Re: myfirewall help

[Eric Ellis <eellis@mail.co.gilchrist.fl.us>]

Jason Opperisano wrote:
> On Thu, 2005-01-27 at 05:13, varun_saa@vsnl.net wrote:
> 
>>Hello,
>>      My server is Mandrake 10.1
>>eth0 is WAN with static IP connected to 512k DSL
>>eth1 is LAN
>>
>>I am trying to write iptables rules and I am 
>>stuck with some error.
>>
>>My iptable file is as follows :
>>
>># Generated by iptables-save v1.2.9 on Thu Oct 21 05:32:36 2004
>>*nat
>>:OUTPUT ACCEPT [0:0]
>>:PREROUTING ACCEPT [0:0]
>>:POSTROUTING ACCEPT [0:0]
>>-A POSTROUTING -o eth0 -j MASQUERADE
>>COMMIT
>># Completed on Thu Oct 21 05:32:36 2004
>># Generated by iptables-save v1.2.9 on Thu Oct 21 05:32:36 2004
>>*mangle
>>:PREROUTING ACCEPT [32056:3889577]
>>:INPUT ACCEPT [32010:3885659]
>>:FORWARD ACCEPT [0:0]
>>:OUTPUT ACCEPT [31637:4617585]
>>:POSTROUTING ACCEPT [31639:4618071]
>>COMMIT
>># Completed on Thu Oct 21 05:32:36 2004
>># Generated by iptables-save v1.2.9 on Thu Oct 21 05:32:36 2004
>>*filter
>>:FORWARD ACCEPT [0:0]
>>:INPUT DROP [0:0]
>>:OUTPUT ACCEPT [0:0]
>>-A INPUT -j ACCEPT
>>-A INPUT -s 127.0.0.1 -j ACCEPT
>>-A INPUT -p tcp -m tcp -i eth1 -o eth0 --dport 3128 --sport 80 -j ACCEPT
>>-A INPUT -p udp -m udp -i eth1 -o eth0 --dport 3128 --sport 80 -j ACCEPT
>>COMMIT
>># Completed on Thu Oct 21 05:32:36 2004
>>
>>When I am trying to save I get the following error :
>>
>>iptables-restore v1.2.9: Can't use -o with INPUT
>>
>>Error occurred at line: 25
>>Try `iptables-restore -h' or 'iptables-restore --help' for more information.
>>
>>Can anybody guide me ?
> 
> 
> yeah--you can't use "-o" with INPUT.
> 
> if you are under the impression that the traffic you're trying to filter
> has both an inbound and outbound interface and that the packet is
> FORWARD-ed from one to the other--you should be adding that rule to the
> FORWARD chain, not the INPUT chain.
> 
> btw--what traffic do you believe has a source port of 80 and a
> destination port of 3128?
> 
> -j
> 
> --
> "Oh, people can come up with statistics to prove anything, Kent. 14%
>  of people know that."
> 	--The Simpsons
Jason:

He has a squid proxy on the other side. :)  3128 is the default for squid.