From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Bharat (Hotmail Mithibaiguy)" Subject: Help!!! Date: Fri, 6 Sep 2002 20:28:05 +0530 Sender: netfilter-admin@lists.netfilter.org Message-ID: Reply-To: "Bharat (Hotmail Mithibaiguy)" Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0005_01C255E3.E78B04E0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.samba.org This is a multi-part message in MIME format. ------=_NextPart_000_0005_01C255E3.E78B04E0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, Your help on iptables for blocking msn was pretty useful but the way u = mentioned that u will be writing additional scripts to to make the rules = permanent after linux is booted.=20 I have successfully blocked msn but the rule just stays till i reboot = the box or restart the iptable services. Would be really obliged if u could help me on this to help me make the = rules permanent Thanks in advance Bharat=20 ------=_NextPart_000_0005_01C255E3.E78B04E0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi,

Your help on iptables for blocking msn was pretty useful but the way = u=20 mentioned that u will be writing additional scripts to to make the rules = permanent after linux is booted.

I have successfully blocked msn but the rule just stays till i reboot = the box=20 or restart the iptable services.

Would be really obliged if u could help me on this to help me make = the rules=20 permanent

Thanks in advance

Bharat

------=_NextPart_000_0005_01C255E3.E78B04E0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Tuyo Board Unilago" Subject: help!! Date: Fri, 18 Jul 2003 10:22:11 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <001b01c34d40$5c963760$6400a8c0@midway> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0018_01C34D16.73860C90" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0018_01C34D16.73860C90 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, This is probably very basic to all of you guys, but i would = apreciate a helping hand. I have a linux red hat 9.2, 2.4 kernel machine with a cable modem signal = with a DHCP ip adress from the cable company I=B4m tring to "PROXY" all services to internet : telnet, Kazaa, httpd, = etc... But the more i try, the father my goal seems. I been reading all the how to=B4s but no luck. Any help. ANY. Will be apreciated. Thanks Tuyo Isaza ------=_NextPart_000_0018_01C34D16.73860C90 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi, This is probably very basic to all = of you guys,=20 but i would apreciate a helping hand.

I have a linux red hat 9.2, = 2.4 kernel machine with a = cable modem=20 signal with a DHCP ip adress from the cable company

I=B4m tring to "PROXY" all services to = internet :=20 telnet, Kazaa, httpd, etc...

But the more i try, the father my goal=20 seems.

I been reading all the how to=B4s but = no=20 luck.

Any help. ANY. Will be = apreciated.

Thanks

Tuyo Isaza

------=_NextPart_000_0018_01C34D16.73860C90-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: btjiang@bohuatech.com Subject: Help! Date: Tue, 30 Mar 2004 09:15:52 +0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Hello, I do not understand some things about netfilter.There are two hash t= able in NAT(bysource and byipsproto).What are they used for?It's just for= fast check? Please help me! Lucky! =20 charlie From mboxrd@z Thu Jan 1 00:00:00 1970 From: radu Subject: Help!!! Date: Thu, 23 Jun 2005 14:50:54 +0300 Message-ID: <14209331.20050623145054@adm.utm.md> Reply-To: radu Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Hello all, My networck config: Internet -> linux box -> My PC(192.168.50.101) linux box eth0 local 192.168.50.0/24 eth1 Internet my iptables config: iptables -P FORWARD DROP iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j DNAT --to 192.168.50.101 iptables -I FORWARD -d 192.168.50.101 -p tcp --dport 4662 -j ACCEPT iptables -I FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -I FORWARD -s 192.168.50.101 -j ACCEPT iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE why I'm receiving on my PC packages with external ip on 4690,4544,4581.. ports??? -- Best regards, Radu mailto:radu@adm.utm.md From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Baake, Matthias" Subject: RE: Help!!! Date: Thu, 23 Jun 2005 14:00:47 +0200 Message-ID: <201E6F5AC48C274996A5AD8304FAEF869B4D@p001ex03.porta.local> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-class: urn:content-classes:message List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: radu Cc: "Netfilter (E-Mail)" hi maybe your workstation is starting the connections and the packets that = you see are just the return packets? /matthias > -----Original Message----- > From: netfilter-bounces@lists.netfilter.org > [mailto:netfilter-bounces@lists.netfilter.org]On Behalf Of radu > Sent: Thursday, June 23, 2005 1:51 PM > To: netfilter@lists.netfilter.org > Subject: Help!!! >=20 >=20 > Hello all, >=20 > My networck config: >=20 > Internet -> linux box -> My PC(192.168.50.101) >=20 > linux box > eth0 local 192.168.50.0/24 > eth1 Internet > =20 > my iptables config: >=20 > iptables -P FORWARD DROP > iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j=20 > DNAT --to 192.168.50.101 > iptables -I FORWARD -d 192.168.50.101 -p tcp --dport 4662 -j ACCEPT > iptables -I FORWARD -i eth1 -o eth0 -m state --state=20 > ESTABLISHED,RELATED -j ACCEPT > iptables -I FORWARD -s 192.168.50.101 -j ACCEPT > iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE > =20 > why I'm receiving on my PC packages with external ip on > 4690,4544,4581.. ports??? >=20 > --=20 > Best regards, > Radu mailto:radu@adm.utm.md >=20 >=20 >=20 From mboxrd@z Thu Jan 1 00:00:00 1970 From: /dev/rob0 Subject: Re: Help!!! Date: Thu, 23 Jun 2005 07:14:24 -0500 Message-ID: <200506230714.24471.rob0@gmx.co.uk> References: <14209331.20050623145054@adm.utm.md> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <14209331.20050623145054@adm.utm.md> Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: radu Cc: netfilter@lists.netfilter.org On Thursday 23 June 2005 06:50, radu wrote: > why I'm receiving on my PC packages with external ip on > 4690,4544,4581.. ports??? That would be me. I was trying to lure you into posting something on this list. ;) > Internet -> linux box -> My PC(192.168.50.101) > > linux box > eth0 local 192.168.50.0/24 > eth1 Internet > > my iptables config: > > iptables -P FORWARD DROP good > iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j DNAT > --to 192.168.50.101 4662/tcp packet arriving at the external interface should have their destination changed to Radu's computer ... > iptables -I FORWARD -d 192.168.50.101 -p tcp > --dport 4662 -j ACCEPT ... and those packets should be accepted. > iptables -I FORWARD -i eth1 -o eth0 -m state > --state ESTABLISHED,RELATED -j ACCEPT Any replies to established or related connections arriving at the external interface, destined to the internal interface, should be accepted. This is surely the rule letting those in. Check the connection tracking table when you see them come in. -- mail to this address is discarded unless "/dev/rob0" or "not-spam" is in Subject: header From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason Opperisano Subject: Re: Help!!! Date: Thu, 23 Jun 2005 10:35:39 -0400 Message-ID: <20050623143539.GA16666@bender.817west.com> References: <14209331.20050623145054@adm.utm.md> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <14209331.20050623145054@adm.utm.md> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org On Thu, Jun 23, 2005 at 02:50:54PM +0300, radu wrote: > Hello all, > > My networck config: > > Internet -> linux box -> My PC(192.168.50.101) > > linux box > eth0 local 192.168.50.0/24 > eth1 Internet > > my iptables config: > > iptables -P FORWARD DROP > iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j DNAT --to 192.168.50.101 > iptables -I FORWARD -d 192.168.50.101 -p tcp --dport 4662 -j ACCEPT > iptables -I FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT > iptables -I FORWARD -s 192.168.50.101 -j ACCEPT > iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE a cleaned-up version of your script: iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 \ -j DNAT --to 192.168.50.101 iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE iptables -P FORWARD DROP iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p tcp -d 192.168.50.101 --dport 4662 -j ACCEPT iptables -A FORWARD -s 192.168.50.101 -j ACCEPT -j -- "Meg: Oh no! I'm missing the news! Peter: We all miss The News, Meg, but Huey Lewis needs time to create, and we need to be patient." --Family Guy From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Stephan Higuti" Subject: Help! Date: Thu, 1 Jun 2006 08:53:45 -0300 Message-ID: <3da957060606010453h6488c763xcb4be5b81c8945bf@mail.gmail.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org Hello guys.... I have a question about PREROUTING and POSTROUTING. I'm making a new firewall script..... In this script, i put some PREROUTING rules , ex: ####################### Apache ########################## iptables -t nat -A PREROUTING -d 200.xxx.yyy.zzz -p tcp --dport 80 -j DNAT --to-destination 192.168.23.7:80 But i need to put some POSTROUTING rules to this? My situation: My firewall will reply for 4 differents Ip's (reals) , one for apache , other for e-mail server, etc............ This PREROUTING rule get a pack that come from internet to a IP "x" , and i want that all that incoming to this ip , to be forward to my internal ip. So , i think that PREROUTING rules its right... but i dont if i need to create a POSTROUTING for this..... Waiting Help.... p.s.:* Sorry for my bad, bad english =D Cheers -- --------------------------------------------------------------------- Stephan Higuti MSN: higutisam@hotmail.com Email: higuti@fai.com.br --------------------------------------------------------------------- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Stephan Higuti" Subject: Re: Help! Date: Thu, 1 Jun 2006 09:05:59 -0300 Message-ID: <3da957060606010505x2744ca27x85a51e9f1961ae36@mail.gmail.com> References: <3da957060606010453h6488c763xcb4be5b81c8945bf@mail.gmail.com> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="iso-8859-1"; format="flowed" To: netfilter@lists.netfilter.org thank'z Manish! But i dont understant what you mean here: > In ur scenario u will require only PREROUTING rule, but if want to > access internet behind ur friewall, then need the POSTROUTING rule > also. Choice is URs. If i want that my servers access internet? On 6/1/06, manish Jamwal wrote: > Hi > When the server's r behind the firewall, u only need PREROUTING rule > with target as DNAT. > The POSTROUTING rule is required when ur traffic will be outwards, > means u access the server's which are on ur WAN side. > In ur scenario u will require only PREROUTING rule, but if want to > access internet behind ur friewall, then need the POSTROUTING rule > also. Choice is URs. > This information is as per my knowledge. :) > Manish > > On 6/1/06, Stephan Higuti wrote: > > Hello guys.... > > I have a question about PREROUTING and POSTROUTING. > > I'm making a new firewall script..... > > In this script, i put some PREROUTING rules , ex: > > > > ####################### Apache ########################## > > iptables -t nat -A PREROUTING -d 200.xxx.yyy.zzz -p tcp --dport 80 -j > > DNAT --to-destination 192.168.23.7:80 > > > > But i need to put some POSTROUTING rules to this? > > My situation: My firewall will reply for 4 differents Ip's (reals) , > > one for apache , other for e-mail server, etc............ > > This PREROUTING rule get a pack that come from internet to a IP "x" , > > and i want that all that incoming to this ip , to be forward to my > > internal ip. > > So , i think that PREROUTING rules its right... but i dont if i need > > to create a POSTROUTING for this..... > > Waiting Help.... > > > > p.s.:* Sorry for my bad, bad english =3DD > > > > Cheers > > > > -- > > --------------------------------------------------------------------- > > Stephan Higuti > > MSN: higutisam@hotmail.com > > Email: higuti@fai.com.br > > --------------------------------------------------------------------- > > > > > --=20 --------------------------------------------------------------------- Stephan Higuti MSN: higutisam@hotmail.com Email: higuti@fai.com.br T=E9cnico em Inform=E1tica Adm servidores Linux FAI - Faculdades Adamantinenses Integradas --------------------------------------------------------------------- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Sietse van Zanen" Subject: RE: Help! Date: Thu, 1 Jun 2006 14:07:19 +0200 Message-ID: <02BB8A4AC86C564C89C7F14CF98CE0C4012783@knowledge.wizdom.nu> References: <3da957060606010453h6488c763xcb4be5b81c8945bf@mail.gmail.com> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-class: urn:content-classes:message List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: Stephan Higuti , netfilter@lists.netfilter.org You are doing it exactly as it should be done. =20 DNAT rules go to PREROUTING CHAIN (as you first want to set the new = destination and the do routing) SNAT rules go to POSTROUTING (usually, as it wouldn't really matter = where they go, unless you do source routing). =20 Ofcourse you will need to ACCEPT the connections in your filter table = too. =20 -Sietse ________________________________ From: netfilter-bounces@lists.netfilter.org on behalf of Stephan Higuti Sent: Thu 01-Jun-06 13:53 To: netfilter@lists.netfilter.org Subject: Help! Hello guys.... I have a question about PREROUTING and POSTROUTING. I'm making a new firewall script..... In this script, i put some PREROUTING rules , ex: ####################### Apache ########################## iptables -t nat -A PREROUTING -d 200.xxx.yyy.zzz -p tcp --dport 80 -j DNAT --to-destination 192.168.23.7:80 But i need to put some POSTROUTING rules to this? My situation: My firewall will reply for 4 differents Ip's (reals) , one for apache , other for e-mail server, etc............ This PREROUTING rule get a pack that come from internet to a IP "x" , and i want that all that incoming to this ip , to be forward to my internal ip. So , i think that PREROUTING rules its right... but i dont if i need to create a POSTROUTING for this..... Waiting Help.... p.s.:* Sorry for my bad, bad english =3DD Cheers -- --------------------------------------------------------------------- Stephan Higuti MSN: higutisam@hotmail.com Email: higuti@fai.com.br --------------------------------------------------------------------- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Stephan Higuti" Subject: Re: Help! Date: Thu, 1 Jun 2006 09:34:24 -0300 Message-ID: <3da957060606010534x7f0c15fcs676c0bc29d24c6a2@mail.gmail.com> References: <3da957060606010453h6488c763xcb4be5b81c8945bf@mail.gmail.com> <02BB8A4AC86C564C89C7F14CF98CE0C4012783@knowledge.wizdom.nu> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <02BB8A4AC86C564C89C7F14CF98CE0C4012783@knowledge.wizdom.nu> Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="iso-8859-1"; format="flowed" To: netfilter@lists.netfilter.org thankz for help guys! So , its right my rule? Anyway... look this image: http://img180.imageshack.us/my.php?image=3Dfirewallsemip2ok.jpg My eth0 reply for 4 reals ip's... And forward the packs to my servers......... so , PREROUTING its the right way to do this? Thank's a lot! On 6/1/06, Sietse van Zanen wrote: > You are doing it exactly as it should be done. > > DNAT rules go to PREROUTING CHAIN (as you first want to set the new desti= nation and the do routing) > SNAT rules go to POSTROUTING (usually, as it wouldn't really matter where= they go, unless you do source routing). > > Ofcourse you will need to ACCEPT the connections in your filter table too= . > > -Sietse > > ________________________________ > > From: netfilter-bounces@lists.netfilter.org on behalf of Stephan Higuti > Sent: Thu 01-Jun-06 13:53 > To: netfilter@lists.netfilter.org > Subject: Help! > > > > Hello guys.... > I have a question about PREROUTING and POSTROUTING. > I'm making a new firewall script..... > In this script, i put some PREROUTING rules , ex: > > ####################### Apache ########################## > iptables -t nat -A PREROUTING -d 200.xxx.yyy.zzz -p tcp --dport 80 -j > DNAT --to-destination 192.168.23.7:80 > > But i need to put some POSTROUTING rules to this? > My situation: My firewall will reply for 4 differents Ip's (reals) , > one for apache , other for e-mail server, etc............ > This PREROUTING rule get a pack that come from internet to a IP "x" , > and i want that all that incoming to this ip , to be forward to my > internal ip. > So , i think that PREROUTING rules its right... but i dont if i need > to create a POSTROUTING for this..... > Waiting Help.... > > p.s.:* Sorry for my bad, bad english =3DD > > Cheers > > -- > --------------------------------------------------------------------- > Stephan Higuti > MSN: higutisam@hotmail.com > Email: higuti@fai.com.br > --------------------------------------------------------------------- > > > > --=20 --------------------------------------------------------------------- Stephan Higuti MSN: higutisam@hotmail.com Email: higuti@fai.com.br T=E9cnico em Inform=E1tica Adm servidores Linux FAI - Faculdades Adamantinenses Integradas ---------------------------------------------------------------------