since there's no REJECT rules in the script, i'd have to say i believe the issue is at 172.16.0.2 (maybe there isn't even an ssh daemon running at that address)...
if the packet was getting dropped by this script you'd be getting a timeout and not a refusal... |
Quote:
hehe... still, the script you had was a mess, i know the one i posted will work much better for you, and it's much cleaner so you'll be able to understand it better... let me know if you have any questions about the script (or about iptables in general) and i'll be glad to do my best and answer them to help you get the hang of iptables... good luck... |
Some thing is wrong with 172.16.0.2. It should work at the first time you gave the code, if I could enabled ip_forward. There are so many things I need to know to solve a single prolbem. If I don't know enought, I cann't even find out what causes the problem.
One last thing. I'm really like playing with firewall. Do you know any good resource to learn iptables. (not doc on the http://netfilter.org. all the docs are leaking details of explanation for what's really going on). |
well, this tutorial is a very popular link here at LQ:
http://iptables-tutorial.frozentux.n...-tutorial.html personally i haven't read it, but it's always recommended by folks here at LQ... feel free to ask me any iptables questions you want... i'll be back online when i wake-up, i'm going to sleep now... take care buddy... buh-bye... |
i've added a few things to the script which i accidentally left-out yesterday cuz i was so sleepy:
- added input rule for loopback interface (very important)... - added "--sport 68" to the dhcp input rule cuz that's what dhcp packets look like, they come from port 68 and into port 67... - added "new not syn" input rule to drop any packets of state NEW which aren't SYN... you can get the updated script at the same place: http://www.linuxquestions.org/questi...70#post1640370 |
Hi, win32sux. I've got the forward and nat working properly. BUT, There is still one thing bothering me for a long time.
Code:
# (1) allow ssh from ralf to client1 Code:
# (1) allow ssh from ralf to client1 I don't know if I explained clearly. The question is how I can know when to check source port only and when to check destination port only?? Thanks. |
Quote:
Code:
$IPTABLES -A INPUT -p TCP -i $EthernetIface -s $EthernetIPs --dport 22 \ Code:
$IPTABLES -A INPUT -p TCP -i $EthernetIface -s 192.168.1.104 --dport 22 \ BTW, these rules you've posted aren't checking for the packet's state, kinda defeats the purpose of having a packet-state filtering firewall... those rules are part of the ones i erased when i cleaned-up your script as they didn't make any sense... as for the source ports: it depends, some connection types always use the same source port, some don't... you need to read docs in order to know which... for example, DHCP will use source port 68 by standard, but SSH won't use any specific source port so using a "--sport 22" in your SSH rules will give you nothing but headaches... |
All times are GMT -5. The time now is 06:47 AM. |