Re: telnet on local LAN question


My iptables is the default per F14 installation:
+++
# Generated by iptables-save v1.4.9 on Tue Aug 16 22:13:30 2011
# Used command "iptables-save > iptables_F14_ORIGINAL_yoyo"
*filter

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [9950:627381]


iptables entries are processed in the order found...

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
Above line jumps to "ACCEPT" for any packet with an established connection.

-A INPUT -p icmp -j ACCEPT
Above line jumps to "ACCEPT" for any icmp packet.

-A INPUT -i lo -j ACCEPT
Above line jumps to "ACCEPT" for any packet from the loopback interface.

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
Above line jumps to "ACCEPT" for any ssh packet establishing a new connection.

May I suggest inserting an entry, at this spot, for mail, something like the
following.
-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
The goal of the previous line is to jump to "ACCEPT" for any mail packet
establishing a new connection.

Instead of the above line, you might want to specify a source IP address range
to limit which IP addresses can send mail to your machine.
-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -s 192.168.2.0/24 -j
ACCEPT
The goal of -s 192.168.2.0/24, in the above line, is to only accept incoming
connections to port 25 (the default smtp port), if the source IP address of
the packet is in the range 192.168.2.0 - 192.168.2.255.

-A INPUT -j REJECT --reject-with icmp-host-prohibited
Above line jumps to "REJECT" for any packet destined to the host.
As I said the order of entries is important.

-A FORWARD -j REJECT --reject-with icmp-host-prohibited
Above line jumps to "REJECT" for any packet the host might forward.

COMMIT
# Completed on Tue Aug 16 22:13:30 2011
+++


I apologize for not reading your original message and going off on a telnet/ssh
tangent in a previous email.

--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines