Re: Internet connection problem

From: Terry A. Haimann (terry_at_pegasus.oldboy.com)
Date: 01/07/05 

Date: Fri, 07 Jan 2005 19:36:10 GMT

I am running iptables now for a firewall, what changes would I have to
make to the following:

# remove any existing rules
# This is a basic script that I modified from a Red Hat Linux for Dummies.
iptables --flush
iptables --flush -t nat
iptables -X

# deny all traffic to start
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD ACCEPT

# allow all internal traffic
iptables -A OUTPUT -j ACCEPT -o lo
iptables -A INPUT -j ACCEPT -i lo

# allow all internal network traffic
iptables -A OUTPUT -j ACCEPT -o eth0
iptables -A INPUT -j ACCEPT -i eth0

# allow outgoing internet traffic on eth1
iptables -A OUTPUT -o eth1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

# use nat
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

On Fri, 07 Jan 2005 17:20:22 +0000, noi wrote:

> On Fri, 07 Jan 2005 15:48:49 +0000, Terry A. Haimann thoughtfully wrote:
>
>> I am in the process of upgrading my home network from a dial-up to
>> broadband account. The only choice that I have for a broadband account is
>> Mediacom in central Iowa. Now my hub computer (a rh 8.0 box) can connect
>> to mediacom, but mediacom announces the dns address at connect time. The
>> hub computer has the address somewhere, but the client boxes don't.
>> Therefore none of my client boxes can reach the web, because they don't
>> know what the current dns address is. My client machines are as follows:
>>
>> 1. WinXP
>> 2. Fedora Core 1
>> 3. Win-ME (via Win4lin)
>> 4. Win-98
>>
>> I am assuming that I am going to have to set up a dns server on the rh 8.0
>> box, but I don't have the faintest idea how and what kind of script will
>> be necessary.
>>
>> Terry
>
>
> I think it would be easiest to pick up a cheap router with firewall and
> connect all the machines to the router.
>
> Are you using the RH8 box a the dial up server for the other machines now?
> I think need to enable Iptable NAT and Forwarding on
> the RH8 box. You can assign static or keep your current static Private
> addresses but the gateway address on your client machines should point to
> the hub. You can have the hub assign addresses by dhcp but in small
> networks that's a overhead you really don't need, unless of course you
> just want to learn how to do it.
>
> I could try explaining this in detail but there are lots of better
> resources on the Internet than me. Try this link for starters:
> http://www.yolinux.com/TUTORIALS/LinuxTutorialIptablesNetworkGateway.html

Relevant Pages

  • Re: Feedback solicited - best way to harden a mail/web server?
    ... Was the system protected by a properly configured firewall? ... it's not a bad "starting point" and it can generate an IPtables rule ... > nor is there a web or ftp server; aside from that I haven't tried to secure ... Before I'll install some nifty application ...
    (comp.os.linux.security)
  • Re: Pro-active Security Software?
    ... > Ultimately, you will need to deal with iptables, which is not too hard. ... To further protect the interior Linux network machines, ... > authorised to connect to Internet hosts. ... the firewall to tighten it up, the more I can configure the internal ...
    (comp.os.linux.security)
  • Re: network / performance problems
    ... > due to some bug in whatever is dynamically adding firewall rules to your system. ... I *do* run iptables on all of these machines. ... # Allow this host to establish new connections. ...
    (Linux-Kernel)
  • Re: EMERGENCY - need to secure my server against an ongoing SPAMMER
    ... computer with a broadband connection. ... that IP range will prevent that spammer from wasting your systems ... This approach eventually makes your firewall machine so busy it has ... A better approach is to use IPTables to deny ALL inbound attempts to ...
    (Fedora)
  • linux - iptable firewall DNS question
    ... When my firewall is active, i am unable to use name solving features from my ... iptables -P INPUT ACCEPT ... # $ipnet -> adresse ip de l'interface connectée à internet ... echo ACCES AU FIREWALL DEPUIS LOCAL ...
    (comp.security.firewalls)