[OLUG] Firewall Help

Good. Root. What is difference? jferguson3 at home.com
Sun May 14 18:45:56 UTC 2000

Okay, I finally got a decent firewall running, ip masqing and some
protective measures.  However, now my /var/log/messages is growing by
the second... every few minutes or so, I get this line:

May 14 13:31:00 cx114367-a kernel: Packet log: input REJECT eth1
PROTO=17 L=71 S=0x00 I=37387 F=0x0000
T=128 (#5)

Obviously, Id like to minimize the stuff in my log.

I've attached my rc.firewall, which I pretty much ripped from the
Stronger IP rulesets section of the masquerading HOWTO. Any help would
be appreciated.


-------------- next part --------------
/sbin/depmod -a
echo 1 > /proc/sys/net/ipv4/ip_forward
/sbin/modprobe ip_masq_ftp
/sbin/modprobe ip_masq_irc
/sbin/modprobe ip_masq_raudio


#export extip extint intint intnet

/sbin/ipchains -M -S 7200 10 160

# -------------------------------
# Input policies
# --------------------------------
# First, we set a default policy of REJECT
ipchains -F input
ipchains -P input REJECT

# Local machines are cool.
ipchains -A input -i eth1 -s -d -j ACCEPT
ipchains -A input -i eth0 -s -d -l -j REJECT
ipchains -A input -i eth0 -s -d -j ACCEPT
ipchains -A input -i lo -s -d -j ACCEPT
ipchains -A input -s -d -l -j REJECT

# -------------------------------
# Output policies
# ------------------------------
# First, we once again set the default policy to REJECT

ipchains -F output
ipchains -P output REJECT

# Once again, local machines are cool

ipchains -A output -i eth1 -s -d -j ACCEPT
ipchains -A output -i eth0 -s -d -l -j REJECT
ipchains -A output -i eth0 -s -d -l -j REJECT
ipchains -A output -i eth0 -s -d -j ACCEPT
ipchains -A output -i lo -s -d -j ACCEPT
ipchains -A output -s -d -l -j REJECT

# -----------------------------------
# Forward (aka Masquerade) policies
# -----------------------------------
# Again, default is deny

/sbin/ipchains -P forward DENY

# The local network is cool
/sbin/ipchains -A forward -s -j MASQ

# Non-local network is cool
ipchains -A forward -s -d -l -j REJECT

-------------- next part --------------
Sent by OLUG Mailing list Manager, run by ezmlm.  http://olug.bstc.net/ 
To unsubscribe: `echo unsubsribe | mail olug-unsubscribe at bstc.net` 

More information about the OLUG mailing list