(no subject)

Bernd Petrovitsch bernd at firmix.at
Tue Nov 21 11:54:04 CET 2006


On Tue, 2006-11-21 at 10:44 +0000, Tim Edwards wrote:
> 
> -----Original Message-----
> From: Bernd Petrovitsch [mailto:bernd at firmix.at] 
> Sent: 21 November 2006 10:13
> To: Tim Edwards
> Cc: netfilter at lists.netfilter.org
> Subject: Re: (no subject)
> 
> > Yes. Just insert such a rule into the OUTPUT chain.
> 
> Ok I have the following rules but it still isn't cutting off existing
> connections:

Yup.

> #!/bin/bash
> 
> # First clear all rules (and set the policy to DROP on the default
> chains)
> iptables -F
> # Second delete all the extra (user-defined) chains
> iptables -X
> # Set polcy on the default chains
> iptables -P INPUT DROP
> iptables -P OUTPUT DROP
> iptables -P FORWARD DROP
> # allow anything over loopback
> iptables -A INPUT -i lo -j ACCEPT
> iptables -A OUTPUT -o lo -j ACCEPT
> # Allow incoming ssh and http/s connections
> iptables -A INPUT -p tcp -m tcp -m multiport --dports 22,80,443 -j
> ACCEPT
> iptables -A INPUT -j LOG --log-prefix="INPUT REJECT" --log-level=info
> iptables -A INPUT -j REJECT
> # Allow already established ssh and http/s connections back out through
> the firewall
> iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

This allows all existing connections. If the above comment should be
correct, you probably forgot here something.

> iptables -A OUTPUT -j LOG --log-prefix="OUTPUT REJECT" --log-level=info
> iptables -A OUTPUT -j REJECT
> iptables -A FORWARD -j LOG --log-prefix="FORWARD REJECT"
> --log-level=info
> iptables -A FORWARD -j REJECT

	Bernd
-- 
Firmix Software GmbH                   http://www.firmix.at/
mobil: +43 664 4416156                 fax: +43 1 7890849-55
          Embedded Linux Development and Services




More information about the netfilter mailing list