Bastille/netfilter with Linux 2.6.28 blocks connections
Quoted 3 lines
Not right that "both" have the default gw to 192.168.1.1 Only the clients on 192.168.1.0/24 have to. The router (the server where you are writing the iptables rules) need another gw!
Yes, I have your mentioned setup here: clients have 192.168.1.1 as gateway and 192.168.1.1 has the PPP partner as its gateway.
Quoted 8 lines
Try
IP -F -t nat
IP -F FORWARD
IP -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
IP -A FORWARD -i eth1 -m state --state NEW -j LOG --log-prefix "NEW FW" IP -A FORWARD -i eth1 -j ACCEPT
IP -A POSTROUTING -o eth0 -m state --state NEW -j LOG --log-prefix "NEW POR" IP -A POSTROUTING -o eth0 -j MASQUERADE
I suppose I should not replace my _whole_ ruleset but a small part? Else these rules will be a little less secure.
And currently my firewall got attacked on port 110 which is (sadly!) reachable on all NICs.
So where should I add/replace your rules?
Quoted 5 lines
For this into the above iptables.list there are no rules! IP -A PREROUTING -i eth0 -p tcp --dport 30017 -j DNAT --to-destination 192.168.1.17
and add the forward one
I have a similar one already and as I said, it worked before like a sharm. :)
So the "bug" must be someone else. Okay, I put all in /etc/Bastille in a ZIP and try it from a fresh installation. Then I put my custom firewall.d back in place step-by-step.
If that is still failing I try yours but shut down a lot processes on my box. I hate that my box got hacked by some script-kiddie or spammer .... :(
I will add "netstat -lnp" soon!
Quoted 1 line
I don't know about this....
Okay, never mind. :)
Quoted 1 line
Michele
Roland
__________________________________________________________________
Deutschlands größte Online-Videothek schenkt Ihnen 12.000 Videos!*
http://entertainment.web.de/de/entertainment/maxdome/index.html
Quoted 3 lines · Roland Häder
I suppose I should not replace my _whole_ ruleset but a small part? Else these rules will be a little less secure.
Those replace only the forward one and add some debug. Of course, at the end of tests, you'll modify and replace your rules with mine :)
Quoted 3 lines
And currently my firewall got attacked on port 110 which is (sadly!) reachable on all NICs.
IP -I INPUT -m state --state NEW -p tcp --dport 110 -j ACCEPT
Quoted 2 lines
So where should I add/replace your rules?
For test, into a "running" env, so after yours.
Quoted 7 lines
Quoted 4 lines
For this into the above iptables.list there are no rules! IP -A PREROUTING -i eth0 -p tcp --dport 30017 -j DNAT --to-destination 192.168.1.17
and add the forward one
I have a similar one already and as I said, it worked before like a sharm. :)
Strange. Start with a "rule clean" and recreate the only one that do the work you want. Make them work and after, and only after, start to debug
Bye