Re: Ipchains and smtp rule

From: Steffen Dettmer (steffen@dett.de)
Date: 11/20/01 

Date: Tue, 20 Nov 2001 09:12:43 +0100
From: Steffen Dettmer <steffen@dett.de>
To: focus-linux <focus-linux@securityfocus.com>
Subject: Re: Ipchains and smtp rule
Message-ID: <20011120091243.C4583@dx.net.de>

* Mogens Valentin wrote on Mon, Nov 19, 2001 at 17:55 +0100:
> ipchains -A -p tcp -s 0/0 -d 0/0 smtp -j accept or even

This rule isn't of correct syntax. Did you misstyped in this mail
or in the script? Try:

ipchains -I input -p tcp -s 0/0 -d 0/0 smtp -j ACCEPT

> ipchains -A input -p tcp -i $PUBLICIFC ! -y -j ACCEPT

SMTP needs -y packets at first of course, and if you accept only
non-SYN packets, no TCP handshake could be established.

> There's a whole bunch of rules, so please ask for what's needed.

I would suggest to add a log rule like:
ipchains -A input -j REJECT --log
or similar to have the rejects (or denies) in the syslog. Then
you see if something get's blocked accidentially.

oki,

Steffen 

-- 
Dieses Schreiben wurde maschinell erstellt,
es trägt daher weder Unterschrift noch Siegel.

Relevant Pages

  • Re: A Question On Ipchains Input Rules
    ... If RH72 allows using iptables instead of ipchains, ... return packets for any established connections, ... outbound SMTP sessions, you just allow outbound SMTP, and the ...
    (comp.os.linux.security)
  • Ipchains masquerading and NETBIOS
    ... I need to filter packets directed to a Windows NT server, ... as a masquerading firewall with two network interface cards to ... In the firewall logs there is no trace of the denied netbios packets, ... I have always controlled with "ipchains -L" the ...
    (comp.security.firewalls)
  • Ipchains masquerading and NETBIOS
    ... I need to filter packets directed to a Windows NT server, ... as a masquerading firewall with two network interface cards to ... In the firewall logs there is no trace of the denied netbios packets, ... I have always controlled with "ipchains -L" the ...
    (comp.security.firewalls)
  • Re: Doubts with iptables (or ipchains)
    ... > (well, I guess the moral is to just not use ipchains, ... Usually in TCP connection the very first packet ... know with quite good accuracy which packets will ... The INPUT chain is ...
    (comp.os.linux.security)
  • Re: Doubts with iptables (or ipchains)
    ... >>How do I state a rule that distinguishes packets ... done with ipchains (using some alternative ... a setup with a Linux gateway connected to a DSL ... always go through the INPUT chain, ...
    (comp.os.linux.security)