doc:appunti:linux:sa:iptables
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
doc:appunti:linux:sa:iptables [2014/04/16 17:36] – [Usare iptables per mitigare o bloccare un DNS Amplification Attack] niccolo | doc:appunti:linux:sa:iptables [2020/11/23 15:25] – [Shorewall and DNAT onto a local host] niccolo | ||
---|---|---|---|
Line 47: | Line 47: | ||
</ | </ | ||
- | In '' | + | For Shorewall 5 we nedd a line in **/ |
+ | |||
+ | < | ||
+ | # | ||
+ | SNAT(192.168.1.254) | ||
+ | </ | ||
+ | |||
+ | Shorewall 4 instead requires a line in **/ | ||
< | < | ||
Line 60: | Line 67: | ||
# | # | ||
DNAT | DNAT | ||
+ | DNAT | ||
</ | </ | ||
+ | |||
+ | ===== Shorewall with router in local LAN ===== | ||
+ | |||
+ | Hosts in LAN#1 may access hosts in LAN#2 by just adding a static route to the **192.168.2.0/ | ||
+ | |||
+ | {{shorewall-router-in-lan.png? | ||
+ | |||
+ | You can instead make **two configurations** on the Shorewall firewall. First of all you add the static route into **/ | ||
+ | |||
+ | < | ||
+ | auto eth1 | ||
+ | iface eth1 inet static | ||
+ | address 192.168.1.1 | ||
+ | netmask 255.255.255.0 | ||
+ | up / | ||
+ | down /sbin/route del -net 192.168.2.0/ | ||
+ | </ | ||
+ | |||
+ | then you have to add the **routeback** option for the **eth1** interfaces in the **/ | ||
+ | |||
+ | < | ||
+ | loc eth1 routeback | ||
+ | </ | ||
===== Iptables schema ===== | ===== Iptables schema ===== | ||
Line 137: | Line 168: | ||
< | < | ||
- | iptables -I INPUT -p udp -m string --hex-string ' | + | /sbin/iptables -I INPUT -p udp -m string --hex-string ' |
- | --algo bm --from 40 --to 56 -j DROP | + | --algo bm --from 40 --to 56 -j DROP -m comment --comment "DROP DNS Q zing.zong.co.ua" |
</ | </ | ||
doc/appunti/linux/sa/iptables.txt · Last modified: 2020/11/23 15:28 by niccolo