strange log entries

strange log entries

[Willi Mann]

Hi!

I'm fighting with some strange log entries in my firewall.
The machine is a proxy server and these entries appear only while the 
proxy (squid) is heavily used. (about 200 hits/minute, so I don't think 
it's caused by ip_conntrack_max=16376)

I allow all ESTABLISHED,RELATED connections and of course some ports 
(8080) in the INPUT chain and all connections in the OUTPUT chain.
The rest of the INPUT chain is logged with stateNEW or stateINVALID prefix.


e.g.:

stateNEW: IN=eth1 OUT= MAC=xxx SRC=131.131.131.131 DST=193.193.193.193 
LEN=1500 TOS=0x00 PREC=0x00 TTL=47 ID=10226 DF PROTO=TCP SPT=80 
DPT=37678 WINDOW=33304 RES=0x00 ACK URGP=0

The flags vary. ACK - ACK,FIN.- ACK,PSH,FIN

Does anybody know the reason for this? Bug in netfilter, bug in remote 
system?

Willi Mann

denying local traffic

[Doug Yeager]

I'm using nocat as a wireless gateway w/ the hostap driver. This is 

Great because I should be able to use iptables firewall rules to 

Administer things. I've had some success w/ these rules as I'm new to 

iptables.

 

What I can't figure out is how to block local traffic between clients 

on the LAN. Basically, I want them to be invisible to each other but 

be able to get to the internet through the gateway.

Right now they can get to the internet but can see each other's shares

and so forth.

 

What should be the iptables commands for doing this.

 

My lan is 192.168.19.0/255.255.255.0

 

Help would be great as I've attempted many things w/o success.

 

Thx,

doug