[EMAIL PROTECTED] wrote:
Hi;
I'm a newbie.
I have successfully installed qmailToaster on FC5 and got most of the
things working. My server is behind a NAT router/firewall with SPI and DoS
enabled.
I have forwarded the required ports from the NAT router to the server.
During installation process I have stopped iptables that were configured
using standard distro script.
I would guess that the iptables rules in the script are for direct
connection to the Internet and wold not work behind NAT without
modifications. Question is - being behind NAT and router firewall, do I
even need an additional firewall on my server ?
George
Let me start by agreeing with Ron's and Erik's replies. No disagreement
here. However, let me attempt to be a little more direct to the question.
First and foremost, the iptables toaster rules not only work behind, but are
considerate of a NAT'd router. The only exception I've found to this is when
trying to ssh in from a local address. I had to add the following to the
toaster's firewall.sh in order to be able to run a headless toaster (ssh in
from a local address):
# shubes 5/16/06 - accept packets from local net
iptables -A INPUT -s 192.168.???.0/255.255.255.0 -j ACCEPT
#
## Drop outside packets with local addresses - anti-spoofing measure
Other than that, the toaster firewall rules work just fine, and provide an
additional layer (think onion) of security.
That being said, there may very well be some toaster firewall rules that
never fire because they're redundant with your router's rules. If you care
to take the time (and risk), feel free to remove them. The question, though,
is why? Redundancy is not always a bad thing, especially when it regards
security, and when there's no noticeable difference in performance.
So, do you *need* the additional firewall on the toaster?
Well, not necessarily, but it won't hurt (with the exception noted above).
Should you *use* the additional fireall on the toaster?
By all means yes. If you have a reason not to, I'd like to hear of it.
--
-Eric 'shubes'
---------------------------------------------------------------------
QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
