/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Good day, Greg,
On Mon, 22 Nov 1999, Gregory Leblanc wrote:
> > On Mon, 22 Nov 1999, Gregory Leblanc wrote:
> > You're also correct in that the above commands and the script I
> > provided will _not_ show anything but masqueraded
> > connections; if you have
> > two boxes talking through the firewall without using
> > masquerading, their
> > conversations won't show up. Neither will conversations to
> > and from the
> > box itself.
> > You have to move up to iptables before you get full stateful
> > inspection.
>
> iptables? do you have a URL handy for that? I'm always looking for
> something else to play with...
Hmmm... me too!
netfilter/iptables can be found at http://www.sama.org/netfilter/
. The 2.3.x kernel series has the necessary low level code, and the above
web site has the companion kernel modules and user-space tools to do
packet filtering. While netfilter replaces ipchains in the 2.3.x series,
Rusty has provided loadable modules that simulate both ipfwadm and
ipchains. This gives the administrator the choice between ipfwadm,
ipchains, and iptables without rebooting.
If you have a favourite ipchains firewall you want to try on
iptables, I have an ipchains2iptables tool available. It won't work
perfectly in all cases (the designs are sufficiently different that there
isn't a one-to-one mapping and the tool must do its best), but it at least
gives a starting point. Mason is finally to the point where it can handle
iptables. Both can be found at ftp://mason.stearns.org .
The 2.3.x kernel, the netfilter code, and the userspace tools like
Mason are not to be considered stable and polished; I would not recommend
them for production machines. They are, however, sufficiently stable that
they can be used.
Cheers,
- Bill
---------------------------------------------------------------------------
If you've been pounding nails with your forehead for years, it may
feel strange the first time somebody hands you a hammer. But that
doesn't mean that you should strap the hammer to a headband just to give
your skull that old familiar jolt.
-- Wayne Throop, during the ``TCL Wars''
(Courtesy of Steve Dodd <[EMAIL PROTECTED]>)
--------------------------------------------------------------------------
William Stearns ([EMAIL PROTECTED]). Mason, Buildkernel, named2hosts,
and ipfwadm2ipchains are at: http://www.pobox.com/~wstearns/
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
