From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Gilles Yue" Subject: RE: Help on IPTABLES Date: Fri, 10 Oct 2003 10:43:55 +0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <83055D4B014C9E478D2F04624B9E82CFD46F@noveldc.novelgmt.mu> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C38EF9.E0439152" Return-path: content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Rob Sterenborg , netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------_=_NextPart_001_01C38EF9.E0439152 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Rob,=20 =20 I have made changes just like you said. And I still I cannot browse!=20 Is there something wrong with my other chain rules or with the routing with my network cards?(Note I have two network cards) Please help. Thanks.=20 =20 =20 Chain INPUT (policy DROP) =20 target prot opt source destination =20 RH-Lokkit-0-50-INPUT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:80 =20 Chain FORWARD (policy ACCEPT) =20 target prot opt source destination RH-Lokkit-0-50-INPUT all -- 0.0.0.0/0 0.0.0.0/0 =20 Chain OUTPUT (policy ACCEPT) =20 target prot opt source destination =20 Chain RH-Lokkit-0-50-INPUT (2 references) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp=20 dpts:0:1023 flag s:0x16/0x02=20 reject-with icmp-port-unreachable REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2049 flags:0 x16/0x02 reject-with=20 icmp-port-unreachable REJECT udp -- 0.0.0.0/0 0.0.0.0/0 udp=20 dpts:0:1023 reje ct-with=20 icmp-port-unreachable REJECT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:2049 reject- with=20 icmp-port-unreachable REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp=20 dpts:6000:6009 f =20 lags:0x16/0x02 reject-with icmp-port-unreachable REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:7100 flags:0 x16/0x02 reject-with=20 icmp-port-unreachable =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 -----Original Message----- From: Rob Sterenborg [mailto:rob@sterenborg.info]=20 Sent: Thursday, October 09, 2003 5:55 PM To: Gilles Yue; netfilter@lists.netfilter.org Subject: RE: Help on IPTABLES =20 > Can somebody explain to me why is when i changed my Chain=20 > INPUT Rules from ACCEPT to DROP, i cannot browse the internet=20 > despite opening port 80 in the INPUT rule. ... > Chain INPUT (policy DROP) > target prot opt source destination > RH-Lokkit-0-50-INPUT all -- anywhere anywhere > ACCEPT tcp -- anywhere anywhere =20 > tcp spt:http > ACCEPT udp -- anywhere anywhere =20 > udp spt:http =20 Because you used sport. You are trying to reach servers that are *listening* on port 80/443 so you should use dport (destination =3D port 80/443). You are most likely not sending from port 80/443. =20 =20 Gr, Rob =20 ------_=_NextPart_001_01C38EF9.E0439152 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Rob,

 

I have made changes just like you said. And I still I cannot = browse!

Is there something wrong with my other chain rules or with the = routing with my network cards?(Note I have two network cards) Please help. = Thanks.

 

 

Chain INPUT (policy = DROP)

 

target     prot opt source           &= nbsp;   destination

 

RH-Lokkit-0-50-INPUT  all  --  0.0.0.0/0          &nbs= p; 0.0.0.0/0

ACCEPT     tcp  --  0.0.0.0/0          &nbs= p; 0.0.0.0/0          tcp dpt:80

ACCEPT     udp  --  0.0.0.0/0          &nbs= p; 0.0.0.0/0          udp dpt:80

 

Chain FORWARD (policy = ACCEPT)

 

target     prot opt source           &= nbsp;   destination

RH-Lokkit-0-50-INPUT  all  --  0.0.0.0/0          &nbs= p; 0.0.0.0/0

 

Chain OUTPUT (policy = ACCEPT)

 

target   =   prot opt source           &= nbsp;   destination

 

Chain = RH-Lokkit-0-50-INPUT (2 references)

target     prot opt source           &= nbsp;   destination

ACCEPT     all  --  0.0.0.0/0          &nbs= p; 0.0.0.0/0

REJECT     tcp  --  0.0.0.0/0          &nbs= p; 0.0.0.0/0          tcp

dpts:0:1023 flag           &nb= sp;           &nbs= p;            = ;        s:0x16/0x02

reject-with = icmp-port-unreachable

REJECT     tcp  --  0.0.0.0/0          &nbs= p; 0.0.0.0/0          tcp dpt:2049

flags:0          =             &= nbsp;           &n= bsp;         x16/0x02 reject-with

icmp-port-unreachable

REJECT     udp  --  0.0.0.0/0          &nbs= p; 0.0.0.0/0          udp

dpts:0:1023 = reje           &nb= sp;           &nbs= p;            = ;        ct-with

icmp-port-unreachable

REJECT     udp  --  0.0.0.0/0          &nbs= p; 0.0.0.0/0          udp dpt:2049

reject-          =             &= nbsp;           &n= bsp;         with

icmp-port-unreachable

REJECT     tcp  --  0.0.0.0/0          &nbs= p; 0.0.0.0/0          tcp

dpts:6000:6009 f            =             &= nbsp;           &n= bsp;      

lags:0x16/0x02 = reject-with icmp-port-unreachable

REJECT     tcp  --  0.0.0.0/0          &nbs= p; 0.0.0.0/0          tcp dpt:7100

flags:0          =             &= nbsp;           &n= bsp;         x16/0x02 reject-with

icmp-port-unreachable

 

 

 

 

 

 

 

 

 

 

-----Original Message-----
From: Rob Sterenborg [mailto:rob@sterenborg.info]
Sent: Thursday, October 09, 2003 5:55 PM
To: Gilles Yue; netfilter@lists.netfilter.org
Subject: RE: Help on IPTABLES

 

> Can somebody explain to me why is when i changed my Chain =

> INPUT Rules from ACCEPT to DROP, i cannot browse the = internet

> despite opening port 80 in the INPUT = rule.

...

> Chain INPUT (policy DROP)

> target     prot opt source           &= nbsp;   destination

> RH-Lokkit-0-50-INPUT  all  --  anywhere           = ;  anywhere

> ACCEPT     tcp  --  anywhere           = ;  anywhere           =

> tcp spt:http

> ACCEPT     udp  --  anywhere           = ;  anywhere           =

> udp spt:http

 

Because you used sport. You are trying to reach servers that = are

*listening* on port 80/443 so you should use dport (destination = =3D port

80/443). You are most likely not sending from port = 80/443.

 

 

Gr,

Rob

 

=00 ------_=_NextPart_001_01C38EF9.E0439152--