From mboxrd@z Thu Jan 1 00:00:00 1970 From: Landy Landy Subject: Re: Forward ssh to an internal server not working Date: Wed, 1 Dec 2010 19:42:00 -0800 (PST) Message-ID: <680345.39820.qm@web62508.mail.re1.yahoo.com> References: Mime-Version: 1.0 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1291261320; bh=KisxH3rhLXZz2YOHVBFIVnChB2bMpNb/KnOcMh3nfyY=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=pPfWenNlE0RcREakgn0eQM+EHfFchLzz2y2VOESWdSfM0b9GvupkmgvMt1EkEXd11UI9a/uRdXD+d32elCkU2mcRP0ZCCZt7syMejMJdUcBRVjXgKLur0QFQH1r61aV3Bo3XCLDOJrDMSPCLSqtT7SR05i/gNLpXlpU9SomSqNU= In-Reply-To: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="iso-8859-1" To: Jan Engelhardt Cc: netfilter@vger.kernel.org --- On Wed, 12/1/10, Jan Engelhardt wrote: > From: Jan Engelhardt > Subject: Re: Forward ssh to an internal server not working > To: "Landy Landy" > Cc: netfilter@vger.kernel.org > Date: Wednesday, December 1, 2010, 10:29 PM > On Thursday 2010-12-02 04:27, Landy > Landy wrote: >=20 > > > >--- On Wed, 12/1/10, Jan Engelhardt > wrote: > >>> > >>>Can someone please tell me why I cannot access > a > >>>machine inside my LAN from outside? These are > my rules to > >>>try to accomplish that task: > >> > > >> >$iptables -t nat -A PREROUTING -i $EXT_IFACE > -p tcp \ > >> >=A0 =A0 =A0 =A0 -s $UNIVERSE --sport > >> $UNPRIVPORTS -d $EXT_IP --dport 22 \ > >> >=A0 =A0 =A0 =A0 -j DNAT --to-destination > >> 172.16.0.200:22 >=20 > These may not be all rules. Post complete rulesets as > output by=20 > `iptables-save` and also `ip addr` and `ip route show table > all`. >=20 Ok. IC_Server:/etc/msd# ip route show table all 190.8.46.40/29 dev eth1 proto kernel scope link src 190.8.46.42=20 172.16.0.0/16 dev eth0 proto kernel scope link src 172.16.0.1=20 default via 190.8.46.41 dev eth1=20 broadcast 127.255.255.255 dev lo table local proto kernel scope link= src 127.0.0.1=20 local 172.16.0.1 dev eth0 table local proto kernel scope host src 1= 72.16.0.1=20 broadcast 172.16.0.0 dev eth0 table local proto kernel scope link s= rc 172.16.0.1=20 broadcast 190.8.46.47 dev eth1 table local proto kernel scope link = src 190.8.46.42=20 broadcast 172.16.255.255 dev eth0 table local proto kernel scope lin= k src 172.16.0.1=20 local 190.8.46.42 dev eth1 table local proto kernel scope host src = 190.8.46.42=20 broadcast 127.0.0.0 dev lo table local proto kernel scope link src = 127.0.0.1=20 broadcast 190.8.46.40 dev eth1 table local proto kernel scope link = src 190.8.46.42=20 local 127.0.0.1 dev lo table local proto kernel scope host src 127.= 0.0.1=20 local 127.0.0.0/8 dev lo table local proto kernel scope host src 12= 7.0.0.1=20 fe80::/64 dev eth0 metric 256 mtu 1500 advmss 1440 hoplimit 429496729= 5 fe80::/64 dev eth1 metric 256 mtu 1500 advmss 1440 hoplimit 429496729= 5 default via fe80::c171:bc1:2a0b:66b9 dev eth0 proto kernel metric 102= 4 expires 0sec mtu 1500 advmss 1440 hoplimit 4294967295 unreachable default dev lo table unspec proto none metric -1 error = -101 hoplimit 255 local ::1 via :: dev lo table local proto none metric 0 mtu 16436 a= dvmss 16376 hoplimit 4294967295 local fe80::209:6bff:fe8c:bfdc via :: dev lo table local proto none = metric 0 mtu 16436 advmss 16376 hoplimit 4294967295 local fe80::209:6bff:fe8c:bfdd via :: dev lo table local proto none = metric 0 mtu 16436 advmss 16376 hoplimit 4294967295 ff00::/8 dev eth0 table local metric 256 mtu 1500 advmss 1440 hoplim= it 4294967295 ff00::/8 dev eth1 table local metric 256 mtu 1500 advmss 1440 hoplim= it 4294967295 unreachable default dev lo table unspec proto none metric -1 error = -101 hoplimit 255 IC_Server:/etc/msd# iptables-save # Generated by iptables-save v1.4.2 on Wed Dec 1 23:38:03 2010 *nat :PREROUTING ACCEPT [131:9526] :POSTROUTING ACCEPT [220:12521] :OUTPUT ACCEPT [1884:120545] -A PREROUTING -s 172.16.0.0/16 -i eth0 -p tcp -m tcp --sport 1024:65535= --dport 80 -j REDIRECT --to-ports 3128=20 -A PREROUTING -s 172.16.0.0/16 -d 172.16.0.1/32 -i eth0 -p tcp -m tcp -= -sport 1024:65535 --dport 8080 -j REDIRECT --to-ports 80=20 -A PREROUTING -d 190.8.46.42/32 -i eth1 -p tcp -m tcp --sport 1024:6553= 5 --dport 8080 -j REDIRECT --to-ports 80=20 -A PREROUTING -d 190.8.46.42/32 -i eth1 -p tcp -m tcp --dport 22 -j DNA= T --to-destination 172.16.0.200:22=20 -A PREROUTING -d 190.8.46.42/32 -i eth1 -p tcp -m tcp --sport 1:65535 -= -dport 22 -j DNAT --to-destination 172.16.0.200:22=20 -A PREROUTING -d 190.8.46.42/32 -i eth1 -p tcp -m tcp --dport 3306 -j D= NAT --to-destination 172.16.0.3:3306=20 -A POSTROUTING -o eth1 -j MASQUERADE=20 COMMIT # Completed on Wed Dec 1 23:38:03 2010 # Generated by iptables-save v1.4.2 on Wed Dec 1 23:38:03 2010 *mangle :PREROUTING ACCEPT [80016:83194298] :INPUT ACCEPT [79872:83178328] :FORWARD ACCEPT [144:15970] :OUTPUT ACCEPT [53820:39324110] :POSTROUTING ACCEPT [53950:39337140] -A PREROUTING -p tcp -m tcp --sport 22 -j TOS --set-tos 0x10/0x3f=20 -A PREROUTING -p tcp -m tcp --dport 22 -j TOS --set-tos 0x10/0x3f=20 -A PREROUTING -p tcp -m tcp --sport 2222 -j TOS --set-tos 0x10/0x3f=20 -A PREROUTING -p tcp -m tcp --dport 2222 -j TOS --set-tos 0x10/0x3f=20 -A PREROUTING -p udp -m udp --sport 53 -j TOS --set-tos 0x10/0x3f=20 -A PREROUTING -p udp -m udp --dport 53 -j TOS --set-tos 0x10/0x3f=20 -A PREROUTING -p icmp -j TOS --set-tos 0x10/0x3f=20 -A PREROUTING -p icmp -j TOS --set-tos 0x10/0x3f=20 COMMIT # Completed on Wed Dec 1 23:38:03 2010 # Generated by iptables-save v1.4.2 on Wed Dec 1 23:38:03 2010 *filter :INPUT DROP [75:89901] :FORWARD DROP [1:48] :OUTPUT ACCEPT [937:67328] :ip_check - [0:0] :p2p_check - [0:0] -A INPUT -i lo -j ACCEPT=20 -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP= =20 -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP=20 -A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP=20 -A INPUT -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP=20 -A INPUT -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP=20 -A INPUT -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP=20 -A INPUT -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP=20 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT=20 -A INPUT -m state --state INVALID -j DROP=20 -A INPUT -s 172.16.0.0/16 -d 172.16.0.1/32 -i eth0 -p tcp -m tcp --spor= t 1024:65535 --dport 3128 -m state --state NEW -j ACCEPT=20 -A INPUT -s 172.16.0.1/32 -j DROP=20 -A INPUT -s 190.8.46.42/32 -j DROP=20 -A INPUT -d 224.0.0.0/4 -p ! udp -j DROP=20 -A INPUT -p icmp -j ACCEPT=20 -A INPUT -p icmp -f -j LOG --log-prefix "Fragmented INPUTing ICMP: "=20 -A INPUT -p icmp -f -j ACCEPT=20 -A INPUT -d 190.8.46.42/32 -p icmp -m icmp --icmp-type 4 -j ACCEPT=20 -A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT=20 -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT=20 -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT=20 -A INPUT -s 172.16.0.0/16 -d 172.16.0.1/32 -i eth0 -p icmp -m icmp --ic= mp-type 8 -m state --state NEW -j ACCEPT=20 -A INPUT -s 172.16.0.0/16 -d 172.16.0.1/32 -i eth0 -p udp -m udp --spor= t 1024:65535 --dport 53 -m state --state NEW -j ACCEPT=20 -A INPUT -s 172.16.0.0/16 -d 172.16.0.1/32 -i eth0 -p tcp -m tcp --spor= t 1024:65535 --dport 53 -m state --state NEW -j ACCEPT=20 -A INPUT -i eth1 -p udp -m state --state NEW -j ACCEPT=20 -A INPUT -i eth1 -p tcp -m state --state NEW -j ACCEPT=20 -A INPUT -s 0.0.0.0/32 -d 255.255.255.255/32 -i eth0 -p udp -m udp --sp= ort 68 --dport 67 -j ACCEPT=20 -A INPUT -s 0.0.0.0/32 -d 172.16.0.1/32 -i eth0 -p udp -m udp --sport 6= 8 --dport 67 -j ACCEPT=20 -A INPUT -s 172.16.0.0/16 -d 172.16.0.1/32 -i eth0 -p udp -m udp --spor= t 68 --dport 67 -j ACCEPT=20 -A INPUT -p tcp -m tcp --dport 2222 -m state --state NEW -j ACCEPT=20 -A INPUT -s 172.16.0.0/16 -i eth0 -p tcp -m tcp --sport 1024:65535 --dp= ort 80 -m state --state NEW -j ACCEPT=20 -A INPUT -i eth1 -p tcp -m tcp --sport 1024:65535 --dport 80 -m state -= -state NEW -j ACCEPT=20 -A INPUT -s 172.16.0.0/16 -i eth0 -p tcp -m tcp --sport 1024:65535 --dp= ort 3306 -m state --state NEW -j ACCEPT=20 -A INPUT -i eth1 -p tcp -m tcp --sport 1024:65535 --dport 3306 -m state= --state NEW -j ACCEPT=20 -A INPUT -s 190.8.46.42/32 -p udp -m udp --sport 3279:65535 --dport 334= 34:33523 -j ACCEPT=20 -A INPUT -i eth0 -p udp -m udp --dport 123 -m state --state NEW -j ACCE= PT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -j ip_check=20 -A FORWARD -j p2p_check=20 -A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DR= OP=20 -A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP=20 -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP=20 -A FORWARD -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP=20 -A FORWARD -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP=20 -A FORWARD -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP=20 -A FORWARD -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP=20 -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT=20 -A FORWARD -m state --state INVALID -j DROP=20 -A FORWARD -d 172.16.0.200/32 -i eth1 -o eth0 -p tcp -m tcp --dport 22 = -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.200/32 -i eth0 -o eth1 -p tcp -m tcp --sport 22 = -m state --state RELATED,ESTABLISHED -j ACCEPT=20 -A FORWARD -s 172.16.0.1/32 -j DROP=20 -A FORWARD -s 190.8.46.42/32 -j DROP=20 -A FORWARD -s ! 172.16.0.0/16 -i eth0 -j DROP=20 -A FORWARD -s ! 172.16.0.1/32 -o eth0 -j DROP=20 -A FORWARD -d 255.255.255.255/32 -j DROP=20 -A FORWARD -d 224.0.0.0/4 -p ! udp -j DROP=20 -A FORWARD -p icmp -f -j LOG --log-prefix "Fragmented FORWARDED ICMP: "= =20 -A FORWARD -p icmp -f -j ACCEPT=20 -A FORWARD -p icmp -m icmp --icmp-type 4 -j ACCEPT=20 -A FORWARD -p icmp -m icmp --icmp-type 12 -j ACCEPT=20 -A FORWARD -p icmp -m icmp --icmp-type 3 -j ACCEPT=20 -A FORWARD -p icmp -m icmp --icmp-type 3/4 -j ACCEPT=20 -A FORWARD -o eth0 -p icmp -m icmp --icmp-type 3 -j ACCEPT=20 -A FORWARD -d 172.16.0.0/16 -o eth0 -p icmp -m icmp --icmp-type 11 -j A= CCEPT=20 -A FORWARD -s 172.16.0.0/16 -p icmp -m icmp --icmp-type 8 -m state --st= ate NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p udp -m udp --sport 1024:= 65535 --dport 53 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 53 -m state --state NEW -j ACCEPT=20 -A FORWARD -d 172.16.0.200/32 -i eth1 -o eth0 -p tcp -m tcp --sport 1:6= 5535 --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 22 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 2222 -m state --state NEW -j ACCEPT=20 -A FORWARD -i eth1 -o eth0 -p tcp -m tcp --dport 8444 -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 80 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 8080 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 81 -m state --state NEW -j ACCEPT=20 -A FORWARD -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 --dport 808= 0 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 443 -m state --state NEW -j ACCEPT=20 -A FORWARD -d 172.16.0.3/32 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:= 65535 --dport 3306 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 25 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 110 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 21 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 1863 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 6891 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p udp -m udp --sport 1024:= 65535 --dport 6891 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 6900 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p udp -m udp --sport 1024:= 65535 --dport 6900 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 23399 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p udp -m udp --sport 3279:= 65535 --dport 33434:33523 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 5050:5100 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 11999 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 51127 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -p tcp -m tcp --sport 1024:65535 --= dport 8636 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -p udp -m udp --sport 1024:65535 --= dport 123 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -p tcp -m tcp --sport 1024:65535 --= dport 6112 -m state --state NEW -j ACCEPT=20 -A FORWARD -s 172.16.0.0/16 -i eth0 -o eth1 -p tcp -m tcp --sport 1024:= 65535 --dport 8090 -m state --state NEW -j ACCEPT=20 -A OUTPUT -o lo -j ACCEPT=20 -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT=20 -A OUTPUT -m state --state INVALID -j DROP=20 -A OUTPUT -s 172.16.0.1/32 -o eth0 -p tcp -m tcp --sport 80 --dport 102= 4:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT=20 -A OUTPUT -s ! 172.16.0.1/32 -o eth0 -j DROP=20 -A OUTPUT -s 0.0.0.0/32 -d 255.255.255.255/32 -o eth0 -p udp -m udp --s= port 67 --dport 68 -j ACCEPT=20 -A OUTPUT -p icmp -f -j LOG --log-prefix "Fragmented OUTPUTing ICMP: "=20 -A OUTPUT -p icmp -f -j ACCEPT=20 -A OUTPUT -p icmp -m icmp --icmp-type 4 -j ACCEPT=20 -A OUTPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT=20 -A OUTPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT=20 -A OUTPUT -p icmp -m icmp --icmp-type 3/4 -j ACCEPT=20 -A OUTPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT=20 -A OUTPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW -j ACCEPT=20 -A OUTPUT -s 0.0.0.0/32 -d 255.255.255.255/32 -o eth0 -p udp -m udp --s= port 67 --dport 68 -j ACCEPT=20 -A OUTPUT -s 172.16.0.1/32 -d 255.255.255.255/32 -o eth0 -p udp -m udp = --sport 67 --dport 68 -j ACCEPT=20 -A OUTPUT -s 172.16.0.1/32 -d 172.16.0.0/16 -o eth0 -p udp -m udp --spo= rt 67 --dport 68 -j ACCEPT=20 -A OUTPUT -s 172.16.0.1/32 -d 172.16.0.0/16 -o eth0 -p udp -m udp --spo= rt 67 --dport 68 -j ACCEPT=20 -A OUTPUT -s 172.16.0.1/32 -d 172.16.0.200/32 -o eth0 -p tcp -m tcp --s= port 1024:65535 --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j = ACCEPT=20 -A OUTPUT -s 190.8.46.42/32 -o eth1 -p tcp -m tcp --sport 1024:65535 --= dport 80 -m state --state NEW -j ACCEPT=20 -A OUTPUT -s 190.8.46.42/32 -o eth1 -p tcp -m tcp --sport 1024:65535 --= dport 443 -m state --state NEW -j ACCEPT=20 -A OUTPUT -s 190.8.46.42/32 -o eth1 -p tcp -m tcp --sport 1024:65535 --= dport 21 -m state --state NEW -j ACCEPT=20 -A OUTPUT -s 190.8.46.42/32 -o eth1 -p udp -m udp --sport 3279:65535 --= dport 33434:33523 -j ACCEPT=20 -A OUTPUT -s 190.8.46.42/32 -o eth1 -p tcp -m tcp --sport 1024:65535 --= dport 8090 -m state --state NEW -j ACCEPT=20 -A ip_check -s 172.16.100.1/32 -j RETURN=20 -A ip_check -s 172.16.100.10/32 -j RETURN=20 -A ip_check -s 172.16.100.11/32 -j RETURN=20 -A ip_check -s 172.16.100.12/32 -j RETURN=20 -A ip_check -s 172.16.100.13/32 -j RETURN=20 -A ip_check -s 172.16.100.14/32 -j RETURN=20 -A ip_check -s 172.16.100.2/32 -j RETURN=20 -A ip_check -s 172.16.100.3/32 -j RETURN=20 -A ip_check -s 172.16.100.5/32 -j RETURN=20 -A ip_check -s 172.16.100.7/32 -j RETURN=20 -A ip_check -s 172.16.100.8/32 -j RETURN=20 -A ip_check -s 172.16.100.9/32 -j RETURN=20 -A ip_check -s 172.16.200.200/32 -j RETURN=20 -A ip_check -s 172.16.0.200/32 -j RETURN=20 -A ip_check -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT=20 -A ip_check -s 172.16.0.0/16 -i eth0 -j REJECT --reject-with icmp-net-p= rohibited=20 -A p2p_check -s 172.16.100.1/32 -j ACCEPT=20 -A p2p_check -d 172.16.100.1/32 -j ACCEPT=20 -A p2p_check -s 172.16.100.2/32 -j ACCEPT=20 -A p2p_check -d 172.16.100.2/32 -j ACCEPT=20 -A p2p_check -s 172.16.100.5/32 -j ACCEPT=20 -A p2p_check -d 172.16.100.5/32 -j ACCEPT=20 -A p2p_check -j RETURN=20 COMMIT # Completed on Wed Dec 1 23:38:03 2010 IC_Server:/etc/msd# ip addr 1: lo: mtu 16436 qdisc noqueue state UNKNOWN=20 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host=20 valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc pfifo_fast st= ate UP qlen 1000 link/ether 00:09:6b:8c:bf:dc brd ff:ff:ff:ff:ff:ff inet 172.16.0.1/16 brd 172.16.255.255 scope global eth0 inet6 fe80::209:6bff:fe8c:bfdc/64 scope link=20 valid_lft forever preferred_lft forever 3: eth1: mtu 1500 qdisc pfifo_fast st= ate UP qlen 1000 link/ether 00:09:6b:8c:bf:dd brd ff:ff:ff:ff:ff:ff inet 190.8.46.42/29 brd 190.8.46.47 scope global eth1 inet6 fe80::209:6bff:fe8c:bfdd/64 scope link=20 valid_lft forever preferred_lft forever =20