/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting!
/* ALSO: Don't quote this header. It makes you look lame :-) */
Hi,
Your lines are opening port 525 for TCP packets, yet your logs are showing
_UDP_ packets being rejected!
You should add another two lines, just like the ones you already have, but
changing "-p tcp" to "-p udp"!
That should solve your problem..
Peace,
Joao
"Ashley M. Kirchner" wrote:
> /* HINT: Search archives @ http://www.indyramp.com/masq/ before posting!
> /* ALSO: Don't quote this header. It makes you look lame :-) */
>
> I'm using DRanch's (strong ipchains rulesets) firewall script. In
> it, I have the following two lines:
>
> /sbin/ipchains -A input -j ACCEPT -i $EXTIF -p tcp -s $UNIVERSE -d
> $EXTIP timed
>
> /sbin/ipchains -A output -j ACCEPT -i $EXTIF -p tcp -s $EXTIP timed -d
> $UNIVERSE
>
> Both lines are in their respective parts in the script, prior to
> catching everything else and set to reject.
>
> Yet, in the logs, I get the following line:
>
> Starting the timed daemon:
> kernel: Packet log: output REJECT eth0 PROTO=17 204.144.132.162:525
> 204.144.132.191:525 L=104 S=0x00 I=54354 F=0x0000 T=64 (#70)
> kernel: Packet log: output REJECT eth0 PROTO=17 204.144.132.162:525
> 204.144.132.191:525 L=104 S=0x00 I=54364 F=0x0000 T=64 (#70)
> kernel: Packet log: output REJECT eth0 PROTO=17 204.144.132.162:525
> 204.144.132.191:525 L=104 S=0x00 I=54367 F=0x0000 T=64 (#70)
>
> Active timed pinging from other servers trying to sync up:
> kernel: Packet log: input REJECT eth0 PROTO=17 204.144.132.175:525
> 204.144.132.191:525 L=104 S=0x10 I=61117 F=0x0000 T=60 (#62)
>
> My question is, why? And how do I open up port 525 so timed can
> work properly?
>
> And another (maybe unrelated) question is, how come I get a lot of
> 192.168.1.0/24 traffic (being rejected) on eth1 (which is the internal
> device), yet that whole net is configured as 10.2.1.0/24 ?
>
> AMK4
>
> --
> W |
> | Digital information lasts forever, or five years
> | - whichever comes first.
> |____________________________________________________________________
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Ashley M. Kirchner <mailto:[EMAIL PROTECTED]> . 303.442.6410 x130
> SysAdmin / Websmith . 800.441.3873 x130
> Photo Craft Laboratories, Inc. . eFax 248.671.0909
> http://www.pcraft.com . 3550 Arapahoe Ave
> .................. . . . . Boulder, CO 80303
>
> _______________________________________________
> Masq maillist - [EMAIL PROTECTED]
> Admin requests can be handled at http://www.indyramp.com/masq-list/ --
> THIS INCLUDES UNSUBSCRIBING!
> or email to [EMAIL PROTECTED]
>
> PLEASE read the HOWTO and search the archives before posting.
> You can start your search at http://www.indyramp.com/masq/
> Please keep general linux/unix/pc/internet questions off the list.
--
-----------------------------------------------------------------
Fabrica de Ideias
sbs - ed. empire center - sala 109 - cep 70070-904 - brasilia-df
tel: (61) 321 1357
fax: (61) 321 6096
[EMAIL PROTECTED]
-----------------------------------------------------------------
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ --
THIS INCLUDES UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
