Re: iptable in fc5

Hongwei Li wrote:
On Mon, 2006-05-15 at 14:27 -0500, Hongwei Li wrote:

Hi,

I have a question about iptables in fc5. I have iptables 1.3.5-1.2
installed.
By default, the iptables has a line
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
... and
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

I try to add the port 2049 for our lan nfs by adding aline before the
above
reject line:


You're also going to need to unblock ports for portmapper, mountd,
rquotad, and (maybe) rstatd and nfslockd. I don't use the last two on
my home systems.

Create a file on the server at /etc/sysconfig/nfs that will bind mountd
and rquotad to fixed ports (I use 922 and 923, but you don't have to).

[root@petrel ~]# cat /etc/sysconfig/nfs
export MOUNTD_PORT=922
export RQUOTAD_PORT=923

Then, in /etc/sysconfig/iptables, add the following rules (change the -s
address as appropriate, or remove it altogether):
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p tcp --dport 922 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p udp --dport 922 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p tcp --dport 923 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p udp --dport 923 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p tcp --dport 111 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p udp --dport 111 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p tcp --dport 2049 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -m state --state NEW -m tcp -p
tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT



Thanks a lot for you and Chris's help, I created /etc/sysconfig/nfs, did
what
you suggested and now it is working.

A few more quations about iptables setting:

1. What's difference if I put some lines like
-A RH-Firewall-1-INPUT -s 192.168.1.0/24 -p tcp --dport 2049 -j ACCEPT
before line
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
or put it in between it and the following line:
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

The difference is performance. Once a connection table entry is
established all subsequent packets will be accepted when the
ESTABLISHED,RELATED... rule is hit. So placing that near the top, and
rules to decide what new connections to permit below it shorten the
rules traversed for the majority of packets.
2. When do we need to include "-m state --state NEW" or "-m state --state
NEW,ESTABLISHED,RELATED" or "-m state --state ESTABLISHED,RELATED" in a
line?
Will they cause different functions?

Definitely different. If you allow all state NEW packets you are not
acting like a firewall because you are allowing any and all connections.
Stick to the accept on ESTABLISHED,RELATED for bulk of packets on
already permitted connections, and the use of NEW in rules that you are
evaluating whether to accept a connection or not based on what the
source and/or destination address/port are.
3. For those lines with "-m state --state NEW" etc., should I put them
before
line
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
or after it?

After - the same reason as question 1. Not because you have to to make
it work, but because doing so is more efficient.

Thank you very much for the explanation!

Hongwei

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

Relevant Pages

  • IPTables Established connection problem.
    ... I posted a couple weeks ago about IPTables possibly losing state. ... My established connections still freeze if I have firewalling ... $IPT -F OUTPUT ... #Log martians (packets with impossible addresses) ...
    (comp.os.linux.security)
  • Re: Help with Iptables on with RH linux
    ... several ports that it listens... ... any established connections are OK. ... If you are dropping packets in the FORWARD chain, ... You can adjust these rules to allow only certain protocols and ports. ...
    (RedHat)
  • Re: iptables syntax error
    ... in which I have the iptables binary in the source code .I then copy the ... then source ports below 512 will be mapped to other ports below 512: ... # Difference between SNAT and MASQUERADE? ... # connections will survive a reconnect. ...
    (comp.os.linux.networking)
  • Re: iptables syntax error
    ... in which I have the iptables binary in the source code .I then copy the ... then source ports below 512 will be mapped to other ports below 512: ... # Difference between SNAT and MASQUERADE? ... # connections will survive a reconnect. ...
    (comp.os.linux.networking)
  • Iptables - attack - please help
    ... incoming packets discarded ... ICMP messages received ... 36 active connections openings ... iptables -N specific-rule-set ...
    (comp.os.linux.security)