| View previous topic :: View next topic |
| Author |
Message |
sm0ker
n00b
Joined: 20 Jan 2006
Posts: 28
|
 Posted: Thu Sep 25, 2008 5:04 pm Post subject: firehol / iptables / was weiss ich.. *g* |
 |
|
erstmal hallo...
folgendes "problem" oder auch nicht problem..
ich habe hier ne gentoo box aufgesetzt, die mein lan ins inet routen soll. das ganze ist mit firehol gemacht und funzt soweit auch wie es soll. nun habe ich aber das problem, dass ich einen port auf eine meiner maschienen forwarden will. nur stell ich mich scheinbar zu doof an und hoffe hier kann mir wer das brett vor'm kopf wegnehmen..
ich moechte realisieren: internet -> router -> client
der router hat ip 192.168.1.1 und die einwahl als auch das firehol script funzen, soll heissen ich kann surfen und alles machen und so, nur eben der eine prot den ich forwarden will, der mag net so recht und auch wenn ich torrent starte, dauert es ewig bis ne website aufgeht...
ich weiss net so genau was ich da falsch mache...
also, der router (192.168.1.1) ist nen aktuelles gentoo und der client ist nen xp pro sp3 (192.168.1.4). wenn ich bitcomet (torrent) starte, bekomme ich erstens keine webseiten mehr auf, heisst der laedt sich tot und zweitens sagt mir bitcomet immer, dass mein listening port net offen ist. wenn ich das per online scanner ueberpruefe, sagt der mir auch, dass eben jener port stealth ist. woran koennte das liegen? ich habe in der firehol.conf doch, zumindest denk ich das, alles richtig eingestellt..
ich habe da eine der example dateien als "vorlage" genommen...
| Code: |
#
# $Id: lan-gateway.conf,v 1.1 2003/10/12 13:43:42 ktsaou Exp $
#
# Configuration file for a LAN router with one ethernet interface (eth0)
# for the LAN and a PPP interface for connecting to the Internet.
#
# The LAN works with private IP addresses.
#
# This script will also setup a transparent cache for all the PCs on the
# local LAN.
# ----------------------------------------------------------------------------
# CUSTOM SERVICES
# ----------------------------------------------------------------------------
# See the section "Adding Services" in the documentation
# Example service x, listening on port TCP/z
# > server_x_ports="tcp/z"
# > client_x_ports="default"
# ----------------------------------------------------------------------------
# NETWORK DEFINITIONS - Normally, only these are to be touched by you.
# ----------------------------------------------------------------------------
# You can define anything you like, assuming you are using it later.
# --- HOME ---
# The definition of our HOME LAN.
HOME_MYIP="192.168.1.1" # The IP on our HOME LAN
HOME_MYIF="eth0" # The HOME LAN interface
HOME_BCAST="192.168.1.255" # The HOME LAN broadcast
HOME_LAN="192.168.1.0/24" # The HOME LAN
HOME_SERVICES="all"
nat to-destination 192.168.1.4:15552 inface ppp0 proto tcp dport 15552
#dnat to-destination 192.168.1.4:15552 inface ppp0 proto udp dport 15552
# Do we run a DHCP server on the HOME LAN?
HOME_DHCP=0 # Set to 0 to disable
# --- PUBLIC ---
# The definition of our PUBLIC interface.
PUBLIC_MYIP="" # Leave empty for dynamic IP
PUBLIC_MYIF="ppp0" # The public interface
PUBLIC_SERVICES=""
# Is the PPP interface a DIAL-ON-DEMAND?
DIAL_ON_DEMAND=0 # Set to 0 to disabl
# --- TRUSTED ---
# Hosts in the internet I trust for accessing private services
# Empty these to disable.
#TRUSTED_IPS="my-office-pc.example.com"
#TRUSTED_SERVICES="ssh http"
# --- TRANSPARENT CACHE ---
# Run a transparent cache?
#SQUID_PORT="3128" # Leave empty to disable SQUID
#SQUID_USERS="squid" # Users to be excluded from the cache
#SQUID_EXCLUDE="" # Web Server IPs to be excluded from the cache
# --- BLACKLIST ---
# A space-separated list of IPs to be blocked.
blacklist=""
# ----------------------------------------------------------------------------
# HELPERS
# ----------------------------------------------------------------------------
# Block all traffic from/to certain IPs
if [ ! -z "${blacklist}" ]
then
blacklist full "${blacklist}"
fi
# Setup a transparent squid, only if SQUID_PORT is set.
if [ ! -z "${SQUID_PORT}" ]
then
transparent_squid "${SQUID_PORT}" "${SQUID_USERS}" \
inface "${HOME_MYIF}" src "${HOME_LAN}" \
`test ! -z "${SQUID_EXCLUDE}" && echo "dst not '${SQUID_EXCLUDE}'"`
fi
# ----------------------------------------------------------------------------
# NETWORK ADDRESS TRANSLATION
# ----------------------------------------------------------------------------
# Change the source/destination of packets...
# Should we do SNAT or MASQUERADE?
# If there is a PUBLIC_MYIP defined, we should do SNAT, otherwise MASQ.
#
if [ ! -z "${PUBLIC_MYIP}" ]
then
snat to "${PUBLIC_MYIP}" \
outface "${PUBLIC_MYIF}" \
src "${HOME_LAN}" dst not "${UNROUTABLE_IPS}"
else
masquerade "${PUBLIC_MYIF}"
fi
# To have some public service hit an internal machine, do this:
# (the example redirects external port TCP/26 to internal IP 10.0.0.2 port 25)
#
# > dnat to 10.0.0.2:25 \
# > inface "${PUBLIC_MYIF}" \
# > src not "${HOME_LAN} ${UNROUTABLE_IPS}" \
# > proto tcp dport 26
#
# For each such statement, the router at the end has to support it.
# ----------------------------------------------------------------------------
# PROTECT SELF
# ----------------------------------------------------------------------------
# Protect the firewall host...
# --- HOME ---
# Protect us from the HOME LAN
interface "${HOME_MYIF}" home src "${HOME_LAN}" dst "${HOME_MYIP} ${HOME_BCAST}"
policy reject
server "${HOME_SERVICES}" accept
client all accept
# DHCP needs 0.0.0.0/255.255.255.255 access.
if [ ${HOME_DHCP} -eq 1 ]
then
interface "${HOME_MYIF}" dhcp
server dhcp accept
fi
# --- PUBLIC ---
# Protect us from the PUBLIC
interface "${PUBLIC_MYIF}" internet \
src not "${UNROUTABLE_IPS}" \
`test ! -z "${PUBLIC_MYIP}" && echo "dst '${PUBLIC_MYIP}'"`
protection strong
policy drop
# Are there any trusted PCs/services?
if [ ! -z "${TRUSTED_PCS}" -a ! -z "${TRUSTED_SERVICES}" ]
then
server "${TRUSTED_SERVICES}" accept src "${TRUSTED_PCS}"
fi
server "${PUBLIC_SERVICES}" accept
client all accept
# DIAL-ON-DEMAND needs this in case there is a PUBLIC_MYIP defined.
if [ ${DIAL_ON_DEMAND} -eq 1 ]
then
interface "${PUBLIC_MYIF}" dialup
client all accept
fi
# ----------------------------------------------------------------------------
# PROTECT ROUTING
# ----------------------------------------------------------------------------
# Protect the LAN...
# Route traffic for the clients on the LAN
router internet2lan inface "${PUBLIC_MYIF}" outface "${HOME_MYIF}" \
src not "${UNROUTABLE_IPS}" dst "${HOME_LAN}"
# route all client traffic
client all accept
# For the dnat example above, this is needed:
# > server smtp accept dst 10.0.0.2
|
wo ist mein fehler? oder besser gesagt, warum forwarded er port 15552 net auf maschiene 192.168.1.4 ?? |
|
| Back to top |
|
 |
AWO
Tux's lil' helper
Joined: 24 May 2005
Posts: 144
Location: 52°32N / 11°58E
|
|
| Back to top |
|
|
sm0ker
n00b
Joined: 20 Jan 2006
Posts: 28
|
| Posted: Thu Sep 25, 2008 7:19 pm Post subject: |
|
|
y0 danke fuer den tipp. ich wollte das ganze aber mit firehol machen.. hast du nen tipp wie ich das konfigurieren muss/kann? ich hab natuerlich auch scho nueber nen eigenes iptables script nachgedacht, aber mir kam das firehol so, naja unkompliziert vor..  |
|
| Back to top |
|
|
AWO
Tux's lil' helper
Joined: 24 May 2005
Posts: 144
Location: 52°32N / 11°58E
|
|
| Back to top |
|
|
schmutzfinger
Veteran
Joined: 26 Oct 2003
Posts: 1287
Location: Dresden/Germany
|
| Posted: Thu Sep 25, 2008 8:27 pm Post subject: |
|
|
Am besten du gibts hier die erzeugten iptables Regeln an. Damit können die meisten wohl mehr anfangen als mit der firehol Beschreibung.
Selbst wenn deine DNAT Regeln richtig sind, kann es zum Beispiel sein, dass der Router auf dem Port nix reinlässt.
Ich kann verstehen, dass man die Regeln nicht selber schreiben will. Mir geht es auch so und ich habe da bisher immer shorewall eingesetzt, vielleicht guckst du dir das auch mal an. |
|
| Back to top |
|
|
sm0ker
n00b
Joined: 20 Jan 2006
Posts: 28
|
| Posted: Thu Sep 25, 2008 9:48 pm Post subject: |
|
|
danke fuer die antworten. ich habe eben alles wieder auf meinen hw router umgesteckt. aber morgen , nach dem ersten kaffee, werd ich die rules von iptables posten...
ich denke iptables --list
sollte mehr auskunft geben, oder? wie gesagt, ich stoepsle das morgen nochmal um.. dann poste ich die ausgaben hier.. |
|
| Back to top |
|
|
sm0ker
n00b
Joined: 20 Jan 2006
Posts: 28
|
| Posted: Fri Sep 26, 2008 12:58 pm Post subject: |
|
|
so, alles wieder umgestoepselt..
mist, wie haenge ich hier ne datei an.. des ist echt viel...
ich hoffe das nimmt mir nun keiner krumm...
| Code: |
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
in_home all -- localhost/24 horst.home.lan
in_home all -- localhost/24 localhost
in_internet all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `'IN-unknown:''
DROP all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
in_internet2lan all -- anywhere localhost/24
out_internet2lan all -- localhost/24 anywhere
ACCEPT all -- anywhere anywhere state RELATED
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `'PASS-unknown:''
DROP all -- anywhere anywhere
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
out_home all -- horst.home.lan localhost/24
out_home all -- localhost localhost/24
out_internet all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `'OUT-unknown:''
DROP all -- anywhere anywhere
Chain in_home (2 references)
target prot opt source destination
in_home_all_s1 all -- anywhere anywhere
in_home_irc_s2 all -- anywhere anywhere
in_home_ftp_s3 all -- anywhere anywhere
in_home_all_c4 all -- anywhere anywhere
in_home_irc_c5 all -- anywhere anywhere
in_home_ftp_c6 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED
LOG tcp -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `''IN-home':''
REJECT tcp -- anywhere anywhere reject-with tcp-reset
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `''IN-home':''
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain in_home_all_c4 (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state ESTABLISHED
Chain in_home_all_s1 (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state NEW,ESTABLISHED
Chain in_home_ftp_c6 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:ftp dpts:32768:61000 state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spt:ftp-data dpts:32768:61000 state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpts:32768:61000 state ESTABLISHED
Chain in_home_ftp_s3 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:ftp state NEW,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:ftp-data state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpts:32768:61000 state RELATED,ESTABLISHED
Chain in_home_irc_c5 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:ircd dpts:32768:61000 state ESTABLISHED
Chain in_home_irc_s2 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:ircd state NEW,ESTABLISHED
Chain in_internet (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/8 anywhere
RETURN all -- 1.0.0.0/8 anywhere
RETURN all -- 2.0.0.0/8 anywhere
RETURN all -- 5.0.0.0/8 anywhere
RETURN all -- localhost/8 anywhere
RETURN all -- 14.0.0.0/8 anywhere
RETURN all -- 23.0.0.0/8 anywhere
RETURN all -- 27.0.0.0/8 anywhere
RETURN all -- 31.0.0.0/8 anywhere
RETURN all -- 36.0.0.0/8 anywhere
RETURN all -- 37.0.0.0/8 anywhere
RETURN all -- 39.0.0.0/8 anywhere
RETURN all -- 42.0.0.0/8 anywhere
RETURN all -- 46.0.0.0/8 anywhere
RETURN all -- 49.0.0.0/8 anywhere
RETURN all -- 50.0.0.0/8 anywhere
RETURN all -- 100.0.0.0/8 anywhere
RETURN all -- 101.0.0.0/8 anywhere
RETURN all -- 102.0.0.0/8 anywhere
RETURN all -- 103.0.0.0/8 anywhere
RETURN all -- 104.0.0.0/8 anywhere
RETURN all -- 105.0.0.0/8 anywhere
RETURN all -- 106.0.0.0/8 anywhere
RETURN all -- 107.0.0.0/8 anywhere
RETURN all -- 108.0.0.0/8 anywhere
RETURN all -- 109.0.0.0/8 anywhere
RETURN all -- 110.0.0.0/8 anywhere
RETURN all -- 111.0.0.0/8 anywhere
RETURN all -- loopback/8 anywhere
RETURN all -- 175.0.0.0/8 anywhere
RETURN all -- 176.0.0.0/8 anywhere
RETURN all -- 177.0.0.0/8 anywhere
RETURN all -- 178.0.0.0/8 anywhere
RETURN all -- 179.0.0.0/8 anywhere
RETURN all -- 180.0.0.0/8 anywhere
RETURN all -- 181.0.0.0/8 anywhere
RETURN all -- 182.0.0.0/8 anywhere
RETURN all -- 183.0.0.0/8 anywhere
RETURN all -- 184.0.0.0/8 anywhere
RETURN all -- 185.0.0.0/8 anywhere
RETURN all -- 197.0.0.0/8 anywhere
RETURN all -- 223.0.0.0/8 anywhere
RETURN all -- 240.0.0.0/8 anywhere
RETURN all -- 241.0.0.0/8 anywhere
RETURN all -- 242.0.0.0/8 anywhere
RETURN all -- 243.0.0.0/8 anywhere
RETURN all -- 244.0.0.0/8 anywhere
RETURN all -- 245.0.0.0/8 anywhere
RETURN all -- 246.0.0.0/8 anywhere
RETURN all -- 247.0.0.0/8 anywhere
RETURN all -- 248.0.0.0/8 anywhere
RETURN all -- 249.0.0.0/8 anywhere
RETURN all -- 250.0.0.0/8 anywhere
RETURN all -- 251.0.0.0/8 anywhere
RETURN all -- 252.0.0.0/8 anywhere
RETURN all -- 253.0.0.0/8 anywhere
RETURN all -- 254.0.0.0/8 anywhere
RETURN all -- 255.0.0.0/8 anywhere
RETURN all -- localhost/8 anywhere
RETURN all -- link-local/16 anywhere
RETURN all -- localhost/12 anywhere
RETURN all -- 192.0.2.0/24 anywhere
RETURN all -- 192.88.99.0/24 anywhere
RETURN all -- localhost/16 anywhere
DROP all -- anywhere anywhere state INVALID
pr_internet_fragments all -f anywhere anywhere
pr_internet_nosyn tcp -- anywhere anywhere state NEW tcp flags:!FIN,SYN,RST,ACK/SYN
pr_internet_icmpflood icmp -- anywhere anywhere icmp echo-request
pr_internet_synflood tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
pr_internet_malxmas tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
pr_internet_malnull tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
pr_internet_malbad tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN
pr_internet_malbad tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST
pr_internet_malbad tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
pr_internet_malbad tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
in_internet_all_c1 all -- anywhere anywhere
in_internet_irc_c2 all -- anywhere anywhere
in_internet_ftp_c3 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `''IN-internet':''
DROP all -- anywhere anywhere
Chain in_internet2lan (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/8 anywhere
RETURN all -- 1.0.0.0/8 anywhere
RETURN all -- 2.0.0.0/8 anywhere
RETURN all -- 5.0.0.0/8 anywhere
RETURN all -- localhost/8 anywhere
RETURN all -- 14.0.0.0/8 anywhere
RETURN all -- 23.0.0.0/8 anywhere
RETURN all -- 27.0.0.0/8 anywhere
RETURN all -- 31.0.0.0/8 anywhere
RETURN all -- 36.0.0.0/8 anywhere
RETURN all -- 37.0.0.0/8 anywhere
RETURN all -- 39.0.0.0/8 anywhere
RETURN all -- 42.0.0.0/8 anywhere
RETURN all -- 46.0.0.0/8 anywhere
RETURN all -- 49.0.0.0/8 anywhere
RETURN all -- 50.0.0.0/8 anywhere
RETURN all -- 100.0.0.0/8 anywhere
RETURN all -- 101.0.0.0/8 anywhere
RETURN all -- 102.0.0.0/8 anywhere
RETURN all -- 103.0.0.0/8 anywhere
RETURN all -- 104.0.0.0/8 anywhere
RETURN all -- 105.0.0.0/8 anywhere
RETURN all -- 106.0.0.0/8 anywhere
RETURN all -- 107.0.0.0/8 anywhere
RETURN all -- 108.0.0.0/8 anywhere
RETURN all -- 109.0.0.0/8 anywhere
RETURN all -- 110.0.0.0/8 anywhere
RETURN all -- 111.0.0.0/8 anywhere
RETURN all -- loopback/8 anywhere
RETURN all -- 175.0.0.0/8 anywhere
RETURN all -- 176.0.0.0/8 anywhere
RETURN all -- 177.0.0.0/8 anywhere
RETURN all -- 178.0.0.0/8 anywhere
RETURN all -- 179.0.0.0/8 anywhere
RETURN all -- 180.0.0.0/8 anywhere
RETURN all -- 181.0.0.0/8 anywhere
RETURN all -- 182.0.0.0/8 anywhere
RETURN all -- 183.0.0.0/8 anywhere
RETURN all -- 184.0.0.0/8 anywhere
RETURN all -- 185.0.0.0/8 anywhere
RETURN all -- 197.0.0.0/8 anywhere
RETURN all -- 223.0.0.0/8 anywhere
RETURN all -- 240.0.0.0/8 anywhere
RETURN all -- 241.0.0.0/8 anywhere
RETURN all -- 242.0.0.0/8 anywhere
RETURN all -- 243.0.0.0/8 anywhere
RETURN all -- 244.0.0.0/8 anywhere
RETURN all -- 245.0.0.0/8 anywhere
RETURN all -- 246.0.0.0/8 anywhere
RETURN all -- 247.0.0.0/8 anywhere
RETURN all -- 248.0.0.0/8 anywhere
RETURN all -- 249.0.0.0/8 anywhere
RETURN all -- 250.0.0.0/8 anywhere
RETURN all -- 251.0.0.0/8 anywhere
RETURN all -- 252.0.0.0/8 anywhere
RETURN all -- 253.0.0.0/8 anywhere
RETURN all -- 254.0.0.0/8 anywhere
RETURN all -- 255.0.0.0/8 anywhere
RETURN all -- localhost/8 anywhere
RETURN all -- link-local/16 anywhere
RETURN all -- localhost/12 anywhere
RETURN all -- 192.0.2.0/24 anywhere
RETURN all -- 192.88.99.0/24 anywhere
RETURN all -- localhost/16 anywhere
in_internet2lan_all_c1 all -- anywhere anywhere
in_internet2lan_irc_c2 all -- anywhere anywhere
in_internet2lan_ftp_c3 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED
Chain in_internet2lan_all_c1 (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state ESTABLISHED
Chain in_internet2lan_ftp_c3 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:ftp dpts:1024:65535 state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spt:ftp-data dpts:1024:65535 state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpts:1024:65535 state ESTABLISHED
Chain in_internet2lan_irc_c2 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:ircd dpts:1024:65535 state ESTABLISHED
Chain in_internet_all_c1 (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state ESTABLISHED
Chain in_internet_ftp_c3 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:ftp dpts:32768:61000 state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spt:ftp-data dpts:32768:61000 state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpts:32768:61000 state ESTABLISHED
Chain in_internet_irc_c2 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:ircd dpts:32768:61000 state ESTABLISHED
Chain out_home (2 references)
target prot opt source destination
out_home_all_s1 all -- anywhere anywhere
out_home_irc_s2 all -- anywhere anywhere
out_home_ftp_s3 all -- anywhere anywhere
out_home_all_c4 all -- anywhere anywhere
out_home_irc_c5 all -- anywhere anywhere
out_home_ftp_c6 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED
LOG tcp -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `''OUT-home':''
REJECT tcp -- anywhere anywhere reject-with tcp-reset
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `''OUT-home':''
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
Chain out_home_all_c4 (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state NEW,ESTABLISHED
Chain out_home_all_s1 (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state ESTABLISHED
Chain out_home_ftp_c6 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts:32768:61000 dpt:ftp state NEW,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:32768:61000 dpt:ftp-data state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:32768:61000 dpts:1024:65535 state RELATED,ESTABLISHED
Chain out_home_ftp_s3 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:ftp dpts:1024:65535 state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spt:ftp-data dpts:1024:65535 state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:32768:61000 dpts:1024:65535 state ESTABLISHED
Chain out_home_irc_c5 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts:32768:61000 dpt:ircd state NEW,ESTABLISHED
Chain out_home_irc_s2 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:ircd dpts:1024:65535 state ESTABLISHED
Chain out_internet (1 references)
target prot opt source destination
RETURN all -- anywhere 0.0.0.0/8
RETURN all -- anywhere 1.0.0.0/8
RETURN all -- anywhere 2.0.0.0/8
RETURN all -- anywhere 5.0.0.0/8
RETURN all -- anywhere localhost/8
RETURN all -- anywhere 14.0.0.0/8
RETURN all -- anywhere 23.0.0.0/8
RETURN all -- anywhere 27.0.0.0/8
RETURN all -- anywhere 31.0.0.0/8
RETURN all -- anywhere 36.0.0.0/8
RETURN all -- anywhere 37.0.0.0/8
RETURN all -- anywhere 39.0.0.0/8
RETURN all -- anywhere 42.0.0.0/8
RETURN all -- anywhere 46.0.0.0/8
RETURN all -- anywhere 49.0.0.0/8
RETURN all -- anywhere 50.0.0.0/8
RETURN all -- anywhere 100.0.0.0/8
RETURN all -- anywhere 101.0.0.0/8
RETURN all -- anywhere 102.0.0.0/8
RETURN all -- anywhere 103.0.0.0/8
RETURN all -- anywhere 104.0.0.0/8
RETURN all -- anywhere 105.0.0.0/8
RETURN all -- anywhere 106.0.0.0/8
RETURN all -- anywhere 107.0.0.0/8
RETURN all -- anywhere 108.0.0.0/8
RETURN all -- anywhere 109.0.0.0/8
RETURN all -- anywhere 110.0.0.0/8
RETURN all -- anywhere 111.0.0.0/8
RETURN all -- anywhere loopback/8
RETURN all -- anywhere 175.0.0.0/8
RETURN all -- anywhere 176.0.0.0/8
RETURN all -- anywhere 177.0.0.0/8
RETURN all -- anywhere 178.0.0.0/8
RETURN all -- anywhere 179.0.0.0/8
RETURN all -- anywhere 180.0.0.0/8
RETURN all -- anywhere 181.0.0.0/8
RETURN all -- anywhere 182.0.0.0/8
RETURN all -- anywhere 183.0.0.0/8
RETURN all -- anywhere 184.0.0.0/8
RETURN all -- anywhere 185.0.0.0/8
RETURN all -- anywhere 197.0.0.0/8
RETURN all -- anywhere 223.0.0.0/8
RETURN all -- anywhere 240.0.0.0/8
RETURN all -- anywhere 241.0.0.0/8
RETURN all -- anywhere 242.0.0.0/8
RETURN all -- anywhere 243.0.0.0/8
RETURN all -- anywhere 244.0.0.0/8
RETURN all -- anywhere 245.0.0.0/8
RETURN all -- anywhere 246.0.0.0/8
RETURN all -- anywhere 247.0.0.0/8
RETURN all -- anywhere 248.0.0.0/8
RETURN all -- anywhere 249.0.0.0/8
RETURN all -- anywhere 250.0.0.0/8
RETURN all -- anywhere 251.0.0.0/8
RETURN all -- anywhere 252.0.0.0/8
RETURN all -- anywhere 253.0.0.0/8
RETURN all -- anywhere 254.0.0.0/8
RETURN all -- anywhere 255.0.0.0/8
RETURN all -- anywhere localhost/8
RETURN all -- anywhere link-local/16
RETURN all -- anywhere localhost/12
RETURN all -- anywhere 192.0.2.0/24
RETURN all -- anywhere 192.88.99.0/24
RETURN all -- anywhere localhost/16
out_internet_all_c1 all -- anywhere anywhere
out_internet_irc_c2 all -- anywhere anywhere
out_internet_ftp_c3 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `''OUT-internet':''
DROP all -- anywhere anywhere
Chain out_internet2lan (1 references)
target prot opt source destination
RETURN all -- anywhere 0.0.0.0/8
RETURN all -- anywhere 1.0.0.0/8
RETURN all -- anywhere 2.0.0.0/8
RETURN all -- anywhere 5.0.0.0/8
RETURN all -- anywhere localhost/8
RETURN all -- anywhere 14.0.0.0/8
RETURN all -- anywhere 23.0.0.0/8
RETURN all -- anywhere 27.0.0.0/8
RETURN all -- anywhere 31.0.0.0/8
RETURN all -- anywhere 36.0.0.0/8
RETURN all -- anywhere 37.0.0.0/8
RETURN all -- anywhere 39.0.0.0/8
RETURN all -- anywhere 42.0.0.0/8
RETURN all -- anywhere 46.0.0.0/8
RETURN all -- anywhere 49.0.0.0/8
RETURN all -- anywhere 50.0.0.0/8
RETURN all -- anywhere 100.0.0.0/8
RETURN all -- anywhere 101.0.0.0/8
RETURN all -- anywhere 102.0.0.0/8
RETURN all -- anywhere 103.0.0.0/8
RETURN all -- anywhere 104.0.0.0/8
RETURN all -- anywhere 105.0.0.0/8
RETURN all -- anywhere 106.0.0.0/8
RETURN all -- anywhere 107.0.0.0/8
RETURN all -- anywhere 108.0.0.0/8
RETURN all -- anywhere 109.0.0.0/8
RETURN all -- anywhere 110.0.0.0/8
RETURN all -- anywhere 111.0.0.0/8
RETURN all -- anywhere loopback/8
RETURN all -- anywhere 175.0.0.0/8
RETURN all -- anywhere 176.0.0.0/8
RETURN all -- anywhere 177.0.0.0/8
RETURN all -- anywhere 178.0.0.0/8
RETURN all -- anywhere 179.0.0.0/8
RETURN all -- anywhere 180.0.0.0/8
RETURN all -- anywhere 181.0.0.0/8
RETURN all -- anywhere 182.0.0.0/8
RETURN all -- anywhere 183.0.0.0/8
RETURN all -- anywhere 184.0.0.0/8
RETURN all -- anywhere 185.0.0.0/8
RETURN all -- anywhere 197.0.0.0/8
RETURN all -- anywhere 223.0.0.0/8
RETURN all -- anywhere 240.0.0.0/8
RETURN all -- anywhere 241.0.0.0/8
RETURN all -- anywhere 242.0.0.0/8
RETURN all -- anywhere 243.0.0.0/8
RETURN all -- anywhere 244.0.0.0/8
RETURN all -- anywhere 245.0.0.0/8
RETURN all -- anywhere 246.0.0.0/8
RETURN all -- anywhere 247.0.0.0/8
RETURN all -- anywhere 248.0.0.0/8
RETURN all -- anywhere 249.0.0.0/8
RETURN all -- anywhere 250.0.0.0/8
RETURN all -- anywhere 251.0.0.0/8
RETURN all -- anywhere 252.0.0.0/8
RETURN all -- anywhere 253.0.0.0/8
RETURN all -- anywhere 254.0.0.0/8
RETURN all -- anywhere 255.0.0.0/8
RETURN all -- anywhere localhost/8
RETURN all -- anywhere link-local/16
RETURN all -- anywhere localhost/12
RETURN all -- anywhere 192.0.2.0/24
RETURN all -- anywhere 192.88.99.0/24
RETURN all -- anywhere localhost/16
out_internet2lan_all_c1 all -- anywhere anywhere
out_internet2lan_irc_c2 all -- anywhere anywhere
out_internet2lan_ftp_c3 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED
Chain out_internet2lan_all_c1 (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state NEW,ESTABLISHED
Chain out_internet2lan_ftp_c3 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:ftp state NEW,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:ftp-data state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpts:1024:65535 state RELATED,ESTABLISHED
Chain out_internet2lan_irc_c2 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts:1024:65535 dpt:ircd state NEW,ESTABLISHED
Chain out_internet_all_c1 (1 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere state NEW,ESTABLISHED
Chain out_internet_ftp_c3 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts:32768:61000 dpt:ftp state NEW,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:32768:61000 dpt:ftp-data state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spts:32768:61000 dpts:1024:65535 state RELATED,ESTABLISHED
Chain out_internet_irc_c2 (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spts:32768:61000 dpt:ircd state NEW,ESTABLISHED
Chain pr_internet_fragments (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `'PACKET FRAGMENTS:''
DROP all -- anywhere anywhere
Chain pr_internet_icmpflood (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere limit: avg 100/sec burst 50
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `'ICMP FLOOD:''
DROP all -- anywhere anywhere
Chain pr_internet_malbad (4 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `'MALFORMED BAD:''
DROP all -- anywhere anywhere
Chain pr_internet_malnull (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `'MALFORMED NULL:''
DROP all -- anywhere anywhere
Chain pr_internet_malxmas (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `'MALFORMED XMAS:''
DROP all -- anywhere anywhere
Chain pr_internet_nosyn (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `'NEW TCP w/o SYN:''
DROP all -- anywhere anywhere
Chain pr_internet_synflood (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere limit: avg 100/sec burst 50
LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `'SYN FLOOD:''
DROP all -- anywhere anywhere
|
ich hoffe damit koennt ihr was anfangen..
soweit ich das sehe, hat er gar keine forwarding rules.. wo ist mein fehler?!? |
|
| Back to top |
|
|
root_tux_linux
l33t
Joined: 21 Dec 2003
Posts: 966
|
| Posted: Fri Sep 26, 2008 2:26 pm Post subject: |
|
|
Versuchs mit Guarddog und Guidedog.
_________________
Intel Core i7 6700K@4.6GHz, Gigabyte GTX 980 Ti G1, Gigabyte Gaming 7, Hyper X Fury 32GB, 2 TB Samsung EVO 840 Basic
ASUS ROG Swift PG348Q Display
ASUS ROG ASUS G771JW Notebook |
|
| Back to top |
|
|
sm0ker
n00b
Joined: 20 Jan 2006
Posts: 28
|
| Posted: Fri Sep 26, 2008 2:39 pm Post subject: |
|
|
| ok. dann versuch ich das einfach mal.. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Deutsches Forum (German)
