Hello all

I have a problem with IP tables.
i have a web content filter server using iptables, squid and dansguardian. After months working on it i just kind of finish it. I just have a little problem

When i restart it i cant access pop3/smtp from outlook on my workstations

but if i copy and paste this the firewall script on a console it fixes the problem.

if i do iptables -L -n before and after pasting the firewall script it gives me the exact same rules.

also i have the firewall script file saved in /etc/init.d and made the shortcut in /etc/rc2.d also did the chmod 750 tp the file.

what can be the problem???


Firewall Script****************

iptables -F
iptables -X
iptables -Z
iptables -t nat -F

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT

/sbin/iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -s 192.168.10.0/24 -i eth3 -j ACCEPT

iptables -A FORWARD -s 192.168.10.0/24 -i eth3 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 192.168.10.0/24 -i eth3 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -s 192.168.10.0/24 -i eth3 -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -s 192.168.10.0/24 -i eth3 -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -s 192.168.10.0/24 -i eth3 -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -s 192.168.10.0/24 -i eth3 -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -s 192.168.10.26/24 -i eth3 -p tcp --dport 4899 -j ACCEPT
iptables -A FORWARD -s 192.168.10.0/24 -i eth3 -j DROP

iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o eth0 -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -A INPUT -s 0.0.0.0/0 -p tcp --dport 1:1024 -j DROP
iptables -A INPUT -s 0.0.0.0/0 -p udp --dport 1:1024 -j DROP
iptables -A INPUT -s 0.0.0.0/0 -p tcp --dport 10000 -j DROP

*************************************************************************

WAG: Could it be because you're messing with a sysctl MIB within a firewall script?

This is really the kind of thing that should be specified in /etc/sysctl.conf, i.e.:
net.ipv4.ip_forward=1

You can test this theory out before making any changes by toggling 'ip_forward' on and off. When turned off do the problem symptoms reappear?

thank you anomie.
Worked fine