[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Port forwarding with Ipmasq and DSA-389-1

On Sat, Sep 20, 2003 at 06:05:01PM -0400, Matt Zimmerman wrote:
> Subject: [SECURITY] [DSA-389-1] New ipmasq packages fix insecure
> packet filtering rules

| #$IPTABLES -A FORWARD -o $i -i ${j%%:*} -d $IPOFIF/$NMOFIF -j ACCEPT

This broke the port forwarding rules I have.  I don't know what I'm
doing, but now the forwarding rules I have in <rules/F10portfw.rul>
don't help me (and if I reverse the comment above, things work again). 
| $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -p tcp -d $EXTIP --dport 515 \
|         -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
| $IPTABLES -A PREROUTING -t nat -p tcp -d $EXTIP --dport 515 \
|         -j DNAT --to $PRINTERIP:515

What should I do get port forwarding working with this security fix
intact?  Perhaps you only need to add "NEW" to the above state line?

Please give me CCs, because I am not subscribed.

Tom Goulet				mail: uid0@em.ca
UID0 Unix Consulting			web:  em.ca/uid0/

Attachment: pgprlUI7BNjgM.pgp
Description: PGP signature

Reply to: