > 
> > I do not want iptables to maintain state inof for
> the
> > rest of the chains as it is not needed.
> > 
> > Any thoughts on this ?
> > 
> > Cheers
> > Venkatesh
> > 
> > 
> > __________________________________
> > Do you Yahoo!?
> > Protect your identity with Yahoo! Mail
> AddressGuard
> > http://antispam.yahoo.com/whatsnewfree
> > 
> 
> 
> =====
> In the absence of order there will be chaos.
> 
> __________________________________
> Do you Yahoo!?
> Protect your identity with Yahoo! Mail AddressGuard
> http://antispam.yahoo.com/whatsnewfree


__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree

Re: help required

[Venkatesh. K]

Turning off connection tracking is not going to help you to conserve
CPU cycles. Savings in memory will be very less.

In fact, enabling the connection tracking helps you in cutting down
number of rules a packet has to traverse which in turn reduce the
number of CPU cycles.

Suppose you have 100 rules and a packet matching 100th rule has to
traverse 99 rules before there is a match. With connection tracking enabled
a packet belonging to an already established connection need to traverse
only one rule assuming the first rule in your chain allows all packets
belonging
to an established connection.

Each connection tracking requires only 292 bytes of memory. Considering
the cost of RAM today, it would be peanuts.

Thanks,

Venkatesh K
----- Original Message ----- 
From: "venky b" <bvr96@yahoo.com>
To: "SBlaze" <dagent.geo@yahoo.com>; <netfilter@lists.netfilter.org>
Sent: Sunday, November 09, 2003 9:41 PM
Subject: Re: help required


> Hi,
>
> Thanks for responding.
>
> My requirement is as follows
>
> I have a site with two IP subnets A and B.
>
> A is connected to eth0 of IPtables firewall and B is
> connected to eth1 interface.
>
> For accessing machines in other locations A must cross
> the firewall and go through the router in subnet B,
> i.e. WAN connectivity is through subnet B.
>
> I want to implement access control for traffic between
> A and B with stateful rules as B is not trusted by A.
>
> Rest of the traffic which is not from/to A
> specifically, i.e. coming from or going to other
> location should be allowed with ACCEPT target.
>
> There are so many application servers in other
> locations which will be accesed by subnet A users,
> around 400.
>
> So I do not want IPtables to keep connection tracking
> entries for this traffic as it hogs the memory and
> cpu.
>
> But at the same time it should keep track of
> communication betweeb A <-> B.
>
> Is there a way to turn off/on connection tracking for
> specific rules or chains ?
>
> Hope this make everybody clear.
>
> Thanks,
> Venkatesh
>
>
>
>
>
>
> --- SBlaze <dagent.geo@yahoo.com> wrote:
> > You need to be way more specific on what it is you
> > want to know. I don't think
> > anyone can really help you since your didn't provide
> > any information on what it
> > is you really want to provided stateful inspection
> > on.
> >
> > SBlaze
> >
> > --- venky b <bvr96@yahoo.com> wrote:
> > > Hi All,
> > >
> > > Need help on a specific requirement.
> > >
> > > I want to enable the stateful inspection only for
> > few
> > > chains.
> > >
> > > I do not want iptables to maintain state inof for
> > the
> > > rest of the chains as it is not needed.
> > >
> > > Any thoughts on this ?
> > >
> > > Cheers
> > > Venkatesh
> > >
> > >
> > > __________________________________
> > > Do you Yahoo!?
> > > Protect your identity with Yahoo! Mail
> > AddressGuard
> > > http://antispam.yahoo.com/whatsnewfree
> > >
> >
> >
> > =====
> > In the absence of order there will be chaos.
> >
> > __________________________________
> > Do you Yahoo!?
> > Protect your identity with Yahoo! Mail AddressGuard
> > http://antispam.yahoo.com/whatsnewfree
>
>
> __________________________________
> Do you Yahoo!?
> Protect your identity with Yahoo! Mail AddressGuard
> http://antispam.yahoo.com/whatsnewfree
>
>

Help Required

[Sridhar Murthy]

Hi Team,

I require help to my following setup:

I have a Redhat 8 Server with squid,smtp & pop3 with iptables running.

My requirement is we have a citrix server with local LAN ipaddress. People 
from Internet will have to access this server from outside(my firewall is 
having a public ipaddress which is dynamic assigned). I want to know what is 
the rules that i have to add to allow the traffic which uses port number 
1494, to get into my network and access my citrix server which is having LAN 
ip. Should any nat be added.

Thanks in advance.

Regards,

Sridhar

Re: Help Required

[Carlo Florendo]

Hello,

> From: "Sridhar Murthy" 
> Hi Team,
> 
> I require help to my following setup:
> 
> I have a Redhat 8 Server with squid,smtp & pop3 with iptables running.
> 
> My requirement is we have a citrix server with local LAN ipaddress. People 
> from Internet will have to access this server from outside(my firewall is 
> having a public ipaddress which is dynamic assigned). I want to know what is 
> the rules that i have to add to allow the traffic which uses port number 
> 1494, to get into my network and access my citrix server which is having LAN 
> ip. Should any nat be added.
> 

Yes.  You need to do a DNAT.  

iptables -t nat --insert PREROUTING -i <external_interface> -p tcp --dport  1494 -j DNAT --to  <citrix_ip_address>
iptables --insert FORWARD -p tcp -i <external_interface> -d <citrix_ip_address> --dport 1494 -j ACCEPT

> Thanks in advance.
> 
> Regards,
> 
> Sridhar
> 


Best Regards,

Carlo
------
Carlo Florendo
Astra Philippines Inc.
URL: http://www.hq.astra.ph/resources

Help Required

[Sridhar Murthy]

Hi all,

I require help in configuring firewall on Redhat 8.0 system my setup 
  is as follows:

 We have a Cable Modem connection with sendmail and proxy service 
 running on Linux 8 system with 2 nic cards.

 One nic card is having local LAN ipaddress and the other is taking 
 an ipaddress from the ISP through dhcp protocol.

 The problem i am facing is when i use the gui utility to configure the 
firewall i am not able to see the second nic card(during installation i was 
able to see both the nic cards) which uses the dhcp for an ipaddress

 Can anybody help in configuring a firewall for the this setup.

Regards,

Sridhar

Re: Help Required

[Dharmendra.T]

[-- Attachment #1: Type: text/plain, Size: 1234 bytes --]

Hi 

 Which gui utility you are using? Are you sure that the other interface
has got an ip address from he dhcp server?

Regards
Dharmu

On Fri, 2003-07-18 at 08:57, Sridhar Murthy wrote:

    Hi all,
    
    I require help in configuring firewall on Redhat 8.0 system my setup 
      is as follows:
    
     We have a Cable Modem connection with sendmail and proxy service 
     running on Linux 8 system with 2 nic cards.
    
     One nic card is having local LAN ipaddress and the other is taking 
     an ipaddress from the ISP through dhcp protocol.
    
     The problem i am facing is when i use the gui utility to configure the 
    firewall i am not able to see the second nic card(during installation i was 
    able to see both the nic cards) which uses the dhcp for an ipaddress
    
     Can anybody help in configuring a firewall for the this setup.
    
    Regards,
    
    Sridhar
    

-- 
Regards
Dharmendra.T
dharmu@nsecure.net

This message is intended for the addressee only. It may contain
privileged or Confidential information. If you have received this
message in error,please notify the sender and destroy the message
immediately.Unauthorised use or reproduction of this message is strictly
prohibited.

[-- Attachment #2: Type: text/html, Size: 2771 bytes --]

Help Required

[Sridhar Murthy]

Hi all,

I require help in configuring firewall on Redhat 8.0 system my setup 
  is as follows: 
 
 We have a Cable Modem connection with sendmail and proxy service 
 running on Linux 8 system with 2 nic cards. 
 
 One nic card is having local LAN ipaddress and the other is taking 
 an ipaddress from the ISP through dhcp protocol. 

 The problem i am facing is when i use the gui utility to configure the 
firewall i am not able to see the second nic card(during installation i was 
able to see both the nic cards) which uses the dhcp for an ipaddress
 
 Can anybody help in configuring a firewall for the this setup. 
 


Regards,

Sridhar

RE: Help Required

[George Vieira]

Don't use that GUI then..

Try www.webmin.com as it probably has a better GUI or learn to script it
yourself.. It's the best way.

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Sridhar Murthy
Sent: Thursday, July 17, 2003 10:47 PM
To: netfilter@lists.netfilter.org
Subject: Help Required


Hi all,

I require help in configuring firewall on Redhat 8.0 system my setup
  is as follows: