* iptables questions @ Tyler Littlefield ` Gregory Nowak ` Willem van der Walt 0 siblings, 2 replies; 14+ messages in thread From: Tyler Littlefield @ UTC (permalink / raw) To: Speakup is a screen review system for Linux. Hello list, I tried running endoshield, and got a ton of errors. So, now I will try to do it manually. I'm going through a tutorial now, and I have a coupel questions. I can do the following. iptables -A INPUT -p tcp -dport 2200 -j queue iptables -A INPUT -p tcp -sport 2200 -j queue to allow for the traffic on port 2200 to go through. I think. But, lets say I create a rule for each port. The ones I want to allow, and the ones I don't want to allow. I think I can use a -s to make it only local if I want. Then, how would I block the ports that I haven't created rules for? next, if I set up the box as a DMZ, in front of the router, is there a way that I can make it manage all traffic coming in and out of the network? Just like the router would? Thanks, ~~TheCreator~~ website: http://tysplace.shaned.net msn: compgeek134@hotmail.com aim: st8amnd2005 skype: st8amnd127 moo coder/wizard and administrator ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions iptables questions Tyler Littlefield @ ` Gregory Nowak ` Tyler Littlefield ` Willem van der Walt 1 sibling, 1 reply; 14+ messages in thread From: Gregory Nowak @ UTC (permalink / raw) To: Speakup is a screen review system for Linux. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tue, Jul 11, 2006 at 03:04:23PM -0600, Tyler Littlefield wrote: > I tried running endoshield, and got a ton of errors. When I first started using endoshield, I found the errors I got were the result of not configuring all the iptables stuff during my kernel config. So, your best bet in my humble opinion is to include all the iptables, nat, and connection tracking stuff as modules, and tying endoshield again. You could also post your errors, so we can see if a lack of modules is the case here, or if it's something else. > So, now I will try to do it manually. I'm going through a tutorial now, and I have a coupel questions. > I can do the following. > iptables -A INPUT -p tcp -dport 2200 -j queue > iptables -A INPUT -p tcp -sport 2200 -j queue > to allow for the traffic on port 2200 to go through. I think. I've never used the queue target, so I can't help you here. I can only tell you that when I want to open a port, I use the ACCEPT target to do so. > But, lets say I create a rule for each port. The ones I want to allow, and the ones I don't want to allow. > I think I can use a -s to make it only local if I want. > Then, how would I block the ports that I haven't created rules for? Off the top of my head, without looking at the iptables docs, or at the endoshield script, I believe you use the DROP target on the entire input chain, and below that, use the ACCEPT target on the ports you want to open. I do however stand to be corrected here. > next, if I set up the box as a DMZ, in front of the router, is there a way that I can make it manage all traffic coming in and out of the network? Just like the router would? Yes, this is called ip masquerading, and endoshield is a good example of how it's done. Also note that if you intend to share your connection with multiple machines, your main machine will need 2 network cards, one from the router to the pc, and the other from the pc to the switch/hub that your other machines are connected to. Greg - -- web site: http://www.romuald.net.eu.org gpg public key: http://www.romuald.net.eu.org/pubkey.asc skype: gregn1 (authorization required, add me to your contacts list first) - -- Free domains: http://www.eu.org/ or mail dns-manager@EU.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) iD8DBQFEtFmy7s9z/XlyUyARAsrtAKDBUJ2A64LR4gOHroSFnORWAoSmvwCcC2En 78FEqOYvuvSIEOYuM8Ic3M4= =MPIm -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions ` Gregory Nowak @ ` Tyler Littlefield ` Alex Snow ` Gregory Nowak 0 siblings, 2 replies; 14+ messages in thread From: Tyler Littlefield @ UTC (permalink / raw) To: Speakup is a screen review system for Linux. Hello, I don't understand how the maskerading works. I currently have a router, that is connected to the modem. Then, I have another 3 computers behind the router, one of which is the linux. What I want to do is dmz linux so that it acts as a firewall. Thanks, ~~TheCreator~~ website: http://tysplace.shaned.net msn: compgeek134@hotmail.com aim: st8amnd2005 skype: st8amnd127 moo coder/wizard and administrator ----- Original Message ----- From: "Gregory Nowak" <greg@romuald.net.eu.org> To: "Speakup is a screen review system for Linux." <speakup@braille.uwo.ca> Sent: Tuesday, July 11, 2006 8:08 PM Subject: Re: iptables questions > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Tue, Jul 11, 2006 at 03:04:23PM -0600, Tyler Littlefield wrote: > > I tried running endoshield, and got a ton of errors. > > When I first started using endoshield, I found the errors I got were > the result of not configuring all the iptables stuff during my kernel > config. So, your best bet in my humble opinion is to include all the > iptables, nat, and connection tracking stuff as modules, and tying > endoshield again. You could also post your errors, so we can see if a > lack of modules is the case here, or if it's something else. > > > So, now I will try to do it manually. I'm going through a tutorial now, and I have a coupel questions. > > I can do the following. > > iptables -A INPUT -p tcp -dport 2200 -j queue > > iptables -A INPUT -p tcp -sport 2200 -j queue > > to allow for the traffic on port 2200 to go through. I think. > > I've never used the queue target, so I can't help you here. I can only > tell you that when I want to open a port, I use the ACCEPT target to > do so. > > > But, lets say I create a rule for each port. The ones I want to allow, and the ones I don't want to allow. > > I think I can use a -s to make it only local if I want. > > Then, how would I block the ports that I haven't created rules for? > > Off the top of my head, without looking at the iptables docs, or at > the endoshield script, I believe you use the DROP target on the entire > input chain, and below that, use the ACCEPT target on the ports you > want to open. I do however stand to be corrected here. > > > next, if I set up the box as a DMZ, in front of the router, is there a way that I can make it manage all traffic coming in and out of the network? Just like the router would? > > Yes, this is called ip masquerading, and endoshield is a good example > of how it's done. Also note that if you intend to share your > connection with multiple machines, your main machine will need 2 > network cards, one from the router to the pc, and the other from the > pc to the switch/hub that your other machines are connected to. > > Greg > > > > > - -- > web site: http://www.romuald.net.eu.org > gpg public key: http://www.romuald.net.eu.org/pubkey.asc > skype: gregn1 > (authorization required, add me to your contacts list first) > > - -- > Free domains: http://www.eu.org/ or mail dns-manager@EU.org > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.3 (GNU/Linux) > > iD8DBQFEtFmy7s9z/XlyUyARAsrtAKDBUJ2A64LR4gOHroSFnORWAoSmvwCcC2En > 78FEqOYvuvSIEOYuM8Ic3M4= > =MPIm > -----END PGP SIGNATURE----- > > _______________________________________________ > Speakup mailing list > Speakup@braille.uwo.ca > http://speech.braille.uwo.ca/mailman/listinfo/speakup ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions ` Tyler Littlefield @ ` Alex Snow ` Gregory Nowak 1 sibling, 0 replies; 14+ messages in thread From: Alex Snow @ UTC (permalink / raw) To: Speakup is a screen review system for Linux. What exactly are you trying to do? From yur message it seems like you want to do 1 of 2 things: 1. Have the linux machine dmz'ed so services running on it can be accessed from the outside world. For this you just need to set up iptables to block incoming connections on ports you don't want people to be able to connect to. 2. have your linux box as a firewall for your entire lan. For this you need 2 interfaces in your box, one from the modem and one to your existing router/switch. Then you would set up iptables to nat, and add the proper firewall rules for your network. On Wed, Jul 12, 2006 at 09:40:41AM -0600, Tyler Littlefield wrote: > Hello, > I don't understand how the maskerading works. > I currently have a router, that is connected to the modem. > Then, I have another 3 computers behind the router, one of which is the > linux. What I want to do is dmz linux so that it acts as a firewall. > Thanks, > ~~TheCreator~~ > website: > http://tysplace.shaned.net > msn: > compgeek134@hotmail.com > aim: > st8amnd2005 > skype: > st8amnd127 > moo coder/wizard and administrator > > ----- Original Message ----- > From: "Gregory Nowak" <greg@romuald.net.eu.org> > To: "Speakup is a screen review system for Linux." <speakup@braille.uwo.ca> > Sent: Tuesday, July 11, 2006 8:08 PM > Subject: Re: iptables questions > > > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > On Tue, Jul 11, 2006 at 03:04:23PM -0600, Tyler Littlefield wrote: > > > I tried running endoshield, and got a ton of errors. > > > > When I first started using endoshield, I found the errors I got were > > the result of not configuring all the iptables stuff during my kernel > > config. So, your best bet in my humble opinion is to include all the > > iptables, nat, and connection tracking stuff as modules, and tying > > endoshield again. You could also post your errors, so we can see if a > > lack of modules is the case here, or if it's something else. > > > > > So, now I will try to do it manually. I'm going through a tutorial now, > and I have a coupel questions. > > > I can do the following. > > > iptables -A INPUT -p tcp -dport 2200 -j queue > > > iptables -A INPUT -p tcp -sport 2200 -j queue > > > to allow for the traffic on port 2200 to go through. I think. > > > > I've never used the queue target, so I can't help you here. I can only > > tell you that when I want to open a port, I use the ACCEPT target to > > do so. > > > > > But, lets say I create a rule for each port. The ones I want to allow, > and the ones I don't want to allow. > > > I think I can use a -s to make it only local if I want. > > > Then, how would I block the ports that I haven't created rules for? > > > > Off the top of my head, without looking at the iptables docs, or at > > the endoshield script, I believe you use the DROP target on the entire > > input chain, and below that, use the ACCEPT target on the ports you > > want to open. I do however stand to be corrected here. > > > > > next, if I set up the box as a DMZ, in front of the router, is there a > way that I can make it manage all traffic coming in and out of the network? > Just like the router would? > > > > Yes, this is called ip masquerading, and endoshield is a good example > > of how it's done. Also note that if you intend to share your > > connection with multiple machines, your main machine will need 2 > > network cards, one from the router to the pc, and the other from the > > pc to the switch/hub that your other machines are connected to. > > > > Greg > > > > > > > > > > - -- > > web site: http://www.romuald.net.eu.org > > gpg public key: http://www.romuald.net.eu.org/pubkey.asc > > skype: gregn1 > > (authorization required, add me to your contacts list first) > > > > - -- > > Free domains: http://www.eu.org/ or mail dns-manager@EU.org > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v1.4.3 (GNU/Linux) > > > > iD8DBQFEtFmy7s9z/XlyUyARAsrtAKDBUJ2A64LR4gOHroSFnORWAoSmvwCcC2En > > 78FEqOYvuvSIEOYuM8Ic3M4= > > =MPIm > > -----END PGP SIGNATURE----- > > > > _______________________________________________ > > Speakup mailing list > > Speakup@braille.uwo.ca > > http://speech.braille.uwo.ca/mailman/listinfo/speakup > > > > _______________________________________________ > Speakup mailing list > Speakup@braille.uwo.ca > http://speech.braille.uwo.ca/mailman/listinfo/speakup -- ...Unix, MS-DOS, and Windows NT (also known as the Good, the Bad, and the Ugly). -- Matt Welsh ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions ` Tyler Littlefield ` Alex Snow @ ` Gregory Nowak ` Tyler Littlefield 1 sibling, 1 reply; 14+ messages in thread From: Gregory Nowak @ UTC (permalink / raw) To: Speakup is a screen review system for Linux. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Generally, if I don't understand how something works, there is a very good chance that searching the web will give me at least one, if not more, good explanations. In short, masquerading does what your router does now. If you're still laboring under the misconception that your ISP is assigning the 10.x.x.x addresses to your machine, the sooner you accept what I've told you twice before, that your modem or router is actually doing that, the easier it will be for you to understand masquerading. Masquerading will simply allow you to assign an internal ip to each of the machines on your LAN, and make any internet traffic from those machines look as if it's coming from your single public IP, assigned to you by your ISP. Like I've said, this is exactly what your modem or router does currently. Greg On Wed, Jul 12, 2006 at 09:40:41AM -0600, Tyler Littlefield wrote: > Hello, > I don't understand how the maskerading works. > I currently have a router, that is connected to the modem. > Then, I have another 3 computers behind the router, one of which is the > linux. What I want to do is dmz linux so that it acts as a firewall. > Thanks, > ~~TheCreator~~ > website: > http://tysplace.shaned.net > msn: > compgeek134@hotmail.com > aim: > st8amnd2005 > skype: > st8amnd127 > moo coder/wizard and administrator > - -- web site: http://www.romuald.net.eu.org gpg public key: http://www.romuald.net.eu.org/pubkey.asc skype: gregn1 (authorization required, add me to your contacts list first) - -- Free domains: http://www.eu.org/ or mail dns-manager@EU.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) iD8DBQFEtTww7s9z/XlyUyARAjFNAKDVbewJEIqr88HgUhRmWGQ67Ism0wCgkwu8 1oqcXLQXttVDm/vbCcDD4K8= =mT9Z -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions ` Gregory Nowak @ ` Tyler Littlefield ` Gregory Nowak 0 siblings, 1 reply; 14+ messages in thread From: Tyler Littlefield @ UTC (permalink / raw) To: Speakup is a screen review system for Linux. > > Generally, if I don't understand how something works, there is a very > good chance that searching the web will give me at least one, if not > more, good explanations. > > In short, masquerading does what your router does now. If you're still > laboring under the misconception that your ISP is assigning the > 10.x.x.x addresses to your machine, the sooner you accept what I've > told you twice before, that your modem or router is actually doing > that, the easier it will be for you to understand > masquerading. Um... I called the ISP, and had to go up to the manager, because no one else woudl tell me what was going on. It turned out that it **wasn't** the modem/router, but I had a private IP. I ended up paying $5 extra a month for a public. Masquerading will simply allow you to assign an internal ip > to each of the machines on your LAN, and make any internet traffic > from those machines look as if it's coming from your single public IP, > assigned to you by your ISP. Like I've said, this is exactly what your > modem or router does currently. > > Greg > > > On Wed, Jul 12, 2006 at 09:40:41AM -0600, Tyler Littlefield wrote: > > Hello, > > I don't understand how the maskerading works. > > I currently have a router, that is connected to the modem. > > Then, I have another 3 computers behind the router, one of which is the > > linux. What I want to do is dmz linux so that it acts as a firewall. > > Thanks, > > ~~TheCreator~~ > > website: > > http://tysplace.shaned.net > > msn: > > compgeek134@hotmail.com > > aim: > > st8amnd2005 > > skype: > > st8amnd127 > > moo coder/wizard and administrator > > > > > > - -- > web site: http://www.romuald.net.eu.org > gpg public key: http://www.romuald.net.eu.org/pubkey.asc > skype: gregn1 > (authorization required, add me to your contacts list first) > > _______________________________________________ > Speakup mailing list > Speakup@braille.uwo.ca > http://speech.braille.uwo.ca/mailman/listinfo/speakup ~~TheCreator~~ website: http://tysplace.shaned.net msn: compgeek134@hotmail.com aim: st8amnd2005 skype: st8amnd127 moo coder/wizard and administrator ----- Original Message ----- From: "Gregory Nowak" <greg@romuald.net.eu.org> To: "Speakup is a screen review system for Linux." <speakup@braille.uwo.ca> Sent: Wednesday, July 12, 2006 12:15 PM Subject: Re: iptables questions > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Generally, if I don't understand how something works, there is a very > good chance that searching the web will give me at least one, if not > more, good explanations. > > In short, masquerading does what your router does now. If you're still > laboring under the misconception that your ISP is assigning the > 10.x.x.x addresses to your machine, the sooner you accept what I've > told you twice before, that your modem or router is actually doing > that, the easier it will be for you to understand > masquerading. Masquerading will simply allow you to assign an internal ip > to each of the machines on your LAN, and make any internet traffic > from those machines look as if it's coming from your single public IP, > assigned to you by your ISP. Like I've said, this is exactly what your > modem or router does currently. > > Greg > > > On Wed, Jul 12, 2006 at 09:40:41AM -0600, Tyler Littlefield wrote: > > Hello, > > I don't understand how the maskerading works. > > I currently have a router, that is connected to the modem. > > Then, I have another 3 computers behind the router, one of which is the > > linux. What I want to do is dmz linux so that it acts as a firewall. > > Thanks, > > ~~TheCreator~~ > > website: > > http://tysplace.shaned.net > > msn: > > compgeek134@hotmail.com > > aim: > > st8amnd2005 > > skype: > > st8amnd127 > > moo coder/wizard and administrator > > > > > > - -- > web site: http://www.romuald.net.eu.org > gpg public key: http://www.romuald.net.eu.org/pubkey.asc > skype: gregn1 > (authorization required, add me to your contacts list first) > > - -- > Free domains: http://www.eu.org/ or mail dns-manager@EU.org > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.3 (GNU/Linux) > > iD8DBQFEtTww7s9z/XlyUyARAjFNAKDVbewJEIqr88HgUhRmWGQ67Ism0wCgkwu8 > 1oqcXLQXttVDm/vbCcDD4K8= > =mT9Z > -----END PGP SIGNATURE----- > > _______________________________________________ > Speakup mailing list > Speakup@braille.uwo.ca > http://speech.braille.uwo.ca/mailman/listinfo/speakup ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions ` Tyler Littlefield @ ` Gregory Nowak ` Tyler Littlefield ` John Heim 0 siblings, 2 replies; 14+ messages in thread From: Gregory Nowak @ UTC (permalink / raw) To: Speakup is a screen review system for Linux. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Jul 12, 2006 at 12:20:19PM -0600, Tyler Littlefield wrote: > Um... I called the ISP, and had to go up to the manager, because no one > else woudl tell me what was going on. It turned out that it **wasn't** the > modem/router, but I had a private IP. I ended up paying $5 extra a month for > a public. Ok, but that's one heck of a rip off if you ask me. A decent ISP will give you a dynamic publicly accessible IP for free, and charge you extra for your own public static address. For an ISP to be doing NAT on it's network for it's customers, and be charging to give them a public IP which I'm guessing is still dynamic, is a rip off. Anyway, you have 3 machines you said with internet connections. However, you still have one public IP address, unless you purchased a block of static addresses. So, my point still stands, your modem or router is still doing IP masquerading for you, and assigning an internal IP to each of your 3 machines. Greg - -- web site: http://www.romuald.net.eu.org gpg public key: http://www.romuald.net.eu.org/pubkey.asc skype: gregn1 (authorization required, add me to your contacts list first) - -- Free domains: http://www.eu.org/ or mail dns-manager@EU.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) iD8DBQFEtUCV7s9z/XlyUyARAmaBAJ954cyPQYqHfdAom9PZvxp61tj5UgCgtl27 Jf9c9b4pAzpM1UIQLByybHk= =4SGI -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions ` Gregory Nowak @ ` Tyler Littlefield ` John Heim 1 sibling, 0 replies; 14+ messages in thread From: Tyler Littlefield @ UTC (permalink / raw) To: Speakup is a screen review system for Linux. Yay, I agree that it is. They called my grandma, and told her that they were "upgrading." So, the tech came down, and "upgraded." I had the router all set up on different ports and stuff, (web admin, on 8000) so I could help her when she needed it. They changed it over... Anyway, it was a public static before they "upgraded." but then they jsut locked us in behind there firewall, or what ever they did. Thanks, ~~TheCreator~~ website: http://tysplace.shaned.net msn: compgeek134@hotmail.com aim: st8amnd2005 skype: st8amnd127 moo coder/wizard and administrator ----- Original Message ----- From: "Gregory Nowak" <greg@romuald.net.eu.org> To: "Speakup is a screen review system for Linux." <speakup@braille.uwo.ca> Sent: Wednesday, July 12, 2006 12:33 PM Subject: Re: iptables questions > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Wed, Jul 12, 2006 at 12:20:19PM -0600, Tyler Littlefield wrote: > > Um... I called the ISP, and had to go up to the manager, because no one > > else woudl tell me what was going on. It turned out that it **wasn't** the > > modem/router, but I had a private IP. I ended up paying $5 extra a month for > > a public. > > Ok, but that's one heck of a rip off if you ask me. A decent ISP will > give you a dynamic publicly accessible IP for free, and charge you > extra for your own public static address. For an ISP to be doing NAT > on it's network for it's customers, and be charging to give them a > public IP which I'm guessing is still dynamic, is a rip off. > > Anyway, you have 3 machines you said with internet > connections. However, you still have one public IP address, unless you > purchased a block of static addresses. So, my point still stands, your > modem or router is still doing IP masquerading for you, and assigning > an internal IP to each of your 3 machines. > > Greg > > > > - -- > web site: http://www.romuald.net.eu.org > gpg public key: http://www.romuald.net.eu.org/pubkey.asc > skype: gregn1 > (authorization required, add me to your contacts list first) > > - -- > Free domains: http://www.eu.org/ or mail dns-manager@EU.org > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.3 (GNU/Linux) > > iD8DBQFEtUCV7s9z/XlyUyARAmaBAJ954cyPQYqHfdAom9PZvxp61tj5UgCgtl27 > Jf9c9b4pAzpM1UIQLByybHk= > =4SGI > -----END PGP SIGNATURE----- > > _______________________________________________ > Speakup mailing list > Speakup@braille.uwo.ca > http://speech.braille.uwo.ca/mailman/listinfo/speakup ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions ` Gregory Nowak ` Tyler Littlefield @ ` John Heim ` Tyler Littlefield ` Gregory Nowak 1 sibling, 2 replies; 14+ messages in thread From: John Heim @ UTC (permalink / raw) To: Speakup is a screen review system for Linux. When the tech support guys at Tyler's ISP told him he had a "private" IP, they probably meant they're blocking incoming connections. He had to pay $5 extra to get them to punch a hole in their firewall. Lots of ISPs block some ports so you can't set up your own smtp server, for example. Maybe Tyler's ISP blocks all incoming connections by default and allows only outgoing and existing connections. I can't believe an ISP would hand out 10.0.0/24 addresses. Hand out private IP addresses and do NAT for every customer? Impossible (I think). It may even be illegal. More likely, they have a range of IP addresses that are not blocked by their firewall. They had to reassign him one from that range. That's what cost $5. I think "private" is marketing-speak for "blocked". Gregory Nowak wrote: > + -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Wed, Jul 12, 2006 at 12:20:19PM -0600, Tyler Littlefield wrote: >> Um... I called the ISP, and had to go up to the manager, because no one >> else woudl tell me what was going on. It turned out that it **wasn't** the >> modem/router, but I had a private IP. I ended up paying $5 extra a month for >> a public. > > Ok, but that's one heck of a rip off if you ask me. A decent ISP will > give you a dynamic publicly accessible IP for free, and charge you > extra for your own public static address. For an ISP to be doing NAT > on it's network for it's customers, and be charging to give them a > public IP which I'm guessing is still dynamic, is a rip off. > > Anyway, you have 3 machines you said with internet > connections. However, you still have one public IP address, unless you > purchased a block of static addresses. So, my point still stands, your > modem or router is still doing IP masquerading for you, and assigning > an internal IP to each of your 3 machines. > > Greg > > > > - -- > web site: http://www.romuald.net.eu.org > gpg public key: http://www.romuald.net.eu.org/pubkey.asc > skype: gregn1 > (authorization required, add me to your contacts list first) > > - -- > Free domains: http://www.eu.org/ or mail dns-manager@EU.org > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.3 (GNU/Linux) > > iD8DBQFEtUCV7s9z/XlyUyARAmaBAJ954cyPQYqHfdAom9PZvxp61tj5UgCgtl27 > Jf9c9b4pAzpM1UIQLByybHk= > =4SGI > -----END PGP SIGNATURE----- > > _______________________________________________ > Speakup mailing list > Speakup@braille.uwo.ca > http://speech.braille.uwo.ca/mailman/listinfo/speakup ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions ` John Heim @ ` Tyler Littlefield ` Gregory Nowak 1 sibling, 0 replies; 14+ messages in thread From: Tyler Littlefield @ UTC (permalink / raw) To: jheim, Speakup is a screen review system for Linux. When I looked at my router, I seen that it was a 10.x IP. When I signed up, they gave me a new 206 ip to use. Thanks, ~~TheCreator~~ website: http://tysplace.shaned.net msn: compgeek134@hotmail.com aim: st8amnd2005 skype: st8amnd127 moo coder/wizard and administrator ----- Original Message ----- From: "John Heim" <jheim@math.wisc.edu> To: "Speakup is a screen review system for Linux." <speakup@braille.uwo.ca> Sent: Wednesday, July 12, 2006 6:46 PM Subject: Re: iptables questions > When the tech support guys at Tyler's ISP told him he had a "private" > IP, they probably meant they're blocking incoming connections. He had > to pay $5 extra to get them to punch a hole in their firewall. Lots of > ISPs block some ports so you can't set up your own smtp server, for > example. Maybe Tyler's ISP blocks all incoming connections by default > and allows only outgoing and existing connections. > > I can't believe an ISP would hand out 10.0.0/24 addresses. Hand out > private IP addresses and do NAT for every customer? Impossible (I > think). It may even be illegal. > > More likely, they have a range of IP addresses that are not blocked by > their firewall. They had to reassign him one from that range. That's > what cost $5. I think "private" is marketing-speak for "blocked". > > Gregory Nowak wrote: > > > > + > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > On Wed, Jul 12, 2006 at 12:20:19PM -0600, Tyler Littlefield wrote: > >> Um... I called the ISP, and had to go up to the manager, because no one > >> else woudl tell me what was going on. It turned out that it **wasn't** the > >> modem/router, but I had a private IP. I ended up paying $5 extra a month for > >> a public. > > > > Ok, but that's one heck of a rip off if you ask me. A decent ISP will > > give you a dynamic publicly accessible IP for free, and charge you > > extra for your own public static address. For an ISP to be doing NAT > > on it's network for it's customers, and be charging to give them a > > public IP which I'm guessing is still dynamic, is a rip off. > > > > Anyway, you have 3 machines you said with internet > > connections. However, you still have one public IP address, unless you > > purchased a block of static addresses. So, my point still stands, your > > modem or router is still doing IP masquerading for you, and assigning > > an internal IP to each of your 3 machines. > > > > Greg > > > > > > > > - -- > > web site: http://www.romuald.net.eu.org > > gpg public key: http://www.romuald.net.eu.org/pubkey.asc > > skype: gregn1 > > (authorization required, add me to your contacts list first) > > > > - -- > > Free domains: http://www.eu.org/ or mail dns-manager@EU.org > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v1.4.3 (GNU/Linux) > > > > iD8DBQFEtUCV7s9z/XlyUyARAmaBAJ954cyPQYqHfdAom9PZvxp61tj5UgCgtl27 > > Jf9c9b4pAzpM1UIQLByybHk= > > =4SGI > > -----END PGP SIGNATURE----- > > > > _______________________________________________ > > Speakup mailing list > > Speakup@braille.uwo.ca > > http://speech.braille.uwo.ca/mailman/listinfo/speakup > > _______________________________________________ > Speakup mailing list > Speakup@braille.uwo.ca > http://speech.braille.uwo.ca/mailman/listinfo/speakup ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions ` John Heim ` Tyler Littlefield @ ` Gregory Nowak ` Tyler Littlefield 1 sibling, 1 reply; 14+ messages in thread From: Gregory Nowak @ UTC (permalink / raw) To: jheim, Speakup is a screen review system for Linux. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Jul 12, 2006 at 07:46:34PM -0500, John Heim wrote: > Lots of > ISPs block some ports so you can't set up your own smtp server, for > example. Maybe Tyler's ISP blocks all incoming connections by default > and allows only outgoing and existing connections. > I know, my former ISP blocked outgoing smtp, and what's even worse is that when they out-sourced their tech support, those people insisted that they didn't block any ports. I also have a friend who has some incoming ports blocked as well, so I'm familiar with the port blocking problem, though I've never heard those situations described as public or private ip addressing. > I can't believe an ISP would hand out 10.0.0/24 addresses. Hand out > private IP addresses and do NAT for every customer? Impossible (I > think). It may even be illegal. > I agree totally. However, Tyler insisted on several occasions in private messages that his ISP handed out 10.0.0/24 addresses to him, and I repeatedly kept telling him that it was either his modem or router that was doing that. As you said, for an ISP to be doing NAT for all its customers would be more costly then having a pool of dynamic public IPS to hand out. Greg - -- web site: http://www.romuald.net.eu.org gpg public key: http://www.romuald.net.eu.org/pubkey.asc skype: gregn1 (authorization required, add me to your contacts list first) - -- Free domains: http://www.eu.org/ or mail dns-manager@EU.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) iD8DBQFEtWH27s9z/XlyUyARAuQ9AJ0bd/+uhKph27XpWxKiOEX/dQUGOgCgkVLm 1DAtvLZe8hNyd6EX4QzAmq4= =E+fP -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions ` Gregory Nowak @ ` Tyler Littlefield 0 siblings, 0 replies; 14+ messages in thread From: Tyler Littlefield @ UTC (permalink / raw) To: Speakup is a screen review system for Linux. OK. With a router set to static, and the IP as 10. That tells me its the isp doing it. especially when the gateway is also a 10 address. ~~TheCreator~~ website: http://tysplace.shaned.net msn: compgeek134@hotmail.com aim: st8amnd2005 skype: st8amnd127 moo coder/wizard and administrator ----- Original Message ----- From: "Gregory Nowak" <greg@romuald.net.eu.org> To: <jheim@math.wisc.edu>; "Speakup is a screen review system for Linux." <speakup@braille.uwo.ca> Sent: Wednesday, July 12, 2006 2:56 PM Subject: Re: iptables questions > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Wed, Jul 12, 2006 at 07:46:34PM -0500, John Heim wrote: > > Lots of > > ISPs block some ports so you can't set up your own smtp server, for > > example. Maybe Tyler's ISP blocks all incoming connections by default > > and allows only outgoing and existing connections. > > > > I know, my former ISP blocked outgoing smtp, and what's even worse is > that when they out-sourced their tech support, those people insisted > that they didn't block any ports. I also have a friend who has some > incoming ports blocked as well, so I'm familiar with the port blocking > problem, though I've never heard those situations described as > public or private ip addressing. > > > I can't believe an ISP would hand out 10.0.0/24 addresses. Hand out > > private IP addresses and do NAT for every customer? Impossible (I > > think). It may even be illegal. > > > > I agree totally. However, Tyler insisted on several occasions in private > messages that his ISP handed out 10.0.0/24 addresses to him, and I > repeatedly kept telling him that it was either his modem or router > that was doing that. As you said, for an ISP to be doing NAT for all > its customers would be more costly then having a pool of dynamic > public IPS to hand out. > > Greg > > > - -- > web site: http://www.romuald.net.eu.org > gpg public key: http://www.romuald.net.eu.org/pubkey.asc > skype: gregn1 > (authorization required, add me to your contacts list first) > > - -- > Free domains: http://www.eu.org/ or mail dns-manager@EU.org > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.3 (GNU/Linux) > > iD8DBQFEtWH27s9z/XlyUyARAuQ9AJ0bd/+uhKph27XpWxKiOEX/dQUGOgCgkVLm > 1DAtvLZe8hNyd6EX4QzAmq4= > =E+fP > -----END PGP SIGNATURE----- > > _______________________________________________ > Speakup mailing list > Speakup@braille.uwo.ca > http://speech.braille.uwo.ca/mailman/listinfo/speakup ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: iptables questions iptables questions Tyler Littlefield ` Gregory Nowak @ ` Willem van der Walt 1 sibling, 0 replies; 14+ messages in thread From: Willem van der Walt @ UTC (permalink / raw) To: Speakup is a screen review system for Linux. On Tue, 11 Jul 2006, Tyler Littlefield wrote: > Hello list, > I tried running endoshield, and got a ton of errors. > So, now I will try to do it manually. I'm going through a tutorial now, and I have a coupel questions. > I can do the following. > iptables -A INPUT -p tcp -dport 2200 -j queue > iptables -A INPUT -p tcp -sport 2200 -j queue > to allow for the traffic on port 2200 to go through. I think. > But, lets say I create a rule for each port. The ones I want to allow, and the ones I don't want to allow. > I think I can use a -s to make it only local if I want. > Then, how would I block the ports that I haven't created rules for? iptables -P INPUT DROP > next, if I set up the box as a DMZ, in front of the router, is there a way that I can make it manage all traffic coming in and out of the network? Just like the router would? Yes, use two nics, bring your router in on the esternal one and your lan on the internal one. HTH, Willem > Thanks, > website: > http://tysplace.shaned.net > msn: > compgeek134@hotmail.com > aim: > st8amnd2005 > skype: > st8amnd127 > moo coder/wizard and administrator > _______________________________________________ > Speakup mailing list > Speakup@braille.uwo.ca > http://speech.braille.uwo.ca/mailman/listinfo/speakup > -- This message is subject to the CSIR's copyright, terms and conditions and e-mail legal notice. Views expressed herein do not necessarily represent the views of the CSIR. CSIR E-mail Legal Notice http://mail.csir.co.za/CSIR_eMail_Legal_Notice.html CSIR Copyright, Terms and Conditions http://mail.csir.co.za/CSIR_Copyright.html For electronic copies of the CSIR Copyright, Terms and Conditions and the CSIR Legal Notice send a blank message with REQUEST LEGAL in the subject line to HelpDesk@csir.co.za. This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks Transtec Computers for their support. ^ permalink raw reply [flat|nested] 14+ messages in thread
* IPTABLES QUESTIONS @ Doug Lawlor 0 siblings, 0 replies; 14+ messages in thread From: Doug Lawlor @ UTC (permalink / raw) To: speakup Hello list, When I forward ports to a machine behind a firewall traffic only seems to be going to the lowest port in the range. The following list using the command 'iptables -t nat -L' illustrates this. DNAT udp -- anywhere hostname.domainudp dpts:2074:2076 to:192.168.0.2:2074 DNAT udp -- anywhere hostname.domainudp dpts:4074:4076 to:192.168.0.2:4074 The commands used to forward the ports are as follows: # Forward ports 2074-2076 to 192.168.0.2 iptables -A PREROUTING -t nat -p udp -d $MYIP --dport 2074:2076 -j DNAT --to 192.168.0.2:2074:2076 # Forward ports 4074-4076 to 192.168.0.2 iptables -A PREROUTING -t nat -p udp -d $MYIP --dport 4074:4076 -j DNAT --to 192.168.0.2:4074:4076 $MYIP is a variable which gets the current dynamically assigned IP from eth0 using the following sed expression MYIP=`ifconfig eth0 | sed '/.*addr:/!d;s///;s/ .*//'` If I am thinking straight the list generated with 'iptables -t nat -L' should look like the following. DNAT udp -- anywhere hostname.domainudp dpts:2074:2076 to:192.168.0.2:2074:2076 DNAT udp -- anywhere hostname.domainudp dpts:4074:4076 to:192.168.0.2:4074:4076 How can I make this happen? The iptables commands I am using in the firewall script are just not doing it. Thanks in advance, Doug -- Make sure your E-mail can be read by everyone! http://www.betips.net/etc/evilmail.html Doug Lawlor <dlawlor@roadrunner.nf.net> ^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~ UTC | newest]
Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
iptables questions Tyler Littlefield
` Gregory Nowak
` Tyler Littlefield
` Alex Snow
` Gregory Nowak
` Tyler Littlefield
` Gregory Nowak
` Tyler Littlefield
` John Heim
` Tyler Littlefield
` Gregory Nowak
` Tyler Littlefield
` Willem van der Walt
-- strict thread matches above, loose matches on Subject: below --
IPTABLES QUESTIONS Doug Lawlor
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).