NetFilter
[Top] [All Lists]

Re: DNAT rule requires extra firewall pinhole

To: Jeff Weber <jweber@amsuper.com>
Subject: Re: DNAT rule requires extra firewall pinhole
From: Jan Engelhardt <jengelh@linux01.gwdg.de>
Date: Sat, 26 May 2007 15:44:04 +0200 (MEST)
Cc: netfilter@lists.netfilter.org
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
In-reply-to: <200705251717.27252.jweber@amsuper.com>
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
References: <200705251717.27252.jweber@amsuper.com>
Sender: netfilter-bounces@lists.netfilter.org
On May 25 2007 17:17, Jeff Weber wrote:
>
>I've added a firewall rule to block external requests to forward through the 
>gateway:
>
>$IPTABLES -A FORWARD -p tcp -i $DAS_SCADA_IF --syn -j DROP

Well that sounds a little broken, because the first packet of a TCP
connection _is_ SYN.

So you might want

 -p tcp ! -d destaddr ! --dport destport --syn -j DROP here...

Alternatively ...

 -p tcp --syn -m conntrack --ctstate DNAT -j ACCEPT
 -p tcp --syn -j DROP


        Jan
-- 


<Prev in Thread] Current Thread [Next in Thread>