On 02/09/16 04:06, J.Witvliet@xxxxxxxxx
wrote:
Hi Bob,
As many said before, due to the lack of info, will result in only partly helpful replies.....
1) Decent firewall's have all policies firmly to "DROP" (instead of the default "ACCEPT")
2) Assuming eth0 is your lan-device, (connected to 192.168.1.255/24)
3) Assuming eth1 is connected to your internet modem
4) before (!) allowing other traffic outside insert
iptables -t filter -A FORWARD -i eth0 -o eth1 --source 192.168.1.17 -j DROP
iptables -t filter -A FORWARD -I eth1 -o eth1 --destination 192.168.1.17 -j DROP
5) next allow other traffic to go outside
Input- and output-chains are only for traffic originating from the box, or having the final destination on the box.
Traffic passing through is handled by the FORWARD-rule.
As I indicated in my top-line, this is very crude, iptables allows making self-defined sub-chains, and many other nice tricks, like timebased rules and so on....
.
J.W.
Thanks for the explanation and example.
The responses to my query help me to
begin to understand the openwrt provided
firewall. It also contains some examples
and it appears to have a place where I
can add some similar code.
My immediate concern is ensuring that
there is no connection between my NFS
server and the WAN-internet. It runs
with F-21 and has firewalld and selinux
both active and it seems blocking access
in the router firewall, as I usually do,
is desirable.
In addition I would like to be able to
restrict users WAN access at times when
we begin to run low on allowable usage
for the month. During those times
certain users [LAN addresses or mac's]
would be blocked between 05:00 and 24:00.
I have a router running Tomato that is
configured to do these things and has
been working well for a long while but I
am interested in setting up an
alternative trying Openwrt, It's not
critical but an interesting project for
and I might even learn something ...
Bob
--
Bob Goodwin - Zuni, Virginia, USA
http://www.qrz.com/db/W2BOD
box10 FEDORA-23/64bit LINUX XFCE POP3
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
