Hi guys, me again.

I,ve managed to setup my Apache webserver/PHP/MySql and the internet connection, which is a Alcatel USB modem with BTOpenworld and sharing this with another PC running Windows on my home LAN which has a staic IP.

I set it up with the ICS Connection Wizard in the Mandrake Control Centre and it works great, much faster than when its connected to windows. However I now want to make a new firewall script for better protection but dont want to use the Control Centre for this because I believe it will override my ICS scripts.

Am I correct in thinking that I can just modify the IP TABLES script for ICS to do this and does anybody know where the scripts are? and i,ve decided samba isnt what I need its time to setup ssh next, any tips?

Thx guys, any input would be most appreciated

ps- any idea why Mandrake installs both Ip tables and chains???

RecoilUK

Help plz

OK I think i,ve found the right file anyway, its called rc.firewall.inet_sharing-2.4 does this sound correct? because there are a few others in there aswell.

Anyway, below is what is in the file allready....

#!/bin/sh
# Load the NAT module (this pulls in all the others).
modprobe iptable_nat

# Turn on IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# In the NAT table (-t nat), Append a rule (-A) after routing (POSTROUTING)
# which says to MASQUERADE the connection (-j MASQUERADE).
/sbin/iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE

# Allows forwarding specifically to our LAN
/sbin/iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT

# Allow dhcp requests
/sbin/iptables -A INPUT -i eth0 -p udp --sport bootpc --dport bootps -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -p tcp --sport bootpc --dport bootps -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -p udp --sport bootps --dport bootpc -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -p tcp --sport bootps --dport bootpc -j ACCEPT

# Allow dns requests
/sbin/iptables -A INPUT -i eth0 -p udp --dport domain -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -p tcp --dport domain -j ACCEPT


I guess this isnt very secure is it, any tips?

Thx guys

RecoilUK

That is the right place to put user rules.
The policies are not in the script you have.

To see all the rules and policies do

iptables -L

If you know the ip of a couple of your dns servers you could narrow that down to only allow them. Same with the dhcp server.
Instead of allowing anyone access to those ports.



theres a lot of security stuff in the security forum.