From: "Gáspár Lajos" <swifty@freemail.hu>
To: Javi Legido <javi@legido.com>
Cc: Netfilter list <netfilter@vger.kernel.org>
Subject: Re: Iptables with Apache - virtualhosts by name
Date: Tue, 16 Dec 2008 16:26:24 +0100 [thread overview]
Message-ID: <4947C8A0.5070606@freemail.hu> (raw)
In-Reply-To: <22552e810812160607m3a2d202dt82ded7d9425fce13@mail.gmail.com>
Hi,
Javi Legido írta:
> Hi.
>
> i have the following machines:
>
> [Router] <=> [Server]
>
> I have a Apache with virtual hosts by name working properly in the
> server. But when i 'turn on' iptables, it's impossible to connect to
> ANY page.
>
Is these rules are on your Server or on the Router?
I assume that these are the Router's rules because of the FORWARD part...
> iptables -S
>
> -P INPUT ACCEPT
> -P FORWARD ACCEPT
> -P OUTPUT ACCEPT
> -A INPUT -s public_ip_pc_132 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
> -A INPUT -s public_ip_pc_132 -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
> -A INPUT -s 192.168.1.31/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
> -A INPUT -s public_ip_pc_2/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
> -A INPUT -s public_ip_pc_2/32 -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
> -A INPUT -s public_ip_pc_3/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
> -A INPUT -s public_ip_pc_3/32 -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
> -A INPUT -s 192.168.1.30/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
Why do you check the source addresses ???
eth0 is your WAN interface ???
And you should use the conntracking system...
> -A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
This line should have enabled the connection... So you have a different
problem...
> -A INPUT -i eth0 -p tcp -m tcp --sport 80 -j ACCEPT
sport ???? why???
> -A INPUT -i eth0 -p tcp -m tcp --dport 4080 -j ACCEPT
> -A INPUT -i eth0 -p udp -m udp --dport 4080 -j ACCEPT
> -A INPUT -i eth0 -p tcp -m tcp --dport 21 -j ACCEPT
> -A INPUT -i eth0 -p udp -m udp --dport 21 -j ACCEPT
> -A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
> -A INPUT -i eth0 -p tcp -m tcp --sport 23 -j ACCEPT
> -A INPUT -i lo -j ACCEPT
I would ACCEPT all "lo" traffic first in my list...
> -A INPUT -j REJECT --reject-with icmp-port-unreachable
> -A FORWARD -p tcp -m tcp --dport 9999 -j ACCEPT
> -A FORWARD -p tcp -m tcp --dport 6882 -j ACCEPT
> -A FORWARD -p udp -m udp --dport 5865 -j ACCEPT
> -A FORWARD -p tcp -m tcp --dport 5865 -j ACCEPT
> -A FORWARD -p udp -m udp --dport 8443 -j ACCEPT
> -A FORWARD -p tcp -m tcp --dport 8443 -j ACCEPT
> -A FORWARD -p udp -m udp --dport 4666 -j ACCEPT
> -A FORWARD -p tcp -m tcp --dport 4662 -j ACCEPT
> -A FORWARD -j REJECT --reject-with icmp-port-unreachable
>
So... If it is on the Router then please show the NAT part also...
iptables -S -t nat
If it is on the Server then why do you check the source addresses and
why do you have any FORWARDing ???
Swifty
prev parent reply other threads:[~2008-12-16 15:26 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-12-16 14:07 Iptables with Apache - virtualhosts by name Javi Legido
2008-12-16 15:26 ` Gáspár Lajos [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4947C8A0.5070606@freemail.hu \
--to=swifty@freemail.hu \
--cc=javi@legido.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox