Re: Adding Telnet to a Working Setup

[cc <cc@kdtc.net>]

Alyn Ashworth wrote:

> I have a working iptables setup that uses the following script, and that I
> would like to change to allow telnet connexions from the local network
> (eth0) but nor from ppp0. Can anyone suggest the best way to do this

Telnet connections into your firewall from the local net?

But haven't you already done that already with your first INPUT rule and
your  3rd Output rule?

> iptables -A INPUT -p ALL -i eth0 -s 192.168.0.0/16 -j ACCEPT
> iptables -A OUTPUT -p ALL -s 192.168.0.0/24 -j ACCEPT

Or did I completely miss the point?

> # (3) INPUT chain rules
> 
> # Rules for incoming pakets from LAN
> iptables -A INPUT -p ALL -i eth0 -s 192.168.0.0/16 -j ACCEPT
> iptables -A INPUT -p ALL -i lo -s 127.0.0.1 -j ACCEPT
> iptables -A INPUT -p ALL -i lo -s 192.168.0.0/16 -j ACCEPT

I don't understand why or how packets from 'lo' could
come from anything but 127.0.0.1?  Isn't the 3rd rule meaningless?
Or am I seriously mistaken?

> # (5) OUTPUT chain rules
> # only output packets with local addreses (no spoofing)
> iptables -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT
> iptables -A OUTPUT -p ALL -s 192.168.0.88 -j ACCEPT
> iptables -A OUTPUT -p ALL -s 192.168.0.0/24 -j ACCEPT

Isn't the 2nd made redundant by the 3rd rule?  If given
rule #3, you don't need rule #2.

It's definitely a good way to learn if someone can correct
my mistakes in understanding your scripts.

Thanks