| View previous topic :: View next topic |
| Author |
Message |
genitus
Tux's lil' helper
Joined: 07 Jun 2007
Posts: 87
Location: Europe
|
 Posted: Sun Jul 08, 2007 10:47 pm Post subject: doubled rules/chains for INPUT/OUTPUT ? |
 |
|
for example i have a rule to allow only INPUT packets from several services :
| Code: |
iptables -P INPUT DROP
iptables -A INPUT -j services
iptables -N services
iptables -A services -p tcp --sport 80 -j ACCEPT
iptables -A services -p tcp --sport 443 -j ACCEPT
iptables -A services -p ALL -j RETURN |
but now i want also to allow the same services (http/https) for OUTPUT packets .
do i need a doubled "services"-chain then (with --dport instead --sport) for OUTPUT packets ?
isn't there a better solution ?
greetings |
|
| Back to top |
|
 |
didymos
Advocate
Joined: 10 Oct 2005
Posts: 4798
Location: California
|
| Posted: Sun Jul 08, 2007 11:13 pm Post subject: |
|
|
Usually, it's alright to just have the OUTPUT policy as ACCEPT, since anything going out is coming from your machine. Now, if you want to allow only those services out, then you'll need specific rules.
_________________
Thomas S. Howard |
|
| Back to top |
|
|
genitus
Tux's lil' helper
Joined: 07 Jun 2007
Posts: 87
Location: Europe
|
| Posted: Mon Jul 09, 2007 1:03 am Post subject: |
|
|
well , i think specifying the OUTPUT chain should be rather commonly used ( although it is maybe
pointless for a simple single user desktop machine ), so i wonder if there is not a better way instead of having
to make rules for the exactly same services for input and output chain...
also i wonder why you can/need to specify an INPUT interface like "lo" and for OUTPUT an interface can not be defined...
is it not OUTPUT when i "ping localhost" ?... i guess when you want to specify OUTPUT interface specific rules then you need to
use a routing chain , but anyway strange.... |
|
| Back to top |
|
|
didymos
Advocate
Joined: 10 Oct 2005
Posts: 4798
Location: California
|
| Posted: Mon Jul 09, 2007 2:49 am Post subject: |
|
|
You can specify:
| Quote: |
-o, --out-interface [!] name
Name of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTING
chains). When the "!" argument is used before the interface name, the sense is inverted. If the interface name ends in
a "+", then any interface which begins with this name will match. If this option is omitted, any interface name will
match.
|
You're probably used to thinking '-i' means interface, which makes sense given how many commands use it that way.
_________________
Thomas S. Howard |
|
| Back to top |
|
|
|
Networking & Security
