Re: Need Help

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Sunday 29 September 2002 11:26 pm, Davide wrote:

> hello,
>    this is the iptables version
>
> /sbin/iptables -F
> /sbin/iptables -t nat -F
>
> /sbin/iptables -P INPUT ACCEPT

Ugh.

> /sbin/iptables -P FORWARD ACCEPT

Ughhh !!!

> /sbin/iptables -P OUTPUT ACCEPT
>
> echo "1" > /proc/sys/net/ipv4/ip_forward

It's a good idea to put this *after* your rules, to avoid any period of time 
when the kernel's forwarding packets, but without a ruleset loaded...

> # for trasparent proxy
> /sbin/iptables -t nat -A PREROUTING -p tcp -s 0.0.0.0/0 --dport 80 -j
> REDIRECT --to-ports 8080

The -s 0.0.0.0/0 is redundant.

> # for direct connection excluding HTTP
> /sbin/iptables -A FORWARD -p tcp -s 0.0.0.0/0 --dport 80 -j DROP

Please do this as an explicit ACCEPT rule for *outbound* packets which do not 
match HTTP, and have a default DROP policy on the FORWARD chain (so you block 
anything trying to come in).

ie:
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --dport ! 80 -o $extIF -j ACCEPT

Antony.

-- 

G- GIT/E d- s+:--(-) a+ C++++$ UL++++$ P+(---)>++ L+++(++++)$ !E W(-) N(-) o? 
w-- O !M V+++(--) !PS !PE Y+ PGP+> t- tv@ b+++ DI++ D--- e++>+++ h++ r@? 5? 
!X- !R K--?