On Tuesday, March 11, 2003, at 02:21 AM, Mike Egglestone wrote:
Quoting n/a <test@pandora.be>:
Hello there,
For the past couple of days i've been looking into setting up an old
pc as a
firewall/router for a couple of students.
To do so i enabled iptables and started looking into configuration
issues.
Eventually i came up with a config that worked. haha. Then i
realised this
config was fishy and started deleting lines as i went along. Now
almost no
lines are left and the darned thing still works even after reboots,
re-loads, restarts.
Apparently there's something i'm not getting thru my thick skull about
packet filtering. Could someone explain to me in text (no diagrams)
how a
packet is evaluated and then processed tru the chains, also what is
done and
not-done any more after a packet has passed thru a chain. Somehow i
have the
idea this config works from the lan to the outside but not from the
outside
to the lan or something.
Any good resources, tips, explanations are welcome. I'm to dumb for
this i
guess.
Hi,
Your not dumb, you use Debian don't you? :)
Perhaps check out www.tldp.org for how-to's on netfilter/iptables stuff.
To be basic, anything destined/orginating for/from your box will hit
the INPUT
and OUTPUT chains. Thats it.
Keep in mind that "your box" (above) refers only to your firewall
machine. INPUT and OUTPUT have nothing to do with to/from internet.
Just into and out of the firewall where the firewall does some
processing (e.g. When its using apt-get for an update).
Anything that is destined somewhere else. Will
only hit your FORWARD chain.
FORWARD is where you put the rules which deny or allow access between
protected machines behind the firewall and the internet. As
mentioned, its the default location for rules you write. Most of your
rules and effort should probably go here. Also remember rules are
generally symmetric (applying to traffic in both direction) unless the
rule explicitly indicates incoming/outgoing interface. HTH
This is for your default "filter" table.
The "mangle" and "nat" tables are for other stuff. Usually nat is for
masquerading. Check out debian's ipmasq package for easy setup.
Good luck,
Cheers,
Mike
-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/
--
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact
listmaster@lists.debian.org