/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting!
/* ALSO: Don't quote this header. It makes you look lame :-) */
I'm using DRanch's (strong ipchains rulesets) firewall script. In
it, I have the following two lines:
/sbin/ipchains -A input -j ACCEPT -i $EXTIF -p tcp -s $UNIVERSE -d
$EXTIP timed
/sbin/ipchains -A output -j ACCEPT -i $EXTIF -p tcp -s $EXTIP timed -d
$UNIVERSE
Both lines are in their respective parts in the script, prior to
catching everything else and set to reject.
Yet, in the logs, I get the following line:
Starting the timed daemon:
kernel: Packet log: output REJECT eth0 PROTO=17 204.144.132.162:525
204.144.132.191:525 L=104 S=0x00 I=54354 F=0x0000 T=64 (#70)
kernel: Packet log: output REJECT eth0 PROTO=17 204.144.132.162:525
204.144.132.191:525 L=104 S=0x00 I=54364 F=0x0000 T=64 (#70)
kernel: Packet log: output REJECT eth0 PROTO=17 204.144.132.162:525
204.144.132.191:525 L=104 S=0x00 I=54367 F=0x0000 T=64 (#70)
Active timed pinging from other servers trying to sync up:
kernel: Packet log: input REJECT eth0 PROTO=17 204.144.132.175:525
204.144.132.191:525 L=104 S=0x10 I=61117 F=0x0000 T=60 (#62)
My question is, why? And how do I open up port 525 so timed can
work properly?
And another (maybe unrelated) question is, how come I get a lot of
192.168.1.0/24 traffic (being rejected) on eth1 (which is the internal
device), yet that whole net is configured as 10.2.1.0/24 ?
AMK4
--
W |
| Digital information lasts forever, or five years
| - whichever comes first.
|____________________________________________________________________
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Ashley M. Kirchner <mailto:[EMAIL PROTECTED]> . 303.442.6410 x130
SysAdmin / Websmith . 800.441.3873 x130
Photo Craft Laboratories, Inc. . eFax 248.671.0909
http://www.pcraft.com . 3550 Arapahoe Ave
.................. . . . . Boulder, CO 80303
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ --
THIS INCLUDES UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
