Yeah along with your other rules. The DROPs make sure that you have the rules set right. If it's no ACCEPTed by a rule it gets DROPed rather than ACCEPTed. Here's some rules for logging too: iptables -A INPUT -j LOG --log-level 1 --log-prefix "INPUT_DROP: " iptables -A OUTPUT -j LOG --log-level 1 --log-prefix "OUTPUT_DROP: " iptables -A FORWARD -j LOG --log-level 1 --log-prefix "FORWARD_DROP: " iptables -t nat -A POSTROUTING -j LOG --log-level 1 --log-prefix "POSTROUTING: " iptables -t nat -A PREROUTING -j LOG --log-level 1 --log-prefix "PREROUTING: " iptables -t nat -A OUTPUT -j LOG --log-level 1 --log-prefix "OUTPUT: " This will dump to the messages log file. Just place this in a .sh script called start-log and copy them to a file called stop-log and change the "-A" to "-D" to stop the logging. Works great for when your hand writing rules.
-----Original Message----- From: Scott Antonivich [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 16, 2003 2:34 PM To: [EMAIL PROTECTED] Subject: RE: iptables causing problem with named? So you are sayig do this? :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :RH-Lokkit-0-50-INPUT - [0:0] iptables -A INPUT -s 127.0.0.1 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT COMMIT Scott -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jason Staudenmayer Sent: Wednesday, July 16, 2003 2:20 PM To: '[EMAIL PROTECTED]' Subject: RE: iptables causing problem with named? Why are you checking for port 53 on the loopback just allow everything to and from the loopback. Here's my rules: iptables -A INPUT -s 127.0.0.1 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT Change default policy of INPUT and FORWARD to DROP and leave the OUTPUT ACCEPT -----Original Message----- From: Scott Antonivich [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 16, 2003 2:05 PM To: [EMAIL PROTECTED] Subject: iptables causing problem with named? named is working for me properly, if I do not have iptables turned on. As soon as I do turn them on DNS cannot reach any servers. I am puzzled. My iptables look like this.... # Firewall configuration written by lokkit # Manual customization of this file is not recommended. # Note: ifup-post will punch the current nameservers through the # firewall; such entries will *not* be listed here. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Lokkit-0-50-INPUT - [0:0] -A INPUT -j RH-Lokkit-0-50-INPUT -A FORWARD -j RH-Lokkit-0-50-INPUT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 110 --syn -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 143 --syn -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 25 --syn -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT -A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 53 -j ACCEPT -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 1645 -j ACCEPT -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 1646 -j ACCEPT -A RH-Lokkit-0-50-INPUT -p udp -m udp -s 127.0.0.1 --sport 53 -d 0/0 -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --syn -j REJECT -A RH-Lokkit-0-50-INPUT -p udp -m udp -j REJECT COMMIT I have been manualled editing the /etc/sysconfig/iptables file and stoping and starting iptables when I make any changes... Scott -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED] https://www.redhat.com/mailman/listinfo/redhat-list -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED] https://www.redhat.com/mailman/listinfo/redhat-list -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED] https://www.redhat.com/mailman/listinfo/redhat-list -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED] https://www.redhat.com/mailman/listinfo/redhat-list
