| To: | Jeff Weber <jweber@amsuper.com> |
|---|---|
| Subject: | Re: DNAT rule requires extra firewall pinhole |
| From: | Jan Engelhardt <jengelh@linux01.gwdg.de> |
| Date: | Sat, 26 May 2007 15:44:04 +0200 (MEST) |
| Cc: | netfilter@lists.netfilter.org |
| Delivered-to: | sp-com-lists@consult.net |
| Delivered-to: | netfilter-list1@securepoint.com |
| In-reply-to: | <200705251717.27252.jweber@amsuper.com> |
| List-archive: | </pipermail/netfilter> |
| List-help: | <mailto:netfilter-request@lists.netfilter.org?subject=help> |
| List-id: | General discussion and user questions <netfilter.lists.netfilter.org> |
| List-post: | <mailto:netfilter@lists.netfilter.org> |
| List-subscribe: | <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe> |
| List-unsubscribe: | <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe> |
| References: | <200705251717.27252.jweber@amsuper.com> |
| Sender: | netfilter-bounces@lists.netfilter.org |
On May 25 2007 17:17, Jeff Weber wrote:
>
>I've added a firewall rule to block external requests to forward through the
>gateway:
>
>$IPTABLES -A FORWARD -p tcp -i $DAS_SCADA_IF --syn -j DROP
Well that sounds a little broken, because the first packet of a TCP
connection _is_ SYN.
So you might want
-p tcp ! -d destaddr ! --dport destport --syn -j DROP here...
Alternatively ...
-p tcp --syn -m conntrack --ctstate DNAT -j ACCEPT
-p tcp --syn -j DROP
Jan
--
|
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | DNAT rule requires extra firewall pinhole, Jeff Weber |
|---|---|
| Next by Date: | Re: DNAT rule requires extra firewall pinhole, Pascal Hambourg |
| Previous by Thread: | DNAT rule requires extra firewall pinhole, Jeff Weber |
| Next by Thread: | Re: DNAT rule requires extra firewall pinhole, Pascal Hambourg |
| Indexes: | [Date] [Thread] [Top] [All Lists] |