LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-06-2003, 01:24 AM   #1
DaveL
LQ Newbie
 
Registered: Jan 2003
Posts: 4

Rep: Reputation: 0
iptables ruleset for nameserver


i've a ruleset for my nameserver. some of the packets are dropped going out. can anyone help me to intepret why these packets are dropped. is ther e something wrong with the ruleset.

localhost kernel: OUTPUT IN= OUT=ppp0 SRC=AAA.BBB.CCC.DDD DST=aaa.bbb.ccc.ddd LEN=168 TOS=0x00 PREC=0xC0 TTL=64 ID=25909 PROTO=ICMP TYPE=3 CODE=3 [SRC=aaa.bbb.ccc.ddd DST=AAA.BBB.CCC.DDD LEN=140 TOS=0x00 PREC=0x00 TTL=55 ID=34974 PROTO=UDP SPT=53 DPT=1036 LEN=120 ]
localhost kernel: OUTPUT IN= OUT=ppp0 SRC=AAA.BBB.CCC.DDD DST=aaa.bbb.ccc.ddd LEN=200 TOS=0x00 PREC=0xC0 TTL=64 ID=17833 PROTO=ICMP TYPE=3 CODE=3 [SRC=aaa.bbb.ccc.ddd DST=AAA.BBB.CCC.DDD LEN=172 TOS=0x00 PREC=0x00 TTL=246 ID=47063 DF PROTO=UDP SPT=53 DPT=1035 LEN=152 ]
localhost kernel: OUTPUT IN= OUT=ppp0 SRC=AAA.BBB.CCC.DDD DST=aaa.bbb.ccc.ddd LEN=184 TOS=0x00 PREC=0xC0 TTL=64 ID=25910 PROTO=ICMP TYPE=3 CODE=3 [SRC=aaa.bbb.ccc.ddd DST=AAA.BBB.CCC.DDD LEN=156 TOS=0x00 PREC=0x00 TTL=55 ID=46179 PROTO=UDP SPT=53 DPT=1037 LEN=136 ]
localhost kernel: OUTPUT IN= OUT=ppp0 SRC=AAA.BBB.CCC.DDD DST=aaa.bbb.ccc.ddd LEN=232 TOS=0x00 PREC=0xC0 TTL=64 ID=17834 PROTO=ICMP TYPE=3 CODE=3 [SRC=aaa.bbb.ccc.ddd DST=AAA.BBB.CCC.DDD LEN=204 TOS=0x00 PREC=0x00 TTL=246 ID=47065 DF PROTO=UDP SPT=53 DPT=1036 LEN=184 ]
localhost kernel: OUTPUT IN= OUT=ppp0 SRC=AAA.BBB.CCC.DDD DST=aaa.bbb.ccc.ddd LEN=561 TOS=0x00 PREC=0xC0 TTL=64 ID=25911 PROTO=ICMP TYPE=3 CODE=3 [SRC=aaa.bbb.ccc.ddd DST=AAA.BBB.CCC.DDD LEN=533 TOS=0x00 PREC=0x00 TTL=55 ID=54026 PROTO=UDP SPT=53 DPT=1038 LEN=513 ]
localhost kernel: OUTPUT IN= OUT=ppp0 SRC=AAA.BBB.CCC.DDD DST=aaa.bbb.ccc.ddd LEN=561 TOS=0x00 PREC=0xC0 TTL=64 ID=17835 PROTO=ICMP TYPE=3 CODE=3 [SRC=aaa.bbb.ccc.ddd DST=AAA.BBB.CCC.DDD LEN=533 TOS=0x00 PREC=0x00 TTL=246 ID=47067 DF PROTO=UDP SPT=53 DPT=1037 LEN=513 ]

my ip address=AAA.BBB.CCC.DDD
name server=aaa.bbb.ccc.ddd

thanks in advance for any help
 
Old 01-06-2003, 11:47 AM   #2
niknah
Member
 
Registered: Dec 2002
Location: In front of a computer
Distribution: UPS, DHL, FedEx
Posts: 466

Rep: Reputation: 38
you'd have to post your ruleset, it's something wrong with the OUTPUT chain obviously.
 
Old 01-06-2003, 10:24 PM   #3
DaveL
LQ Newbie
 
Registered: Jan 2003
Posts: 4

Original Poster
Rep: Reputation: 0
thanks for the attention. the following are the rulesets:

-A OUTPUT -d 192.x.x.x -o ppp0 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -d 192.y.y.y -o ppp0 -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

i've no problems with the firewall, just that the logs showed dropped icmp packets to my nameservers and i want to know why that happened. thanks
 
Old 01-06-2003, 10:54 PM   #4
niknah
Member
 
Registered: Dec 2002
Location: In front of a computer
Distribution: UPS, DHL, FedEx
Posts: 466

Rep: Reputation: 38
your ip addresses from the first message are different from the ones in the 2nd message, and which computer is the firewall on, the name server or somewhere else? and where'd those logs from the first message come from, name server or your computer?
 
Old 01-07-2003, 01:11 AM   #5
DaveL
LQ Newbie
 
Registered: Jan 2003
Posts: 4

Original Poster
Rep: Reputation: 0
sorry i've not been clear with my info. i'm using a standalone comp and the logs was from the comp. the nameserver from the first post was from my isp dns 192.x.x.x hope this helps. thanks
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
IPtables failing to load: unknown ruleset bureado Linux - Software 3 06-19-2008 11:32 PM
Stealth iptables ruleset Mux Linux - Security 10 02-21-2007 03:54 AM
Problem with Arno's IPTables ruleset? slacquer Slackware 1 01-26-2004 10:06 AM
Iptables ruleset Paul_assheton Linux - Networking 1 08-31-2002 08:01 AM
Iptables ruleset Kinstonian Linux - Security 1 04-04-2002 03:58 AM


All times are GMT -5. The time now is 02:42 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration