Jump to content

Iptables Question


Deags
 Share

Recommended Posts

Okay aside for my major routing / iptables issue of not allowing me to send some traffic over one wan and traffic over the other wan(look for my other posts in this forum section).

I have a pptp server setup on the box.

at present people can connect and get internet. They cannot access the local network though. Here are my rules so far.

eth0 is lan

eth1 is internet

eth2 is adsl modem

eth3 is waiting for vpn connections

ppp0 is adsl

iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to-source 60.241.215.178

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

iptables -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i eth3 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT

iptables -A INPUT -i eth1 -p tcp --dport 80 -j ACCEPT

iptables -A INPUT -i ppp0 -p tcp --dport 22 -j ACCEPT

iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT

iptables -A INPUT -i ppp0 -p tcp --dport 18900:18960 -j ACCEPT

iptables -A INPUT -i eth1 -p tcp --dport 18900:18960 -j ACCEPT

iptables -A INPUT -i eth3 -p tcp --dport 47 -j ACCEPT

iptables -A INPUT -i eth3 -p tcp --dport 1723 -j ACCEPT

iptables -I INPUT -i eth0 -j ACCEPT

iptables -I INPUT -i eth2 -j ACCEPT

iptables -I INPUT -i lo -j ACCEPT

iptables -I INPUT -p icmp -i ppp0 -j ACCEPT

iptables -I INPUT -p icmp -i eth1 -j ACCEPT

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT ACCEPT

iptables -I FORWARD -i eth0 -d 192.168.1.0/255.255.255.0 -j DROP

iptables -A FORWARD -s 192.168.1.0/255.255.255.0 -j ACCEPT

iptables -A FORWARD -i ppp0 -d 192.168.1.0/255.255.255.0 -j ACCEPT

iptables -A FORWARD -i eth1 -d 192.168.1.0/255.255.255.0 -j ACCEPT

enjoy

Link to comment
Share on other sites

root@1:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
216.218.224.42  10.20.20.229    255.255.255.255 UGH   0      0        0 ppp0
192.168.1.10    0.0.0.0         255.255.255.255 UH    0      0        0 ppp1
10.20.20.229    0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth3
124.191.176.0   0.0.0.0         255.255.240.0   U     0      0        0 eth1
0.0.0.0         10.20.20.229    0.0.0.0         UG    0      0        0 ppp0

It used to work before i attempted to secure the box a bit.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...