From mboxrd@z Thu Jan 1 00:00:00 1970
Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org)
by nuthatch.gentoo.org with esmtp (Exim 4.60)
(envelope-from <gentoo-user+bounces-54874-garchives=archives.gentoo.org@gentoo.org>)
id 1GknGv-000387-2h
for garchives@archives.gentoo.org; Thu, 16 Nov 2006 19:51:41 +0000
Received: from robin.gentoo.org (localhost [127.0.0.1])
by robin.gentoo.org (8.13.8/8.13.8) with SMTP id kAGJnWZD005908;
Thu, 16 Nov 2006 19:49:32 GMT
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.172])
by robin.gentoo.org (8.13.8/8.13.8) with ESMTP id kAGJlP3M025392
for <gentoo-user@lists.gentoo.org>; Thu, 16 Nov 2006 19:47:25 GMT
Received: by ug-out-1314.google.com with SMTP id z38so511900ugc
for <gentoo-user@lists.gentoo.org>; Thu, 16 Nov 2006 11:47:25 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=beta; d=gmail.com;
h=received:from:reply-to:to:subject:date:user-agent:references:in-reply-to:mime-version:content-type:content-transfer-encoding:message-id;
b=MjSTnfFaril1Imya2ruf6RJMa2LSgEwGR/TrqlilDFB4/forG0LWzlp4h8NVVP146qwiguT+N6rC2DLsYIw01BFpiVWlH/bjN55fVXiCUsIAHqjECS1jyES5+1fRICDJhloENf4kflnWp+R2mhrQXw91DyQEFq9Pk2KA3tMoI9k=
Received: by 10.66.216.20 with SMTP id o20mr856165ugg.1163706444855;
Thu, 16 Nov 2006 11:47:24 -0800 (PST)
Received: from ?192.168.0.5? ( [213.162.120.196])
by mx.google.com with ESMTP id x33sm2632632ugc.2006.11.16.11.47.23;
Thu, 16 Nov 2006 11:47:24 -0800 (PST)
From: Mick <michaelkintzios@gmail.com>
To: gentoo-user@lists.gentoo.org
Subject: Re: [gentoo-user] Help with script for iptables
Date: Thu, 16 Nov 2006 18:05:58 +0000
User-Agent: KMail/1.9.5
References: <200611152029.35737.michaelkintzios@gmail.com> <200611160920.45191.michaelkintzios@gmail.com> <5fc5c49d0611160719w7d9a8d69w908a82412be877ea@mail.gmail.com>
In-Reply-To: <5fc5c49d0611160719w7d9a8d69w908a82412be877ea@mail.gmail.com>
Precedence: bulk
List-Post: <mailto:gentoo-user@lists.gentoo.org>
List-Help: <mailto:gentoo-user+help@gentoo.org>
List-Unsubscribe: <mailto:gentoo-user+unsubscribe@gentoo.org>
List-Subscribe: <mailto:gentoo-user+subscribe@gentoo.org>
List-Id: Gentoo Linux mail <gentoo-user.gentoo.org>
X-BeenThere: gentoo-user@gentoo.org
Reply-to: gentoo-user@lists.gentoo.org
MIME-Version: 1.0
Content-Type: multipart/signed;
boundary="nextPart6368175.v5gShl3Se7";
protocol="application/pgp-signature";
micalg=pgp-sha1
Content-Transfer-Encoding: 7bit
Message-Id: <200611161806.11492.michaelkintzios@gmail.com>
X-Archives-Salt: b0064d3c-4f70-46cf-b4ac-a80b280360a6
X-Archives-Hash: cfbed11e230b216a726d1fb5973fec3d
--nextPart6368175.v5gShl3Se7
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Thursday 16 November 2006 15:19, Nangus Garba wrote:
> # I think that a set of rules that looks something like this would be
> easier to maintain
> # there are 500 little tricks that I could add if I was home and had my
> notes
Hey! Thanks for your help - please send some more when you get home. :)
> iptables -P INPUT DROP
> iptables -A INPUT -i lo -j ACCEPT
The "! $iface" is meant to catch incoming packets on an external iface whic=
h=20
have their IP address spoofed to 127.0.0.1 type of thing. Will "lo" achiev=
e=20
the same thing?
> #this will take care of all interfaces by default
> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>
> # maybe you should just use one interface for portage to connect through
> such as eth0
Good point.
> # might also be a good plan to use the mac address instead of the ip it is
> a little harder to spoof
Could I use both in a single rule?
> #Allow rsync connections from study1 to update portage
> iptables -A INPUT -i eth0 -p tcp -s 192.168.0.2 -m tcp --dport 873 -d
> 192.168.0.5 -j ACCEPT
> #Allow tcp connections from study1 to download distfiles
> iptables -A INPUT -i eth0 -p tcp -s 192.168.0.2 -m tcp --dport 1024 -d
> 192.168.0.5 -j ACCEPT
> # these rules are kinda taken car of by: iptables -P INPUT DROP
Yes, in their current format they are, but I had previously set them up to=
=20
REJECT with different messages
> # iptables -A INPUT -p tcp -i ${x} -j DROP
> # iptables -A INPUT -p udp -i ${x} -j DROP
Keep 'em coming! :)
=2D-=20
Regards,
Mick
--nextPart6368175.v5gShl3Se7
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQBFXKiT5Fp0QerLYPcRAq2ZAJ9HEumI+hLVU8dHjz1v+g87zpR+XQCcD4dZ
yRPfGYAcbvQuZNnJ1zMHEvg=
=A6/O
-----END PGP SIGNATURE-----
--nextPart6368175.v5gShl3Se7--
--
gentoo-user@gentoo.org mailing list