/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Scott Brause <[EMAIL PROTECTED]> wrote:
>
> > ipchains -A input -i $extint -s $intnet -d 0.0.0.0/0 -l -j REJECT
>
> The way I read this rule is as follws :
>
> Add an input rule REJECT all packets coming from the external
> interface with a source IP of the internal network and destination of
> anywhere.
That's a good way to look at it symbolically, but like any programming
language, if your variables are set to wrong values, the statement can
be correct, but still produce the wrong result!
If $extint does not refer to your external interface, then this rule
will have some other effect.
If $intnet does not describe your internal network's IP address space,
then the rule will also do something wrong.
The "-d 0.0.0.0/0" part of the rule is completely useless, because it
does not add any information. In fact, you can leave it out completely.
> This is probably a lack of understanding on my part, but for the -d do
> I have to have the external interface IP address/subnet mask?
No. Best to leave it out, so that it does not confuse you.
Again, what I was trying to tell you last time is that I believe your
$intnet variable, in your script, is wrong. It should not be
10.0.0.0/0, which is what you posted. It should be either 10.0.0.0/8,
or 10.0.0.0/24, whatever conforms to your internal netmask.
If you leave the setting at "/0", it means to compare no bits from the
IP address, which basically means that it always succeeds! (Just like
the -d 0.0.0.0/0 always succeeds, which is why it is superfluous.)
--
[EMAIL PROTECTED] (Fuzzy Fox) || "Good judgment comes from experience.
sometimes known as David DeSimone || Experience comes from bad judgment."
http://www.dallas.net/~fox/ || -- Life Lessons
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
