On Monday 08 July 2002 18:32, Mark Tessier wrote: > I have a PC running rh7.1., which I'm trying to turn into a firewall. The > firewall stands between a DMZ and a LAN. I have an elaborate script which > I've been trying to deploy, but so far no luck. Since I really don't know > where to begin in terms of diagnosing my problem, I decided to see if I > could just ping one machine on the DMZ from another on the LAN. > > The first thing I did was to set the policy to drop for the forward chain > as in: > > iptables --policy FORWARD DROP
=> Response on my machine (and yours) is: iptables v1.2.1a: Unknown arg '--policy' Try 'iptables -h` or 'iptables --help' for more information. Suppose you mean: #iptables -P FORWARD DROP ? > Next, I tried to open one door on the forward chain, allowing icmp packets > of the echo request type to ping any other machine as in: > > iptables -A FORWARD -o eth0 -p icmp --icmp-type echo-request -s > 192.168.0.0/24 -m state --state NEW -j ACCEPT Assuming that this line properly reflects your network configuration, you may also want to allow the reply to come in: #iptables -A FORWARD -i eth0 -p icmp --icmp-type echo-reply -d 192.168.0.0/24 -j ACCEPT. In general though, one good way to debug is to look at the firewall machine, and use: => iptables -Z FORWARD to clear counter => do your ping => run iptables -L -v -x to inspect counters to see which rule(s) matched and caused your packets to be dropped. => also tcpdump may help Jan Humme.
