LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 09-01-2004, 03:17 PM   #1
extremebfn
Member
 
Registered: Jun 2004
Location: bloem
Distribution: asdsa
Posts: 43

Rep: Reputation: 15
Questions Questions Questions


CURRENT SETUP:
===========

I have 2 networks at work.Let's name them NetworkA and NetworkB.
NetworkA has a ADSL Router.Both Networks use the router for internet.

NetworkA: 192.168.35.X (8 PC's)
NetworkB: 192.168.35.X (20 PC's)
GATEWAY: 192.168.35.1 (ADSL Router)

Ok....all PC's on NetworkA connects to a hub(obviously), and the same with NetworkB. The 2 hubs ARE Conneted VIA a UTP Cable to link the 2 networks. OK....now some users on NetworkB MAY NOT have internet Access,so i want only allow trafic to networkA for Authorised users.


WHAT I WANT TO DO:
===============

I want to place a "RED HAT 9" Box between the 2 networks...this will be done why using 2 NIC's,one for the UTP Cable of NetworkA and the other for the UTP Cable for NetworkB.I think this is the right way?Hope so.....

Anyways: The Linux box must be defualt to DROP all Trafic...and only allow access to sertain IP's. I think to the command to DROP all Trafic is:

iptables -P INPUT DROP

So now i must add rules for EACH IP that can be allowed to Enter NetworkA and het access to the internet.

Im a newbie in linux,and i have read many HOWTo's: Most commands does not work and most stuff i dont understand.I don't think that what i want to do is that hard....so if ANYBODY can help me....please do........

I want the commands and code for :

IP FORWARDING--> I think im going to use this right?
IP TABLES --> To setup Rules Ex: ALLOW TRAFIC FROM 192.168.35.20

All allowed trafic must be able to goto the ADSL Router(192.168.35.1) and access the gateway.


PLEASE HELP..............................................
THANKS!!
 
Old 09-02-2004, 01:33 AM   #2
ppuru
Senior Member
 
Registered: Mar 2003
Location: Beautiful BC
Distribution: RedHat & clones, Slackware, SuSE, OpenBSD
Posts: 1,791

Rep: Reputation: 50
Quote:
Im a newbie in linux,and i have read many HOWTo's: Most commands does not work and most stuff i dont understand.I don't think that what i want to do is that hard..
I would recommend you try to write a firewall script, post it here. We will help you out with the problems that you might encounter. It will be really dangerous to have a firewall script and not knowing what it does.

so if you write a script all by yourself first and then modify it with the suggestions of this forum, you would have better control over your network and the traffic that is moving in and out of it.


Not wanting to sound philosophical ...
... if you give a fish to a hungry (wo)man, (s)he would be happy for that day, if you teach h(er)im how to fish .... (s)he would be happy for ever.
 
Old 09-02-2004, 02:22 AM   #3
extremebfn
Member
 
Registered: Jun 2004
Location: bloem
Distribution: asdsa
Posts: 43

Original Poster
Rep: Reputation: 15
Thats does NOT help one bit.
 
Old 09-02-2004, 04:28 AM   #4
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
all of your network are in same subnet, right?
192.168.35.0/255.255.255.0 ?

at least u must move adsl router to another segment. so linux will be able to work as a router. you dont have to change network A and B. u can block them trou thier ip or MAC address.

imagine like this:

adsl-----(eth1) linux (eth0)-----switches/hubs----clients.
 
Old 09-02-2004, 05:39 AM   #5
ppuru
Senior Member
 
Registered: Mar 2003
Location: Beautiful BC
Distribution: RedHat & clones, Slackware, SuSE, OpenBSD
Posts: 1,791

Rep: Reputation: 50
Oh well, just trying to help you help yourself....

Quote:
IP FORWARDING--> I think im going to use this right?
IP TABLES --> To setup Rules Ex: ALLOW TRAFIC FROM 192.168.35.20
Edit /etc/sysctl.conf and add the entry
net.ipv4.ip_forward = 1

run sysctl -p to enable forwarding.

Here is a very basic script you can build upon.

Code:
#!/bin/sh
# Firewall script

IPT=/sbin/iptables

# Default deny stance; allowing filter-free OUTPUT 
$IPT -P INPUT DROP
$IPT -P FORWARD DROP


# Flush entries, zero counters.
$IPT -t filter -F
$IPT -t nat -F
$IPT -X
$IPT -Z

# Allow local traffic
$IPT -A INPUT -i lo -j ACCEPT

# Forwarding - only for 192.168.35
# Block a IPs from accesing the internet 
$IPT -A FORWARD -i eth1 -s ! 192.168.35.20 -j REJECT

# Masquerading 
$IPT -t nat -A POSTROUTING -i eth1 -j MASQUERADE
 
Old 09-02-2004, 11:29 AM   #6
extremebfn
Member
 
Registered: Jun 2004
Location: bloem
Distribution: asdsa
Posts: 43

Original Poster
Rep: Reputation: 15
Hi. Thanks for your help....See im so down becuase i really TRIED to get it working on my own,and i don't succeed Thats why i need people to help me now.

# Block a IPs from accesing the internet
$IPT -A FORWARD -i eth1 -s ! 192.168.35.20 -j REJECT

The obove: will this only block the ip: 192.168.35.20. But where do i ADD the IP's i want to ALLOW?

Won;t it be better to BLOCK ALL Trafic and only Allow lets say: 192.168.35.10 and 192.168.35.11. How would the Firewall for the look like?I can just later ADD all the IP's i want to Allow?

Thanks again...i really need this to work.
 
Old 09-03-2004, 12:15 AM   #7
ppuru
Senior Member
 
Registered: Mar 2003
Location: Beautiful BC
Distribution: RedHat & clones, Slackware, SuSE, OpenBSD
Posts: 1,791

Rep: Reputation: 50
Quote:
# Block a IPs from accesing the internet
$IPT -A FORWARD -i eth1 -s ! 192.168.35.20 -j REJECT

The obove: will this only block the ip: 192.168.35.20. But where do i ADD the IP's i want to ALLOW?
The above rule will block all traffic except the ones originating from 192.168.35.20.

-s ! 192.168.35.20 means source ip is not 192.168.35.20.

Quote:
Allow lets say: 192.168.35.10 and 192.168.35.11. Ho would the Firewall for the look like?I can just later ADD all the IP's i want to Allow?
You can either keep adding the rules like

$IPT -A FORWARD -i eth1 -s ! 192.168.35.10 -j REJECT
$IPT -A FORWARD -i eth1 -s ! 192.168.35.11 -j REJECT
$IPT -A FORWARD -i eth1 -s ! 192.168.35.21 -j REJECT

OR

take it a step further and create a new chain as in
http://www.linuxquestions.org/questi...615#post990615

That is,

$IPT -N privileged
$IPT -A privileged -s 192.168.35.20 -j RETURN
$IPT -A privileged -s 192.168.35.11 -j RETURN
$IPT -A privileged -s 192.168.35.10 -j RETURN
$IPT -A privileged ... and so on
$IPT -A privileged -j REJECT

and

$IPT -A FORWARD -i eth1 -j privileged

Last edited by ppuru; 09-03-2004 at 12:22 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
basic questions on hostname and domain name + related postfix questions Moebius Linux - Newbie 7 09-04-2007 11:50 AM
Solaris - Questions! Questions! Questions! qs_tahmeed Solaris / OpenSolaris 2 07-16-2005 05:27 AM
window manager questions and/or theme questions t3gah Linux - Software 2 02-27-2005 04:16 PM
Some questions... CryptDragoon Linux From Scratch 2 02-04-2004 08:28 PM
few questions? pudhiyavan Linux - General 2 10-03-2003 07:35 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 02:08 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration