On 02/12/2016 12:10 PM, Rick Stevens wrote:
On 02/12/2016 11:10 AM, Bob Goodwin wrote:
I have been messing with a firewall file and added the following:
config rule
option src lan
option src_ip 192.168.1.7
option dest wan
option target REJECT
It works to prevent internet access from that ip. However I can still
ping 8.8.8.8 which leaves wondering if that is adequate isolation. Can
that be improved on?
I have never done anything with iptables and I am pushing my skill level
in this but it is encouraging to have something actually work ...
Not sure which firewall you're using. Judging by your description of its
behavior, the odds are that the (unless otherwise specified) default
protocol the rules affect is TCP. If that's the case, yes, your rules
would prevent TCP-based activity (telnet, ssh, web, etc.) from working,
but would NOT prevent UDP-based traffic (normal DNS queries for
instance) or ICMP-based traffic (such as ping, traceroute, etc.).
There's a whole lot of protocols that come under the "IP" umbrella.
Dump out the content of /etc/protocols if you want to see a (fairly
complete, but not exhaustive) list of what's out there.
After more digging around, it appears you're using firewalld-
richlanguage stuff. In that case, by default it affects TCP and UDP, but
not ICMP. You could add another rule for ICMP:
config rule
option src lan
option src_ip 192.168.1.7
option dest wan
option protocol icmp
option target REJECT (or DROP)
and that should block ping as well.
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, AllDigital ri...@alldigital.com -
- AIM/Skype: therps2 ICQ: 226437340 Yahoo: origrps2 -
- -
- You possess a mind not merely twisted, but actually sprained. -
----------------------------------------------------------------------
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
