Re: iptables & tcp wrappers
From: Toby Heywood (toby.heywood_at_doofruds.net)
Date: 09/28/04
- Previous message: Whelan, Paul: "RE: iptables & tcp wrappers"
- In reply to: Meatplow: "iptables & tcp wrappers"
- Next in thread: Bowes, Ronald (EST): "RE: iptables & tcp wrappers"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 27 Sep 2004 23:02:25 +0100 To: Meatplow <greg@meatplow.com>
I have to admit that I am not the best to advise on iptables but I
believe I can answer your questions.
Try using
#iptables -A INPUT -p tcp -s PUT_IP_HERE -d 0/0 --syn -j LOG
#iptables -A INPUT -p tcp -s PUT_IP_HERE -d 0/0 --syn -j DROP
For additional security I would restrict the interface that you expect
traffic to come in on as well. For example;
#iptables -A INPUT -i eth2 -s ip_address -d 0/0 -p tcp --syn -j DROP
If you want line numbers then try;
#iptables -L -v --line-numbers
With regards to blocking access to ssh and allowing from only a
specified ip, if would do the following
1) #iptables -P INPUT DROP
2) #iptables -A INPUT -i eth2 -s example_ip -d ip_of_server -p tcp -m
tcp --dport ssh -m state --state NEW,ESTABLISHED -j ACCEPT
Step one sets the default policy for the INPUT table, thus dropping all
incoming traffic. Step two allows ssh access from the specified ip only
if it is coming in via interface eth2.
Hope this is what you wanted.
Toby
Meatplow wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>
>Hello.
>
>I'm running RH Enterprise edition.
>
>I'm relatively new to iptables. I am getting the common intrusion
>attempts with some of the common uses of test/guest/root/ and a
>couple others I've been able to add the IPs to the to iptables.,
>but
>I'd really like a log that tells me the info that I want to know.
>
>My basic input command is this :
>#iptables -A INPUT -p tcp -s PUT_IP_HERE -d 0/0 --syn -j DROP
>
>iptables seem a little convoluted. Example. To delete a line -
>supposedly give it a line and it will be deleted/modified. My
>problem is even with #iptable -L -v there is no line number ?
>
>My goal is to block all incoming ssh attempts except IP#.
>This is where I got into hosts.allow/deny as mentioned below.
>
>I've tried to find many different types of commands and it works to
>some degree, but not the way I'd expect it to.
>
>Any help would be appreciated. I'm not completely sure that I
>understand iptables as well as I want/need to. I've also toyed
>around with the hosts.allow/hosts.deny and have not been successful.
>
>
>
>I know that there is a lot of info in here, and I'm tired. I'll
>leave it at that
>
>
>Thanks in advance for your time and help.
>
>Meatplow
>greg ta meatplow.com
>
>
>Thanks again.
>
>-----BEGIN PGP SIGNATURE-----
>Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>
>
>iQA/AwUBQVSBsR42gIcyjrnjEQJIqwCfWAShp7r+J1XNNjQq6sbvvD03WZ8AoNrg
>ctQ837g5pQDafgBhTTeeMr1V
>=niWK
>-----END PGP SIGNATURE-----
>
>
>
>
>
>
>
- application/x-pkcs7-signature attachment: S/MIME Cryptographic Signature
- Previous message: Whelan, Paul: "RE: iptables & tcp wrappers"
- In reply to: Meatplow: "iptables & tcp wrappers"
- Next in thread: Bowes, Ronald (EST): "RE: iptables & tcp wrappers"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
