SBlaze wrote:
--- Jeffrey Laramie <JALaramie@xxxxxxxxxxxxxxxxxxx> wrote:I use SNAT. Here is the rule:
Hi All,
I am trying to provide a modest amount of security for a home LAN using NAT and filtering. My family insists on using Kazaa Lite on their Windows boxes (aaahhh!!).
My (other) problem is that Kazaa insists on using sequential source ports and seemingly random destination ports to make connections. I already have a rule to allow ESTABLISHED,RELATED through, but these packets must be new connections (connecting to supernodes maybe?). No matter how many ports I open I can't seem to open enough ports to make it run.
I'm rapidly becoming unpopular in my house. Any ideas how I can make Kazaa Lite work and still maintain some security? Are these mutually exclusive goals?
Jeff
Are you using NAT? This is probably your best soloution.
iptables -t nat -A POSTROUTING -o $Net_Interface -j SNAT --to $Net_IP
My default policy on the filter FORWARD chain is drop, so any required ports have to have an ACCEPT rule for in order for services to work. In this case, Kazaa expects to have an unknown (large) number of ports open LAN->Net and it fails when it finds a blocked port.
I can make it work if I stop filtering outbound traffic, but I found a worm last month by checking unauthorized outbound traffic and I'm reluctant to give up that extra security.
Jeff
