Help Required

Help Required

[Sridhar Murthy]

Hi all,

I require help in configuring firewall on Redhat 8.0 system my setup 
  is as follows: 
 
 We have a Cable Modem connection with sendmail and proxy service 
 running on Linux 8 system with 2 nic cards. 
 
 One nic card is having local LAN ipaddress and the other is taking 
 an ipaddress from the ISP through dhcp protocol. 

 The problem i am facing is when i use the gui utility to configure the 
firewall i am not able to see the second nic card(during installation i was 
able to see both the nic cards) which uses the dhcp for an ipaddress
 
 Can anybody help in configuring a firewall for the this setup. 
 


Regards,

Sridhar

RE: Help Required

[George Vieira]

Don't use that GUI then..

Try www.webmin.com as it probably has a better GUI or learn to script it
yourself.. It's the best way.

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Sridhar Murthy
Sent: Thursday, July 17, 2003 10:47 PM
To: netfilter@lists.netfilter.org
Subject: Help Required


Hi all,

I require help in configuring firewall on Redhat 8.0 system my setup
  is as follows:

Help required

[Vishwanatha Hattera]

Hi
    While doing some experiment I have done git commit and sent the mail
with subject "[PATCH] added new files Signed-off-by: Vishwanatha Hatter
<vishwanatha.hattera@itasin.com>"  Please ignore and remove this from
the mailing list.

Regards,
Vishwa

-- 
iTAS Innovations Pvt. Ltd.
#1585, 3rd floor, B-Block, Sahakaranagar,
Bangalore, Karanataka, India, pin: 560092
Email:vishwanatha.hattera@itasin.com
Phone: +91-80-41675006
Mob: +91-9945089777

Re: Help required

[Patrick McHardy]

Muhammad R. Sami wrote:
> It seems tat I cannot run my fw classifier although when I say lsmod it
> shows the module cls_fw there. I also cross-checked packet marking through
> the mangle and that is also perfect. All the traffic flows from the 2nd band
> of the PRIO queue. These are my commands for the filter
> 
> tc filter add dev eth0 parent 1:0 prio 0 protocol ip handle 1 fw flowid 1:1 
> tc filter add dev eth0 parent 1:0 prio 1 protocol ip handle 2 fw flowid 1:2 
> tc filter add dev eth0 parent 1:0 prio 2 protocol ip handle 3 fw flowid 1:3

Try "protocol ip" or "protocol all", also use prio 0 for all three
filters, that will increase efficiency.

> This is my 3rd email to the group, can anyone please help me on this one.

This question in a tc usage question and unrelated to netfilter
development, you might want to ask stuff like this on the lartc list.

Regards
Patrick

Help required

[Muhammad R. Sami]

It seems tat I cannot run my fw classifier although when I say lsmod it
shows the module cls_fw there. I also cross-checked packet marking through
the mangle and that is also perfect. All the traffic flows from the 2nd band
of the PRIO queue. These are my commands for the filter

tc filter add dev eth0 parent 1:0 prio 0 protocol ip handle 1 fw flowid 1:1 
tc filter add dev eth0 parent 1:0 prio 1 protocol ip handle 2 fw flowid 1:2 
tc filter add dev eth0 parent 1:0 prio 2 protocol ip handle 3 fw flowid 1:3

This is my 3rd email to the group, can anyone please help me on this one.
Regards,

Muhammad R. Sami 
Research Assistant, 
Computer Engineering Department 
P.O.Box 354 
King Fahd University of Petroleum & Minerals 
Dhahran 31261 
Saudi Arabia. 
Tel: +96638601423 
Cell: +96657982951 
www.ccse.kfupm.edu.sa/sami

Re: Help required

[Jan-Benedict Glaw]

[-- Attachment #1: Type: text/plain, Size: 784 bytes --]

On Thu, 2004-05-20 07:29:03 -0400, Venkatesharao, Lakshmesha <Lakshmesha_Venkatesharao@Syntelinc.com>
wrote in message <E84F4156F89E3E4286468CA99DF68E400284DCC6@Synbomexch3>:
> Hi all,
> 
>  I have a harddisk with partitions tables erased, but there is data in that
> harddisk.
>  Can anyone help me how to restore the partitions or atleast recover data.

If your partitions contained filesystems (that's commonly true), gpart
will easily recover that.

MfG, JBG

-- 
   Jan-Benedict Glaw       jbglaw@lug-owl.de    . +49-172-7608481
   "Eine Freie Meinung in  einem Freien Kopf    | Gegen Zensur | Gegen Krieg
    fuer einen Freien Staat voll Freier Bürger" | im Internet! |   im Irak!
   ret = do_actions((curr | FREE_SPEECH) & ~(NEW_COPYRIGHT_LAW | DRM | TCPA));

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Help required

[Alphex Kaanoken]

В Чтв, 20.05.2004, в 15:29, Venkatesharao, Lakshmesha пишет:
> Hi all,
> 
>  I have a harddisk with partitions tables erased, but there is data in that
> harddisk.
>  Can anyone help me how to restore the partitions or atleast recover data.
> 
> --lakshmesha
You may write by your hands a partition table.
Use special tools for it.
Or pay some money to specialists for it - it's better IMHO.
> 
> 
> ____________________________________________
> Confidential:  This electronic message and all contents contain information
> from Syntel, Inc. which may be privileged, confidential or otherwise
> protected from disclosure. The information is intended to be for the
> addressee only. If you are not the addressee, any disclosure, copy,
> distribution or use of the contents of this message is prohibited.  If you
> have received this electronic message in error, please notify the sender
> immediately and destroy the original message and all copies.
> -
> To unsubscribe from this list: send the line "unsubscribe linux-c-programming" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
-- 
Senior Developer of Crew IT research labs
Alphex Kaanoken <alphex@crew.org.ru>
Web: http://crew.org.ru
-
To unsubscribe from this list: send the line "unsubscribe linux-c-programming" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Help required

[Venkatesharao, Lakshmesha]

Hi all,

 I have a harddisk with partitions tables erased, but there is data in that
harddisk.
 Can anyone help me how to restore the partitions or atleast recover data.

--lakshmesha


____________________________________________
Confidential:  This electronic message and all contents contain information
from Syntel, Inc. which may be privileged, confidential or otherwise
protected from disclosure. The information is intended to be for the
addressee only. If you are not the addressee, any disclosure, copy,
distribution or use of the contents of this message is prohibited.  If you
have received this electronic message in error, please notify the sender
immediately and destroy the original message and all copies.

Re: help required

[Venkatesh. K]

Turning off connection tracking is not going to help you to conserve
CPU cycles. Savings in memory will be very less.

In fact, enabling the connection tracking helps you in cutting down
number of rules a packet has to traverse which in turn reduce the
number of CPU cycles.

Suppose you have 100 rules and a packet matching 100th rule has to
traverse 99 rules before there is a match. With connection tracking enabled
a packet belonging to an already established connection need to traverse
only one rule assuming the first rule in your chain allows all packets
belonging
to an established connection.

Each connection tracking requires only 292 bytes of memory. Considering
the cost of RAM today, it would be peanuts.

Thanks,

Venkatesh K
----- Original Message ----- 
From: "venky b" <bvr96@yahoo.com>
To: "SBlaze" <dagent.geo@yahoo.com>; <netfilter@lists.netfilter.org>
Sent: Sunday, November 09, 2003 9:41 PM
Subject: Re: help required


> Hi,
>
> Thanks for responding.
>
> My requirement is as follows
>
> I have a site with two IP subnets A and B.
>
> A is connected to eth0 of IPtables firewall and B is
> connected to eth1 interface.
>
> For accessing machines in other locations A must cross
> the firewall and go through the router in subnet B,
> i.e. WAN connectivity is through subnet B.
>
> I want to implement access control for traffic between
> A and B with stateful rules as B is not trusted by A.
>
> Rest of the traffic which is not from/to A
> specifically, i.e. coming from or going to other
> location should be allowed with ACCEPT target.
>
> There are so many application servers in other
> locations which will be accesed by subnet A users,
> around 400.
>
> So I do not want IPtables to keep connection tracking
> entries for this traffic as it hogs the memory and
> cpu.
>
> But at the same time it should keep track of
> communication betweeb A <-> B.
>
> Is there a way to turn off/on connection tracking for
> specific rules or chains ?
>
> Hope this make everybody clear.
>
> Thanks,
> Venkatesh
>
>
>
>
>
>
> --- SBlaze <dagent.geo@yahoo.com> wrote:
> > You need to be way more specific on what it is you
> > want to know. I don't think
> > anyone can really help you since your didn't provide
> > any information on what it
> > is you really want to provided stateful inspection
> > on.
> >
> > SBlaze
> >
> > --- venky b <bvr96@yahoo.com> wrote:
> > > Hi All,
> > >
> > > Need help on a specific requirement.
> > >
> > > I want to enable the stateful inspection only for
> > few
> > > chains.
> > >
> > > I do not want iptables to maintain state inof for
> > the
> > > rest of the chains as it is not needed.
> > >
> > > Any thoughts on this ?
> > >
> > > Cheers
> > > Venkatesh
> > >
> > >
> > > __________________________________
> > > Do you Yahoo!?
> > > Protect your identity with Yahoo! Mail
> > AddressGuard
> > > http://antispam.yahoo.com/whatsnewfree
> > >
> >
> >
> > =====
> > In the absence of order there will be chaos.
> >
> > __________________________________
> > Do you Yahoo!?
> > Protect your identity with Yahoo! Mail AddressGuard
> > http://antispam.yahoo.com/whatsnewfree
>
>
> __________________________________
> Do you Yahoo!?
> Protect your identity with Yahoo! Mail AddressGuard
> http://antispam.yahoo.com/whatsnewfree
>
>

Re: help required

[venky b]

Hi,

Thanks for responding.

My requirement is as follows

I have a site with two IP subnets A and B.

A is connected to eth0 of IPtables firewall and B is
connected to eth1 interface.

For accessing machines in other locations A must cross
the firewall and go through the router in subnet B,
i.e. WAN connectivity is through subnet B.

I want to implement access control for traffic between
A and B with stateful rules as B is not trusted by A.

Rest of the traffic which is not from/to A
specifically, i.e. coming from or going to other
location should be allowed with ACCEPT target.

There are so many application servers in other
locations which will be accesed by subnet A users,
around 400.

So I do not want IPtables to keep connection tracking
entries for this traffic as it hogs the memory and
cpu.

But at the same time it should keep track of
communication betweeb A <-> B.

Is there a way to turn off/on connection tracking for
specific rules or chains ? 

Hope this make everybody clear.

Thanks,
Venkatesh



 


--- SBlaze <dagent.geo@yahoo.com> wrote:
> You need to be way more specific on what it is you
> want to know. I don't think
> anyone can really help you since your didn't provide
> any information on what it
> is you really want to provided stateful inspection
> on.
> 
> SBlaze
> 
> --- venky b <bvr96@yahoo.com> wrote:
> > Hi All,
> > 
> > Need help on a specific requirement.
> > 
> > I want to enable the stateful inspection only for
> few
> > chains.
> > 
> > I do not want iptables to maintain state inof for
> the
> > rest of the chains as it is not needed.
> > 
> > Any thoughts on this ?
> > 
> > Cheers
> > Venkatesh
> > 
> > 
> > __________________________________
> > Do you Yahoo!?
> > Protect your identity with Yahoo! Mail
> AddressGuard
> > http://antispam.yahoo.com/whatsnewfree
> > 
> 
> 
> =====
> In the absence of order there will be chaos.
> 
> __________________________________
> Do you Yahoo!?
> Protect your identity with Yahoo! Mail AddressGuard
> http://antispam.yahoo.com/whatsnewfree


__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree

Re: help required

[SBlaze]

You need to be way more specific on what it is you want to know. I don't think
anyone can really help you since your didn't provide any information on what it
is you really want to provided stateful inspection on.

SBlaze

--- venky b <bvr96@yahoo.com> wrote:
> Hi All,
> 
> Need help on a specific requirement.
> 
> I want to enable the stateful inspection only for few
> chains.
> 
> I do not want iptables to maintain state inof for the
> rest of the chains as it is not needed.
> 
> Any thoughts on this ?
> 
> Cheers
> Venkatesh
> 
> 
> __________________________________
> Do you Yahoo!?
> Protect your identity with Yahoo! Mail AddressGuard
> http://antispam.yahoo.com/whatsnewfree
> 


=====
In the absence of order there will be chaos.

__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree

help required

[venky b]

Hi All,

Need help on a specific requirement.

I want to enable the stateful inspection only for few
chains.

I do not want iptables to maintain state inof for the
rest of the chains as it is not needed.

Any thoughts on this ?

Cheers
Venkatesh


__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree

Re: Help Required

[Carlo Florendo]

Hello,

> From: "Sridhar Murthy" 
> Hi Team,
> 
> I require help to my following setup:
> 
> I have a Redhat 8 Server with squid,smtp & pop3 with iptables running.
> 
> My requirement is we have a citrix server with local LAN ipaddress. People 
> from Internet will have to access this server from outside(my firewall is 
> having a public ipaddress which is dynamic assigned). I want to know what is 
> the rules that i have to add to allow the traffic which uses port number 
> 1494, to get into my network and access my citrix server which is having LAN 
> ip. Should any nat be added.
> 

Yes.  You need to do a DNAT.  

iptables -t nat --insert PREROUTING -i <external_interface> -p tcp --dport  1494 -j DNAT --to  <citrix_ip_address>
iptables --insert FORWARD -p tcp -i <external_interface> -d <citrix_ip_address> --dport 1494 -j ACCEPT

> Thanks in advance.
> 
> Regards,
> 
> Sridhar
> 


Best Regards,

Carlo
------
Carlo Florendo
Astra Philippines Inc.
URL: http://www.hq.astra.ph/resources

Help Required

[Sridhar Murthy]

Hi Team,

I require help to my following setup:

I have a Redhat 8 Server with squid,smtp & pop3 with iptables running.

My requirement is we have a citrix server with local LAN ipaddress. People 
from Internet will have to access this server from outside(my firewall is 
having a public ipaddress which is dynamic assigned). I want to know what is 
the rules that i have to add to allow the traffic which uses port number 
1494, to get into my network and access my citrix server which is having LAN 
ip. Should any nat be added.

Thanks in advance.

Regards,

Sridhar

Re: Help Required

[Dharmendra.T]

[-- Attachment #1: Type: text/plain, Size: 1234 bytes --]

Hi 

 Which gui utility you are using? Are you sure that the other interface
has got an ip address from he dhcp server?

Regards
Dharmu

On Fri, 2003-07-18 at 08:57, Sridhar Murthy wrote:

    Hi all,
    
    I require help in configuring firewall on Redhat 8.0 system my setup 
      is as follows:
    
     We have a Cable Modem connection with sendmail and proxy service 
     running on Linux 8 system with 2 nic cards.
    
     One nic card is having local LAN ipaddress and the other is taking 
     an ipaddress from the ISP through dhcp protocol.
    
     The problem i am facing is when i use the gui utility to configure the 
    firewall i am not able to see the second nic card(during installation i was 
    able to see both the nic cards) which uses the dhcp for an ipaddress
    
     Can anybody help in configuring a firewall for the this setup.
    
    Regards,
    
    Sridhar
    

-- 
Regards
Dharmendra.T
dharmu@nsecure.net

This message is intended for the addressee only. It may contain
privileged or Confidential information. If you have received this
message in error,please notify the sender and destroy the message
immediately.Unauthorised use or reproduction of this message is strictly
prohibited.

[-- Attachment #2: Type: text/html, Size: 2771 bytes --]

Help Required

[Sridhar Murthy]

Hi all,

I require help in configuring firewall on Redhat 8.0 system my setup 
  is as follows:

 We have a Cable Modem connection with sendmail and proxy service 
 running on Linux 8 system with 2 nic cards.

 One nic card is having local LAN ipaddress and the other is taking 
 an ipaddress from the ISP through dhcp protocol.

 The problem i am facing is when i use the gui utility to configure the 
firewall i am not able to see the second nic card(during installation i was 
able to see both the nic cards) which uses the dhcp for an ipaddress

 Can anybody help in configuring a firewall for the this setup.

Regards,

Sridhar

Re: Help required

[Russell Coker]

On Fri, 9 Aug 2002 10:40, Samarth  Sharma wrote:
>      1.Does SELinux provide application transparency(like Flask
> proposes)?

Most applications can run unchanged without needing to know anything about SE 
Linux.

>      2.If yes then what level of applications can be transprent to
> the security architecture underneath.

I'm not sure what you mean by this.

>      3.If no what has to be done to make it security aware?

Usually nothing.  The only programs that REALLY need changes are login, sshd, 
and cron.

>      4.What would happen in case of daemons?

Generally they have their own daemon domain.

>      5.If I write an application for seLinux who will be   the
> object manager or do i have to code the object manager myself.

The kernel.

You really should try out SE Linux.  We could spend several months answering 
your questions and you still probably wouldn't get the whole picture.  Spend 
a day or two installing SE Linux on a spare machine and you'll get it much 
sooner.

Also login to #selinux on irc.openprojects.net.

-- 
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
>From field.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Help required

[Samarth Sharma]

Hi,
     1.Does SELinux provide application transparency(like Flask 
proposes)?
     2.If yes then what level of applications can be transprent to 
the security architecture underneath.
     3.If no what has to be done to make it security aware?
     4.What would happen in case of daemons?

     5.If I write an application for seLinux who will be   the 
object manager or do i have to code the object manager myself.

Thanks

Samarth
__________________________________________________________
Give your Company an email address like
ravi @ ravi-exports.com.  Sign up for Rediffmail Pro today!
Know more. http://www.rediffmailpro.com/signup/


--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.