/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */ I wrote to the maillist yesterday about some mail errors I was getting using an ipchains setup that had been running nicely for a while. I did not get the problem singled out until this morning, when I disabled my http server (apache), which I installed the other day. After I killed httpd, ipchains worked great. However, I don't know why it was not working with other. I only want apache for an internal server, can I make it work with my ipchains setup? Again, here is my ipchains rulesets: ++++++++ # flush residual BS /sbin/ipchains -F # I saw this somewhere ...let's try it ... /sbin/depmod -a # Load modules /sbin/modprobe ip_masq_ftp /sbin/modprobe ip_masq_raudio /sbin/modprobe ip_masq_vdolive # default is to deny /sbin/ipchains -P forward DENY # Attempt to optimize throughput /sbin/ipchains -A output -p tcp -d 0.0.0.0/0 telnet -t 0x01 0x10 /sbin/ipchains -A output -p tcp -d 0.0.0.0/0 ftp -t 0x01 0x10 /sbin/ipchains -A output -p tcp -s 0.0.0.0/0 ftp-data -t 0x01 0x08 # here we go ........... /sbin/ipchains -A output -d 199.95.207.0/24 -j REJECT /sbin/ipchains -A output -d 199.95.208.0/24 -j REJECT /sbin/ipchains -A output -d 209.67.38.62/24 -j REJECT /sbin/ipchains -A forward -j MASQ -s 10.1.1.1/8 -d 0.0.0.0/0 /sbin/ipchains -A forward -j MASQ -s 10.1.1.2/24 -d 0.0.0.0/0 /sbin/ipchains -l -A forward -j MASQ -s 10.1.1.3/24 -d 0.0.0.0/0 /sbin/ipchains -A forward -j MASQ -s 10.1.1.5/8 -d 0.0.0.0/0 /sbin/ipchains -A forward -j MASQ -s 10.1.1.6/24 -d 0.0.0.0/0 # Whack unwanted visitors /sbin/ipchains -P input ACCEPT /sbin/ipchains -A input -l -i ppp0 -p tcp --dport 31780:31790 -j DENY /sbin/ipchains -A input -l -i ppp0 -p udp --dport 31780:31790 -j DENY /sbin/ipchains -A input -l -i ppp0 -p tcp --dport 21:1024 -j DENY /sbin/ipchains -A input -l -i ppp0 -p tcp --dport 6000 -j DENY /sbin/ipchains -A input -l -i ppp0 -p udp --dport 21:1024 -j DENY /sbin/ipchains -A input -l -i ppp0 -p udp --dport 6000 -j DENY ++++++++++++++++++ Thanks again, Tom _______________________________________________ Masq maillist - [EMAIL PROTECTED] Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES UNSUBSCRIBING! or email to [EMAIL PROTECTED] PLEASE read the HOWTO and search the archives before posting. You can start your search at http://www.indyramp.com/masq/ Please keep general linux/unix/pc/internet questions off the list.
