|
I hope you all can help. Ok, here's the
setup
Internet: eth0
Lan: eth1
Tunnel: tap0
Bridge: br0 (tap0<->eth1)
I have the firewall setup to be a gateway/router to
the internet, and to the private offsite lan thru the tunnel. Everything works
great, minus one thing.
I have FORWARD/OUTPUT rules for not letting certain
traffic out to the internet. Mainly virus traffic and use of other mail servers.
Only problem is they aren't working. Here are the rules:
iptables -A FORWARD -o eth0 -p tcp -m tcp
-d <approved mail server> --dport 25 -j ACCEPT
iptables -A FORWARD -o eth0 -p tcp -m tcp --dport
25 -j DROP
iptables -A OUTPUT -o eth0 -p tcp -m tcp
-d <approved mail server> --dport 25 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m tcp
--dport 25 -j DROP
iptables- A FORWARD -o eth0 -p tcp -m tcp --dport
445 -j DROP
iptables -A OUTPUT -o eth0 -p tcp -m tcp --dport
445 -j DROP
iptables- A FORWARD -o eth0 -p udp -m udp
--dport 445 -j DROP
iptables -A OUTPUT -o eth0 -p udp -m udp
--dport 445 -j DROP Now if I take the tunnel and bridge are down(Only
having eth1 NAT'D to eth0), everything works fine. I've read that iptables works
at layer 3 and will not filter bridged interfaces. Well tap0 and eth1 are the
bridged interfaces, not eth0. So why isn't the firewall stopping these packets?
I can telnet to port 25 all day long on non-approved mail servers.
Anthony R. Vallario
|
