Hello.

Am looking for a way to detect if any Windows PC (running Win 98SE, Win 2000 or Win XP) inside my network is using Windows ICS.

I use a RedHat Linux 7.2 Box as my gateway server, and would like to stop those who are using ICS.

Thanks in Advance.

Kevin

#----------------------------------------
#Unrestrict Local Network |
#----------------------------------------
iptables -A INPUT -i $INTINT -s $INTRA -j ACCEPT
iptables -A OUTPUT -o $INTINT -d $INTRA -j ACCEPT
#----------------------------------------
#Routing Internal -> Out |
#----------------------------------------
iptables -A OUTPUT -o $EXTINT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o $INTINT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#----------------------------------------
#Routing Related External -> In |
#----------------------------------------
iptables -A INPUT -i $EXTINT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $INTINT -m state --state ESTABLISHED,RELATED -j ACCEPT
#----------------------------------------
#Forwarding to/from Internal Network |
#----------------------------------------
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW -i ! $EXTINT -j ACCEPT
#----------------------------------------
#Masquerading Internal to External |
#----------------------------------------
iptables -t nat -A POSTROUTING -o $EXTINT -j MASQUERADE


In theory, this only allows connections to be initiated from internal sources. That'll get half your problem.

Perhaps add more rules to limit port numbers....