* Configurationrequest for firewall with temporary ppp0-interface
@ 2005-06-30 9:23 Ruprecht Helms
2005-06-30 10:27 ` /dev/rob0
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Ruprecht Helms @ 2005-06-30 9:23 UTC (permalink / raw)
To: netfilter
Hi,
I've the problem that I need some rules for a temporary ppp0 interface.
This interface is only active then the admin has made a dial-up on the
server and has activated a ppp-daemon.
In the time the ppp0-Interface is up the connections should be able
completely in both directions and through to clients. But this should
only alowed for connections via ppp0.
Connections via the normal isdn0 should be protected by the normal
firewallroules (iptables).
How have I to configure.
Regards,
Ruprecht
------------------------------------------------------------------------------------------
Ruprecht Helms IT-Service & Softwareentwicklung
Tel./Fax +49[0]7621 16 99 16
Web: htp://www.rheyn.de
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: Configurationrequest for firewall with temporary ppp0-interface
2005-06-30 9:23 Configurationrequest for firewall with temporary ppp0-interface Ruprecht Helms
@ 2005-06-30 10:27 ` /dev/rob0
2005-07-01 0:43 ` Christoph Georgi
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: /dev/rob0 @ 2005-06-30 10:27 UTC (permalink / raw)
To: netfilter
On Thursday 30 June 2005 04:23, Ruprecht Helms wrote:
> I've the problem that I need some rules for a temporary ppp0
> interface. This interface is only active then the admin has made a
> dial-up on the server and has activated a ppp-daemon.
>
> In the time the ppp0-Interface is up the connections should be able
> completely in both directions and through to clients. But this should
> only alowed for connections via ppp0.
If this is your only ppp+ interface it is easy. You can add your rules
to the existing firewall and leave them there.
If there are other ppp+ interfaces which should be more restricted, it
is only slightly more difficult. pppd(8) has a feature to run scripts
when an interface goes active and inactive, /etc/ppp/ip-{up,down}
respectively. Put your rules to open the interface in ip-up and to
close it in ip-down. (Some distributors use ip-{up,down}.local for
local additions.)
--
mail to this address is discarded unless "/dev/rob0"
or "not-spam" is in Subject: header
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: Configurationrequest for firewall with temporary ppp0-interface
2005-06-30 9:23 Configurationrequest for firewall with temporary ppp0-interface Ruprecht Helms
2005-06-30 10:27 ` /dev/rob0
@ 2005-07-01 0:43 ` Christoph Georgi
2005-07-01 17:40 ` Seferovic Edvin
2005-07-03 13:56 ` Jan Engelhardt
3 siblings, 0 replies; 6+ messages in thread
From: Christoph Georgi @ 2005-07-01 0:43 UTC (permalink / raw)
To: rhelms; +Cc: netfilter
Just create rules specifying ppp0 as incoming and outgoing interface (-i
and -o), e.g.
$IPTABLES -A FORWARD -i eth0 -o ppp0 -j ACCEPT
$IPTABLES -A FORWARD -o eth0 -i ppp0 -j ACCEPT
christoph
Ruprecht Helms wrote:
> Hi,
>
> I've the problem that I need some rules for a temporary ppp0 interface.
> This interface is only active then the admin has made a dial-up on the
> server and has activated a ppp-daemon.
>
> In the time the ppp0-Interface is up the connections should be able
> completely in both directions and through to clients. But this should
> only alowed for connections via ppp0.
>
> Connections via the normal isdn0 should be protected by the normal
> firewallroules (iptables).
>
> How have I to configure.
>
> Regards,
> Ruprecht
>
> ------------------------------------------------------------------------------------------
>
> Ruprecht Helms IT-Service & Softwareentwicklung
>
> Tel./Fax +49[0]7621 16 99 16
> Web: htp://www.rheyn.de
>
>
--
Christoph Georgi
-----------------------------
email. christoph.georgi@web.de
fon. +64 (0)9 815 8259
registered linux user #380268
ubuntu 5.04 (ubuntu.com)
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Configurationrequest for firewall with temporary ppp0-interface
2005-06-30 9:23 Configurationrequest for firewall with temporary ppp0-interface Ruprecht Helms
2005-06-30 10:27 ` /dev/rob0
2005-07-01 0:43 ` Christoph Georgi
@ 2005-07-01 17:40 ` Seferovic Edvin
2005-07-03 13:56 ` Jan Engelhardt
3 siblings, 0 replies; 6+ messages in thread
From: Seferovic Edvin @ 2005-07-01 17:40 UTC (permalink / raw)
To: netfilter
Well if you are using NAT then you can say that ppp+ should be NATed to your
extern interface.. should be to complicated? :) pppd brings up a new
interface and adds a route to it, so you dont have to worry about this.
Regards,
Edvin Seferovic
-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Ruprecht Helms
Sent: Donnerstag, 30. Juni 2005 11:24
To: netfilter@lists.netfilter.org
Subject: Configurationrequest for firewall with temporary ppp0-interface
Hi,
I've the problem that I need some rules for a temporary ppp0 interface.
This interface is only active then the admin has made a dial-up on the
server and has activated a ppp-daemon.
In the time the ppp0-Interface is up the connections should be able
completely in both directions and through to clients. But this should
only alowed for connections via ppp0.
Connections via the normal isdn0 should be protected by the normal
firewallroules (iptables).
How have I to configure.
Regards,
Ruprecht
----------------------------------------------------------------------------
--------------
Ruprecht Helms IT-Service & Softwareentwicklung
Tel./Fax +49[0]7621 16 99 16
Web: htp://www.rheyn.de
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Configurationrequest for firewall with temporary ppp0-interface
2005-06-30 9:23 Configurationrequest for firewall with temporary ppp0-interface Ruprecht Helms
` (2 preceding siblings ...)
2005-07-01 17:40 ` Seferovic Edvin
@ 2005-07-03 13:56 ` Jan Engelhardt
3 siblings, 0 replies; 6+ messages in thread
From: Jan Engelhardt @ 2005-07-03 13:56 UTC (permalink / raw)
To: Ruprecht Helms; +Cc: netfilter
> Hi,
>
> I've the problem that I need some rules for a temporary ppp0 interface.
> This interface is only active then the admin has made a dial-up on the server
> and has activated a ppp-daemon.
Maybe it's been said, or not:
You can have iptables rules for devices even if they do not exist or are
turned off (`a la "ip link set down")
Jan Engelhardt
--
| Gesellschaft fuer Wissenschaftliche Datenverarbeitung Goettingen,
| Am Fassberg, 37077 Goettingen, www.gwdg.de
^ permalink raw reply [flat|nested] 6+ messages in thread
* Configurationrequest for firewall with temporary ppp0-interface
@ 2005-06-30 12:49 Ruprecht Helms
0 siblings, 0 replies; 6+ messages in thread
From: Ruprecht Helms @ 2005-06-30 12:49 UTC (permalink / raw)
To: netfilter
Hi,
I've the problem that I need some rules for a temporary ppp0 interface.
This interface is only active then the admin has made a dial-up on the
server and has activated a ppp-daemon.
In the time the ppp0-Interface is up the connections should be able
completely in both directions and through to clients. But this should
only alowed for connections via ppp0.
Connections via the normal isdn0 should be protected by the normal
firewallroules (iptables).
How have I to configure.
Regards,
Ruprecht
------------------------------------------------------------------------------------------
Ruprecht Helms IT-Service & Softwareentwicklung
Tel./Fax +49[0]7621 16 99 16
Web: htp://www.rheyn.de
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2005-07-03 13:56 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-06-30 9:23 Configurationrequest for firewall with temporary ppp0-interface Ruprecht Helms
2005-06-30 10:27 ` /dev/rob0
2005-07-01 0:43 ` Christoph Georgi
2005-07-01 17:40 ` Seferovic Edvin
2005-07-03 13:56 ` Jan Engelhardt
-- strict thread matches above, loose matches on Subject: below --
2005-06-30 12:49 Ruprecht Helms
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox