7:32 p.m.
On Fedora Core 3, I want to enable the firewall, permitting inbound TCP
connections from anywhere on port 80. I also want to allow inbound
connections on port 3306 but only from hosts 192.168.1.1 and 192.168.1.2.
It looks like I can't do this from the Applications --> System Settings
--> Security Level GUI. I can allow ports 80 and 3306, but it doesn't
look like I can limit the port 3306 connections to just 2 specific
hosts. I would have to craft an IPTABLES script. Am I right here, and if
so, what would be the right way to add specific IPTABLES rules without
interfering with the Security Level applet?
Thanks
Bob Cochran
Greenbelt, Maryland, USA
8:14 p.m.
On Sat, 2005-01-29 at 20:32 -0500, Robert L Cochran wrote:
On Fedora Core 3, I want to enable the firewall, permitting inbound
TCP
connections from anywhere on port 80. I also want to allow inbound
connections on port 3306 but only from hosts 192.168.1.1 and 192.168.1.2.
It looks like I can't do this from the Applications --> System Settings
--> Security Level GUI. I can allow ports 80 and 3306, but it doesn't
look like I can limit the port 3306 connections to just 2 specific
hosts. I would have to craft an IPTABLES script. Am I right here, and if
so, what would be the right way to add specific IPTABLES rules without
interfering with the Security Level applet?
Thanks
Bob Cochran
Greenbelt, Maryland, USA
Best way, man iptables and lean how to build chains for what you need
Fast way, use your favorite Package Manager and install Firestarter.
MC
9:13 p.m.
On Sat, 2005-01-29 at 20:32 -0500, Robert L Cochran wrote:
On Fedora Core 3, I want to enable the firewall, permitting inbound
TCP
connections from anywhere on port 80. I also want to allow inbound
connections on port 3306 but only from hosts 192.168.1.1 and 192.168.1.2.
It looks like I can't do this from the Applications --> System Settings
--> Security Level GUI. I can allow ports 80 and 3306, but it doesn't
look like I can limit the port 3306 connections to just 2 specific
hosts. I would have to craft an IPTABLES script. Am I right here, and if
so, what would be the right way to add specific IPTABLES rules without
interfering with the Security Level applet?
----
yeah - it's a very basic tool
If you want to start messing with iptables...it's not hard - I've always
used David Ranch's trinity os think stuff
http://www.ecst.csuchico.edu/~dranch/LINUX/ipmasq/c-html/stronger-
firewall-examples.html#RC.FIREWALL-2.4.X-STRONGER
but basically, you can simply add rules to that which you created with
the system-config-securitylevel and the issue the command 'service
iptables save' but that is mindless...if you ever run the system-config-
securitylevel again, you will wipe out any custom stuff you added.
I think this is how you would do one of the lines...
/sbin/iptables -A INPUT -i eth0 -s 192.168.1.1/32 -p tcp --dport 3306 -j
ACCEPT
Craig
3:35 a.m.
Robert L Cochran wrote:
On Fedora Core 3, I want to enable the firewall, permitting inbound
TCP connections from anywhere on port 80. I also want to allow inbound
connections on port 3306 but only from hosts 192.168.1.1 and
192.168.1.2.
It looks like I can't do this from the Applications --> System
Settings --> Security Level GUI. I can allow ports 80 and 3306, but it
doesn't look like I can limit the port 3306 connections to just 2
specific hosts. I would have to craft an IPTABLES script. Am I right
here, and if so, what would be the right way to add specific IPTABLES
rules without interfering with the Security Level applet?
Thanks
Bob Cochran
Greenbelt, Maryland, USA
I (as the other posters) will recommend you to learn iptables, and if
you want a very easy way to configure your firewall and build *quite*
complex per-interface rule sets, I'd strongly recommend you take a look
at fwbuilder (there are the packages for it in the pre-extras repo
[http://fedoraproject.org/pre-extras])
3:53 a.m.
Gain Paolo Mureddu wrote:
Robert L Cochran wrote:
> On Fedora Core 3, I want to enable the firewall, permitting inbound
> TCP connections from anywhere on port 80. I also want to allow
> inbound connections on port 3306 but only from hosts 192.168.1.1 and
> 192.168.1.2.
>
> It looks like I can't do this from the Applications --> System
> Settings --> Security Level GUI. I can allow ports 80 and 3306, but
> it doesn't look like I can limit the port 3306 connections to just 2
> specific hosts. I would have to craft an IPTABLES script. Am I right
> here, and if so, what would be the right way to add specific IPTABLES
> rules without interfering with the Security Level applet?
>
> Thanks
>
> Bob Cochran
> Greenbelt, Maryland, USA
>
I (as the other posters) will recommend you to learn iptables, and if
you want a very easy way to configure your firewall and build *quite*
complex per-interface rule sets, I'd strongly recommend you take a
look at fwbuilder (there are the packages for it in the pre-extras
repo [http://fedoraproject.org/pre-extras])
Thank you. How do I implement iptables rules without interfering with
what the Security Level applet sets?
Bob
5:06 p.m.
On Sun, 2005-01-30 at 04:53 -0500, Robert L Cochran wrote:
Gain Paolo Mureddu wrote:
> Robert L Cochran wrote:
>
>> On Fedora Core 3, I want to enable the firewall, permitting inbound
>> TCP connections from anywhere on port 80. I also want to allow
>> inbound connections on port 3306 but only from hosts 192.168.1.1 and
>> 192.168.1.2.
>>
>> It looks like I can't do this from the Applications --> System
>> Settings --> Security Level GUI. I can allow ports 80 and 3306, but
>> it doesn't look like I can limit the port 3306 connections to just 2
>> specific hosts. I would have to craft an IPTABLES script. Am I right
>> here, and if so, what would be the right way to add specific IPTABLES
>> rules without interfering with the Security Level applet?
>>
>> Thanks
>>
>> Bob Cochran
>> Greenbelt, Maryland, USA
>>
> I (as the other posters) will recommend you to learn iptables, and if
> you want a very easy way to configure your firewall and build *quite*
> complex per-interface rule sets, I'd strongly recommend you take a
> look at fwbuilder (there are the packages for it in the pre-extras
> repo [http://fedoraproject.org/pre-extras])
>
Thank you. How do I implement iptables rules without interfering with
what the Security Level applet sets?
Bob
Very simply, open up a terminal, su over to root. Add the iptables
rules tgat you want.
When you are finshed, service iptables save will make them permanent
MC
6:56 p.m.
micheal wrote:
On Sun, 2005-01-30 at 04:53 -0500, Robert L Cochran wrote:
>Gain Paolo Mureddu wrote:
>
>
>
>>Robert L Cochran wrote:
>>
>>
>>
>>>On Fedora Core 3, I want to enable the firewall, permitting inbound
>>>TCP connections from anywhere on port 80. I also want to allow
>>>inbound connections on port 3306 but only from hosts 192.168.1.1 and
>>>192.168.1.2.
>>>
>>>It looks like I can't do this from the Applications --> System
>>>Settings --> Security Level GUI. I can allow ports 80 and 3306, but
>>>it doesn't look like I can limit the port 3306 connections to just 2
>>>specific hosts. I would have to craft an IPTABLES script. Am I right
>>>here, and if so, what would be the right way to add specific IPTABLES
>>>rules without interfering with the Security Level applet?
>>>
>>>Thanks
>>>
>>>Bob Cochran
>>>Greenbelt, Maryland, USA
>>>
>>>
>>>
>>I (as the other posters) will recommend you to learn iptables, and if
>>you want a very easy way to configure your firewall and build *quite*
>>complex per-interface rule sets, I'd strongly recommend you take a
>>look at fwbuilder (there are the packages for it in the pre-extras
>>repo [http://fedoraproject.org/pre-extras])
>>
>>
>>
>Thank you. How do I implement iptables rules without interfering with
>what the Security Level applet sets?
>
>Bob
>
>
>
Very simply, open up a terminal, su over to root. Add the iptables
rules tgat you want.
When you are finshed, service iptables save will make them permanent
MC
Thank you. I am assuming that the Security Level applet adds its own
iptables rules. Is this correct? So it would drop all inbound
connections on all ports to start with, and allow in only the the
connections I permit through the applet.
If I'm right about the above, then I can just do what you say: just add
the new iptables rules I'm interested in, enter 'service iptables save',
and they become permanent. Am I still right?
Now suppose I screwed up and made a mistake. Can I change the rules I
messed up?
Thanks
Bob
7:19 p.m.
On Mon, 2005-01-31 at 19:56 -0500, Robert L Cochran wrote:
>>>
>>Thank you. How do I implement iptables rules without interfering with
>>what the Security Level applet sets?
>>
>>Bob
>>
>>
>>
>
>Very simply, open up a terminal, su over to root. Add the iptables
>rules tgat you want.
>
>When you are finshed, service iptables save will make them permanent
>
>MC
>
>
>
Thank you. I am assuming that the Security Level applet adds its own
iptables rules. Is this correct? So it would drop all inbound
connections on all ports to start with, and allow in only the the
connections I permit through the applet.
If I'm right about the above, then I can just do what you say: just add
the new iptables rules I'm interested in, enter 'service iptables save',
and they become permanent. Am I still right?
Now suppose I screwed up and made a mistake. Can I change the rules I
messed up?
Thanks
Bob
Essentially yes, system-config-secutitylevel works the same way. For
example, If you were to add for Other ports: 445:tcp in the applet. It
would add this to the chain:
ACCEPT tcp -- anywhere anywhere tcp
dpt:microsoft-ds
The same effect can be achieved by
iptables -A INPUT -p TCP -dport 445 -d 192.168.1.1 -j ACCEPT
and then service iptables save
All of the available options are in man iptables, there are also some
very helpful pages on the web
Disclamer, I have not worked with iptables in a long time, feel free to
correct my syntax
MC
7:52 p.m.
micheal wrote:
On Mon, 2005-01-31 at 19:56 -0500, Robert L Cochran wrote:
>>>Thank you. How do I implement iptables rules without interfering with
>>>what the Security Level applet sets?
>>>
>>>Bob
>>>
>>>
>>>
>>>
>>>
>>Very simply, open up a terminal, su over to root. Add the iptables
>>rules tgat you want.
>>
>>When you are finshed, service iptables save will make them permanent
>>
>>MC
>>
>>
>>
>>
>>
>Thank you. I am assuming that the Security Level applet adds its own
>iptables rules. Is this correct? So it would drop all inbound
>connections on all ports to start with, and allow in only the the
>connections I permit through the applet.
>
>If I'm right about the above, then I can just do what you say: just add
>the new iptables rules I'm interested in, enter 'service iptables save',
>and they become permanent. Am I still right?
>
>Now suppose I screwed up and made a mistake. Can I change the rules I
>messed up?
>
>Thanks
>
>Bob
>
>
>
Essentially yes, system-config-secutitylevel works the same way. For
example, If you were to add for Other ports: 445:tcp in the applet. It
would add this to the chain:
ACCEPT tcp -- anywhere anywhere tcp
dpt:microsoft-ds
The same effect can be achieved by
iptables -A INPUT -p TCP -dport 445 -d 192.168.1.1 -j ACCEPT
and then service iptables save
All of the available options are in man iptables, there are also some
very helpful pages on the web
Disclamer, I have not worked with iptables in a long time, feel free to
correct my syntax
MC
Here is what Security Level set for me when I permitted incoming http
and ssh through the GUI applet:
[root@bobcp4 ~]# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j
ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
---------------------------------------------------------------------------------------------------------------------
Here is a list of all the iptables chains:
[root@bobcp4 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT ipv6-crypt-- anywhere anywhere
ACCEPT ipv6-auth-- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:5353
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT all -- anywhere anywhere state
RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:https
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with
icmp-host-prohibited
-------------------------------------------------------------------------------------------------------------------------
now suppose I independently add a rule like this:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3306
-s 192.168.1.0/24 -j ACCEPT
the rule will be added to the bottom of the RH-Firewall -1-INPUT chain,
right after that REJECT. So a datagram for port 3306 will traverse the
chain, hit the REJECT, and get blown away without ever being inspected
by the new rule appearing after the REJECT.
Am I on the right track here?
Thanks
Bob Cochran
7:59 p.m.
On Mon, 2005-01-31 at 20:52 -0500, Robert L Cochran wrote:
---------------------------------------------------------------------------------------------------------------------
Here is a list of all the iptables chains:
[root@bobcp4 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT ipv6-crypt-- anywhere anywhere
ACCEPT ipv6-auth-- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:5353
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT all -- anywhere anywhere state
RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:https
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with
icmp-host-prohibited
-------------------------------------------------------------------------------------------------------------------------
now suppose I independently add a rule like this:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3306
-s 192.168.1.0/24 -j ACCEPT
the rule will be added to the bottom of the RH-Firewall -1-INPUT chain,
right after that REJECT. So a datagram for port 3306 will traverse the
chain, hit the REJECT, and get blown away without ever being inspected
by the new rule appearing after the REJECT.
Am I on the right track here?
----
why don't you try it?
and then
service iptables save
service iptables restart
iptables -L
and see what happens then?
Craig
9:13 p.m.
Craig White wrote:
On Mon, 2005-01-31 at 20:52 -0500, Robert L Cochran wrote:
>---------------------------------------------------------------------------------------------------------------------
>Here is a list of all the iptables chains:
>
>[root@bobcp4 ~]# iptables -L
>Chain INPUT (policy ACCEPT)
>target prot opt source destination
>RH-Firewall-1-INPUT all -- anywhere anywhere
>
>Chain FORWARD (policy ACCEPT)
>target prot opt source destination
>RH-Firewall-1-INPUT all -- anywhere anywhere
>
>Chain OUTPUT (policy ACCEPT)
>target prot opt source destination
>
>Chain RH-Firewall-1-INPUT (2 references)
>target prot opt source destination
>ACCEPT all -- anywhere anywhere
>ACCEPT icmp -- anywhere anywhere icmp any
>ACCEPT ipv6-crypt-- anywhere anywhere
>ACCEPT ipv6-auth-- anywhere anywhere
>ACCEPT udp -- anywhere 224.0.0.251 udp dpt:5353
>ACCEPT udp -- anywhere anywhere udp dpt:ipp
>ACCEPT all -- anywhere anywhere state
>RELATED,ESTABLISHED
>ACCEPT tcp -- anywhere anywhere state NEW
>tcp dpt:http
>ACCEPT tcp -- anywhere anywhere state NEW
>tcp dpt:https
>ACCEPT tcp -- anywhere anywhere state NEW
>tcp dpt:ssh
>REJECT all -- anywhere anywhere reject-with
>icmp-host-prohibited
>
>-------------------------------------------------------------------------------------------------------------------------
>
>now suppose I independently add a rule like this:
>
>-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3306
>-s 192.168.1.0/24 -j ACCEPT
>
>the rule will be added to the bottom of the RH-Firewall -1-INPUT chain,
>right after that REJECT. So a datagram for port 3306 will traverse the
>chain, hit the REJECT, and get blown away without ever being inspected
>by the new rule appearing after the REJECT.
>
>Am I on the right track here?
>
>
----
why don't you try it?
and then
service iptables save
service iptables restart
iptables -L
and see what happens then?
Craig
I tried this in steps. I added the new rule. At first I didn't do the
'service iptables save' or 'service iptables restart'. The new rule
appends to the existing chain and I still could not connect to the
server (as expected).
Then I did a 'service iptables save' which saved the firewall rules, in
the order shown by 'iptables -L', to file /etc/sysconfig/iptables. This
was unacceptable because it the saved rules would later be added to the
chain in the wrong order.
Then I manually edited /etc/sysconfig/iptables and moved the new ACCEPT
rule before the final REJECT rule. I did a 'service iptables restart'
and listed the chain out. That was better -- the rule was in the right
place. And the connection attempt from a different host succeeded, too.
Thanks, this has got me started in the direction I need.
Bob
9:17 p.m.
You can also use webmin to create iptables chains, if you'd prefer a
more GUI/web form type interface.
--
MG
9:08 p.m.
On Mon, 2005-01-31 at 20:52 -0500, Robert L Cochran wrote:
micheal wrote:
>On Mon, 2005-01-31 at 19:56 -0500, Robert L Cochran wrote:
>
>
>
>>>>Thank you. How do I implement iptables rules without interfering with
>>>>what the Security Level applet sets?
>>>>
>>>>Bob
>>>>
>>>>
>>>>
>>>>
>>>>
>>>Very simply, open up a terminal, su over to root. Add the iptables
>>>rules tgat you want.
>>>
>>>When you are finshed, service iptables save will make them permanent
>>>
>>>MC
>>>
>>>
>>>
>>>
>>>
>>Thank you. I am assuming that the Security Level applet adds its own
>>iptables rules. Is this correct? So it would drop all inbound
>>connections on all ports to start with, and allow in only the the
>>connections I permit through the applet.
>>
>>If I'm right about the above, then I can just do what you say: just add
>>the new iptables rules I'm interested in, enter 'service iptables
save',
>>and they become permanent. Am I still right?
>>
>>Now suppose I screwed up and made a mistake. Can I change the rules I
>>messed up?
>>
>>Thanks
>>
>>Bob
>>
>>
>>
>
>Essentially yes, system-config-secutitylevel works the same way. For
>example, If you were to add for Other ports: 445:tcp in the applet. It
>would add this to the chain:
>
>ACCEPT tcp -- anywhere anywhere tcp
>dpt:microsoft-ds
>
>
>The same effect can be achieved by
>iptables -A INPUT -p TCP -dport 445 -d 192.168.1.1 -j ACCEPT
>
>and then service iptables save
>
>All of the available options are in man iptables, there are also some
>very helpful pages on the web
>
>Disclamer, I have not worked with iptables in a long time, feel free to
>correct my syntax
>
>MC
>
>
>
>
Here is what Security Level set for me when I permitted incoming http
and ssh through the GUI applet:
[root@bobcp4 ~]# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j
ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j
ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
---------------------------------------------------------------------------------------------------------------------
Here is a list of all the iptables chains:
[root@bobcp4 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT ipv6-crypt-- anywhere anywhere
ACCEPT ipv6-auth-- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:5353
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT all -- anywhere anywhere state
RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:https
ACCEPT tcp -- anywhere anywhere state NEW
tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with
icmp-host-prohibited
-------------------------------------------------------------------------------------------------------------------------
now suppose I independently add a rule like this:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3306
-s 192.168.1.0/24 -j ACCEPT
the rule will be added to the bottom of the RH-Firewall -1-INPUT chain,
right after that REJECT. So a datagram for port 3306 will traverse the
chain, hit the REJECT, and get blown away without ever being inspected
by the new rule appearing after the REJECT.
Am I on the right track here?
Thanks
Bob Cochran
>
>
>
Looks like you got the basic idea, the reject is last so the effect is
unless i have earlier stated otherwise, reject it.
Though you would want to use the iptables command rather then edit that
file.
MC
7023
days inactive
7025
days old
12 comments
5 participants
participants (5)
-
Craig White -
Gain Paolo Mureddu -
m g -
micheal -
Robert L Cochran