I have a PC running rh7.1., which I'm trying to turn into a firewall. The firewall stands between a DMZ and a LAN. I have an elaborate script which I've been trying to deploy, but so far no luck. Since I really don't know where to begin in terms of diagnosing my problem, I decided to see if I could just ping one machine on the DMZ from another on the LAN.
The first thing I did was to set the policy to drop for the forward chain as in: iptables --policy FORWARD DROP Next, I tried to open one door on the forward chain, allowing icmp packets of the echo request type to ping any other machine as in: iptables -A FORWARD -o eth0 -p icmp --icmp-type echo-request -s 192.168.0.0/24 -m state --state NEW -j ACCEPT The result is, it doesn't work. If I do a lsmod I get what I think are the relevant modules that should allow state tracking to work (I haven't included the others): ip_conntrack 23088 3 [ipt_state ip_conntrack_ftp iptable_nat] ip_tables 14016 [ipt_state iptables_mangle iptables_filter iptables_nat] Any recommendations are appreciated. -- Thanks, Mark
