ip restrition question

azure_ss · 10-04-2002, 10:19 PM

hi,all
I really want to know in redhat 7.1,how many places can I define rules to ban some ip to access my service?
Actually,I have a database service running on my linux box and it can only be accessed by the machines in the same subnet.
I do check my hosts.allow file and sure that it's fine.
And I stop ipchains and iptables.
I also check xinetd but it's a default setting there,in my understanding,xinetd is just used to control some standard service of the system like ftp,telnet.I don't know for a database service started manually,should I add a configure file there.
Besides the three places,any other files can control the ip access?
Assume that the upper level firewall is fine for any connection to my port.
Thank you so much for your reply.

DavidPhillips · 10-04-2002, 10:29 PM

well the service needs to be listening / connected to a port on the external interface for someone to connect to it.

If you let us know what the service is and give a few details about the type of connection you have we could try to help.

What software is it? How do the clients connect on the lan?

azure_ss · 10-04-2002, 10:40 PM

hi,it's db2 service listenning on port 50002 and 1678.
Actually,I can access the port in my subnet,say 126.126.10.X,but I can't access it from 126.126.X.X.I don't think it's the upper level firewall's restrition though.So wanna to check what's wrong in my linux box.

DavidPhillips · 10-04-2002, 11:22 PM

thats maybe due to the netmask, if it's not in your network and there is no rout e to it in your routing table, then it will use the default route.

azure_ss · 10-05-2002, 11:03 AM

yes,they r not in the same subnet.
say,the server is 126.126.10.X/255.255.255.0
the client is 126.126.2.X/255.255.255.255

What's the default setting of the routing?Can you show me the detail configuration for the routing table in my case?
Thanks

someuser · 10-05-2002, 11:35 AM

im not so firm but i'll try it ...

add this line to the gateway of your client subnet

route -n add 126.126.10.0 gw_ip_to_subnet

(gw_ip_to_subnet = 126.126.2.1 in most cases - it has to be the machine which has access to the 126.126.10.x subnet!)

this should work...

azure_ss · 10-05-2002, 11:42 AM

hmm,I think that's not I want.
Actually my client machine can access the http service running on the same server of the db2 service.But just can't connet to the db2 service.wierd,huh?

DavidPhillips · 10-05-2002, 10:11 PM

try running tcpdump and see what traffic you have.