firewall settings

win32sux · 04-29-2008, 10:53 AM

Quote:

Originally Posted by chlee97

Code:

iptables -I FORWARD -p TCP -i $LAN_IFACE -o $WAN_IFACE \
-m multiport --dports 80,443 -m state --state NEW -j REJECT

above code is to block 80 and 443 port only. How about if i wan to block ALL port but except 25, 110 and 8080 ports? what should i type in iptables?

You could do it like this:

Code:

iptables -P FORWARD DROP

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -p TCP -i $LAN_IFACE -o $WAN_IFACE \
-m multiport --dports 25,110,8080 -m state --state NEW -j ACCEPT

iptables -A FORWARD -i $LAN_IFACE -o $WAN_IFACE -j REJECT

EDIT: Of course, this assumes a clean FORWARD chain when you start.

chlee97 · 04-30-2008, 02:23 AM

hi win32sux,

since skype hard to block, so can i just block all the ports from internal to external, then only allow some of the port like 25, 110, 143 able to access to external. So from here i can prevent user to use skype and bittorrent download, besides that force user to use proxy server, then only can access to net.

anyway will it have any disadvantages?

by the way, if i have blocked all port (which included my proxy port 8080), can my user still use my proxy server to surf net? or i need to allow the proxy port in iptables, then my user only can access internet with my proxy server?

Thank you

Regards,
Kenny

win32sux · 04-30-2008, 06:37 AM

Quote:

Originally Posted by chlee97

since skype hard to block, so can i just block all the ports from internal to external, then only allow some of the port like 25, 110, 143 able to access to external. So from here i can prevent user to use skype and bittorrent download, besides that force user to use proxy server, then only can access to net.

Yes, you can do that. The commands in my last post allow the clients to start outgoing connections to ports 25, 110, and 8080. I don't know if it'll stop Skype and/or BitTorrent, though.

Quote:

anyway will it have any disadvantages?

by the way, if i have blocked all port (which included my proxy port 8080), can my user still use my proxy server to surf net? or i need to allow the proxy port in iptables, then my user only can access internet with my proxy server?

Yes, you can simply disable forwarding and require all users to connect to the proxy. The advantage to this is you pretty much get to control all their access via proxy ACLs. I don't know if it will stop Skype, though. I mean, AFAIK Skype will indeed work through a proxy.