Carl_Niskern@Dell.com
2002-Feb-15 17:27 UTC
A very specific iptables task using RedHat scripts
Forgive me if I am in the wrong place for this question. I looked over all the available maillists and this one seemed closest for the question I have. I am running RH 7.2 with Apache, Wu-ftp, and VNC. I want to block all incoming traffic except from certain systems on a W2K home network. The system should''n show up, not even ICMP returns, for non-allowed hosts. I can write a script to get the current IP address of a given hostname if I need it. The thing is I wanted to use the RedHat built-in tools to do this. Currently iptables is the latest thing but the docs I can find on it create everything from scratch and are mostly pointed towards routing and masquerading. All I need is the blocking ability. In /etc/rc.d/init.d/ there is a script "iptables" that responds like any other service if the script file /etc/sysconfig/iptables exists. But I can find no docs on either of those scripts. Where are the docs on them? Is there a sample /etc/sysconfig/iptables script that I can go over to see what is expected by /etc/rc.d/init.d/iptables? Is it possible to allow some hosts http access only and the others all available services? My RHCE was from RH 7.0 and I trained for RH 6.2 so I don''t really understand ipchains or iptables. I am trying but... The hosts.allow and hosts.deny files were so much easier but not nearly as secure. ;-) Thanks in advance for ANY help. Carl Niskern RHCE / MCP
Cristian Paslaru
2002-Feb-15 18:04 UTC
Re: A very specific iptables task using RedHat scripts
On Fri 15 Feb 2002 19:27, you wrote:> Forgive me if I am in the wrong place for this > question. I looked over all the available maillists > and this one seemed closest for the question I have. > > I am running RH 7.2 with Apache, Wu-ftp, and VNC. > I want to block all incoming traffic except from > certain systems on a W2K home network. The system > should''n show up, not even ICMP returns, for > non-allowed hosts. I can write a script to get the > current IP address of a given hostname if I need it. > > The thing is I wanted to use the RedHat built-in > tools to do this. Currently iptables is the latest > thing but the docs I can find on it create everything > from scratch and are mostly pointed towards routing > and masquerading. All I need is the blocking ability.Try this: http://netfilter.samba.org/documentation/HOWTO//packet-filtering-HOWTO-7.html -- http://devel.iasi.ro