[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Iptables is driving me nuts (beginner)


On Tuesday, March 11, 2003, at 02:21 AM, Mike Egglestone wrote:


Quoting n/a <test@pandora.be>:


Hello there,
For the past couple of days i've been looking into setting up an old pc as a 
firewall/router for a couple of students.
To do so i enabled iptables and started looking into configuration issues. Eventually i came up with a config that worked. haha. Then i realised this config was fishy and started deleting lines as i went along. Now almost no 
lines are left and the darned thing still works even after reboots,
re-loads, restarts.

Apparently there's something i'm not getting thru my thick skull about
packet filtering. Could someone explain to me in text (no diagrams) how a packet is evaluated and then processed tru the chains, also what is done and not-done any more after a packet has passed thru a chain. Somehow i have the idea this config works from the lan to the outside but not from the outside 
to the lan or something.
Any good resources, tips, explanations are welcome. I'm to dumb for this i 
guess.

Hi,
Your not dumb, you use Debian don't you? :)
Perhaps check out www.tldp.org for how-to's on netfilter/iptables stuff. To be basic, anything destined/orginating for/from your box will hit the INPUT 
and OUTPUT chains. Thats it.
Keep in mind that "your box" (above) refers only to your firewall machine. INPUT and OUTPUT have nothing to do with to/from internet. Just into and out of the firewall where the firewall does some processing (e.g. When its using apt-get for an update). 


Anything that is destined somewhere else. Will
only hit your FORWARD chain.
FORWARD is where you put the rules which deny or allow access between protected machines behind the firewall and the internet. As mentioned, its the default location for rules you write. Most of your rules and effort should probably go here. Also remember rules are generally symmetric (applying to traffic in both direction) unless the rule explicitly indicates incoming/outgoing interface. HTH 


This is for your default "filter" table.
The "mangle" and "nat" tables are for other stuff. Usually nat is for
masquerading. Check out debian's ipmasq package for easy setup.

Good luck,

Cheers,
Mike









-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/


--
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: