firewall på pro@ccess fra TDC

alt for mange point !

Det lyder som om din server ikke kører NAT. prøv at læg denne firewall på http://www.sslug.dk/sikkerhed/netfilter.html

mente det her

#!/bin/sh

# Disable forwarding
echo \"0\" >/proc/sys/net/ipv4/ip_forward

# Enable syn-cookies (syn-flooding attacks)
echo \"1\" >/proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP echo-request to broadcast addresses (Smurf amplifier)
echo \"1\" >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Shut off source-routing and enable IP spoof detection
for f in /proc/sys/net/ipv4/conf/*; do
  # Drop all source-routed packets
  echo \"0\" >$f/accept_source_route

  # Enable source-address verification (anti spoofing).
  # The value 2 means use Ingress filtering as per RFC 1812.
  # Overhead is a little more than the simple routing check
  # (enabled with 1) but it negligible for most home users.
  echo \"2\" >$f/rp_filter
done

# Set default Policy
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Flush all 3 chains
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT

# Accept connections already establihed
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Accept all connections that does not come from the outside
iptables -A INPUT -m state --state NEW -i ! ppp0 -j ACCEPT

# Prevent spoofing of internal IP adresses from outside
iptables -A INPUT --protocol all -s 192.168.0.0/255.255.255.0 -i ppp0 -j DROP
iptables -A INPUT --protocol all -s 172.16.0.0/255.240.0.0 -i ppp0 -j DROP
iptables -A INPUT --protocol all -s 10.0.0.0/255.0.0.0 -i ppp0 -j DROP

# Accept incoming http, ftp, smtp
iptables -A INPUT -m state --protocol tcp --state NEW --destination-port http -j ACCEPT
iptables -A INPUT -m state --protocol tcp --state NEW --destination-port ftp -j ACCEPT
iptables -A INPUT -m state --protocol tcp --state NEW --destination-port smtp -j ACCEPT

# Block anything else
iptables -A INPUT -j LOG


-------------------------------------------------
Senere et eksempel på NAT
-------------------------------------------------
# Set up IP masquerading
# Flush POSTROUTING chain
iptables -t nat -F POSTROUTING
# Set POSTROUTING to MASQUERADE if you have a dynamic IP
# address.
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

# If you have a static IP number, and ONLY if you have a static IP number, use
#iptables -t nat -A POSTROUTING -o <your network interface> -j SNAT --to <your IP address>

# Enable forwarding in the kernel
echo \"1\" > /proc/sys/net/ipv4/ip_forward

Takker for dit hint den kommer med en hel stak fejl når jeg kører scriptet, tror det er noget med iptabels der går galt.
jeg har prøvet med følgende script og så kan jeg komme på nettet fra clienterne men så kan jeg ikke se http serveren fra nettet det kan jeg indtil jeg kører scriptet

echo 1 > /proc/sys/net/ipv4/ip_forward
ipchains -F
ipchains -P input ACCEPT
ipchains -P output ACCEPT
ipchains -P forward ACCEPT
ipchains -A forward -i eth0 -j MASQ

har nogen en firewall opsætning hvor der er
åbnet for http udefra. der bruger ipchains
Hilsen Brian

Så sætter vi den da op med ipchains :-)

Her er et ok script : http://www.linuxguruz.org/iptables/scripts/rc.firewall_021.txt
og en howto her :
http://www.linuxdoc.org/HOWTO/IPCHAINS-HOWTO.html