Re: Ipchains help

From: Nigel Wade (nmw_at_ion.le.ac.uk)
Date: 09/03/04

  • Next message: NeoSadist: "Re: File and Printer Sharing bug with Norton Personal Firewall 2004" 
    Date: Fri, 03 Sep 2004 16:01:43 +0100

    On Thu, 02 Sep 2004 10:19:53 -0700, Robert Law wrote:

    > Nigel Wade <nmw@ion.le.ac.uk> wrote in message news:<pan.2004.09.02.10.39.32.859925@ion.le.ac.uk>...
    >> On Wed, 01 Sep 2004 19:17:15 -0700, Robert Law wrote:
    >>
    >> > I am using ipchains and am trying to do two things that I seem to be
    >> > unable to figure out.
    >> >
    >> > The first thing is I want to disable outgoing http over port 80 since
    >> > I'm using squid. The second thing is that I would like to disable all
    >> > outgoing traffic from my network at certain times. I know how to
    >> > conditionally execute the script but it doesn't seem to disable the
    >> > traffic.
    >> >
    >> > I have a linux box acting as a router and it is masquerading the boxes
    >> > on the internal network.
    >> >
    >> > Here is my ipchains stmt.
    >> > ipchains -A input -p tcp -s 192.168.1.0/24 -d \! 192.168.1.0/24
    >> > --destination-port 80 -j DENY
    >> >
    >> > To cancel all output i think this should work.
    >> > ipchains -a output -d \! 192.168.1.0/24 -j DENY
    >> >
    >> > Any help is greatly appreciated.
    >> >
    >> > Thanks.
    >>
    >> Don't forget that those rules are being *added* to the chains. If any rule
    >> prior to those accepts the packet then the rule won't be reached.
    >>
    >> The easiest way to turn of packet forwarding entirely is to echo 0 into
    >> /proc/sys/net/ipv4/ip_forward (dependent on kernel version, which you
    >> don't mention).
    >
    > I can use the ip_forward okay. I have the first statement as the one
    > just after I have flushed everything and set the default deny rules.
    > What I'm wondering, is why doesn't it work.

    I can't see anything obviously wrong with it. I don't really know ipchains
    that well, I use iptables.

    You might add a new chain and jump into that chain rather than DENY. Then
    you can log the packets traversing that chain. Turn on logging on all
    chains and see if you can determine where those packets are being
    accepted. 

    -- 
Nigel Wade, System Administrator, Space Plasma Physics Group,
            University of Leicester, Leicester, LE1 7RH, UK 
E-mail :    nmw@ion.le.ac.uk 
Phone :     +44 (0)116 2523548, Fax : +44 (0)116 2523555
  • Next message: NeoSadist: "Re: File and Printer Sharing bug with Norton Personal Firewall 2004"

    Relevant Pages

    • iptables questions
      ... FORWARD chain because if no connection has been established from my ... the packet will be handled by the INPUT ... supported and how would I go about having other protocols recognised? ...
      (comp.os.linux.security)
    • Re: iptables for linux router/firewall on home lan
      ... >if from localhost jump to lorules ... logreject (log and reject a packet) ... >if match rule1 jump to ACCEPT ... >I think the DROP all at the end of each custom chain is unnecessary, ...
      (comp.os.linux.networking)
    • Re: how to start iptables on dsl ppp0
      ... reaches the end of the chain will get dropped, ... Assume a packet would get dropped by a rule early in the chain. ... This disussion is only about setting up an entire ruleset. ... Kasper Dupont -- der bruger for meget tid på usenet. ...
      (comp.os.linux.security)
    • Re: iptables forwarding question
      ... of packet loss or RTTs or is something else entirely happening? ... What does your route table look ... Chain FORWARD (policy ACCEPT) ...
      (Fedora)
    • Re: iptables support?
      ... For example, if the first rule in your chain is to ACCEPT incoming traffic on port 80 to your machine then packets that come in to port 80 on your machine match the first rule and are accepted, no longer following the rest of the chain. ... It is what happens if a packet failed to match any of the ACCEPTs in your chain, ... So in your example one of the first thing you do is define the policy of the chain, or what will happen if a packet doesn't match any of the rules you add later. ...
      (Fedora)
    • Quantcast