On Wednesday 23 Jul 2003 4:24 am, Sharrea wrote: > Disclaimer: I'm NO expert on iptables but I've been playing around with > these scripts lately too. If my advice here is incorrect, someone please > correct me. > > On Wed, 23 Jul 2003 02:29, L.V.Gandhi wrote: > > Slightly I want to modify my yesterday mail. In a PC with modem, which is > > to act as masq server, I have already installed iptables. However > > starting its daemon during startup was disabled by me. Now I have > > followed IP-masquerade howto. I made rc.firewall-2.4 , put it in > > /etc/rc.d and firewall-2.4 in /etc/rc.d/init.d/. Now when I ran > > rc.firewall-2.4 in command line, I get errors many modules are already > > running. > > Before running your firewall script you should flush the current tables. > Either use the rc.flush-iptables script to flush the tables with a default > policy of ACCEPT or if you can use the command: > > # iptables --flush > > to flush the tables with a default policy of DROP. > > > Further gateway ip address of eth0, I can ping. When masq server > > is connected to internet, I can ping its dynamically allocated ip > > address. But I can't ping its dns server by its number also. The rules > > were intially as propsed by ip-masq howto > > <snip> > > > In this copndition masq is working. Only I want some clarification. > > Why it is now working but not with previous rules. In both general > > condition of > > ACCEPT all -- anywhere anywhere > > exists. > > This may be because the tables were not flushed before running your script. > > Also, I note that you have a default policy of accept rather than drop on > some of your chains. From what I understand that is not very secure (I > could be wrong, often am). I think the idea is to block ALL ports and then > only open the ones you want from/to wherever. > > I'm not sure which tutorial/script you're using L.V., but I recommend Oskar > Andreasson's one at > http://www.linuxsecurity.com/resource_files/firewalls/IPTables-Tutorial/ipt >ables-tutorial.html and try the rc.firewall script in there.
I was using IP-masquerading Howto scripts. I have installed iptables in the gateway. But disabled its daemon service. Then I installed the scripts given in the above howto. It had default policy of drop for forward and but below it had ACCEPT all -- anywhere anywhere Still when I did ping ISP dns, I was not successful. But making the default policy ACCEPT for forward, then I could get connected and browse. Here only I needed clarification why the above line almost equal to default ploicy of ACCEPT didn't allow me to ping ISP dns. -- L.V.Gandhi 203, Soundaryalahari Apartments, Lawsons Bay colony, Visakhapatnam, 530017 MECON, 5th Floor, RTC Complex, Visakhapatnam AP 530020 INDIA
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
