You are not logged in.
- Topics: Active | Unanswered
#1 2012-07-27 19:39:55
- hussam
- Member
- Registered: 2006-03-26
- Posts: 572
- Website
simple iptables rules.
I have two NICs installed. one is used to dial a ppp0 connection through eth0.
Another one is used for internet connection sharing (eth1) with a few other computers and phones/
the boost sequence starts adsl service then squid (transparent proxy) and then rc.local runs:
ifconfig eth1 192.168.0.1 netmask 255.255.255.0
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -F
iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner proxy -j ACCEPT
iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128
In pppoe.conf, the FIREWALL is set to NONE. if I set to MASQUERADE, internet stops working at all.
but since ppp0 is connected directly to the internet (real IP address), I need some simply iptables rules to protect my box through ppp0.
Any suggestions?
Last edited by hussam (2012-07-27 19:41:15)
Offline
#2 2012-07-27 20:28:07
- Strike0
- Member
- From: Germany
- Registered: 2011-09-05
- Posts: 1,491
Re: simple iptables rules.
In pppoe.conf, the FIREWALL is set to NONE. if I set to MASQUERADE, internet stops working at all.
but since ppp0 is connected directly to the internet (real IP address), I need some simply iptables rules to protect my box through ppp0.
Your config looks fine with NONE in pppoe.conf.
Doubts? Anymore rules you feel necessary to have, just add them to your tables.
Offline
#3 2012-07-27 20:40:10
- hussam
- Member
- Registered: 2006-03-26
- Posts: 572
- Website
Re: simple iptables rules.
ok, I added these:
# Drop ping requests
iptables -A INPUT -i ppp0 -p icmp --icmp-type echo-request -j DROP# Drop connections to privileged ports
iptables -t filter -A INPUT -i ppp0 -p tcp --dport 0:1023 -j LOG
iptables -t filter -A INPUT -i ppp0 -p udp --dport 0:1023 -j LOG
iptables -t filter -A INPUT -i ppp0 -p tcp --dport 0:1023 -j DROP
iptables -t filter -A INPUT -i ppp0 -p udp --dport 0:1023 -j DROP# Drop connections to squid through ppp0
iptables -t filter -A INPUT -i ppp0 -p tcp --dport 3128 -j DROP
Offline