I think we are getting there: The one you suggested gives an error: Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not allowed Looking at tcpdump on a few machines it looks like the packets are getting through - but nothing gets sent: 17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S 965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024 0,nop,wscale 0> (DF) [tos 0x10] And then nothing else - sadly I am not a tcpdump expert..... Any clues? I am at a loss as to why this was working and now it does not..... Greg On Tue, 25 Jan 2005 09:46:20 -0800, Gary W. Smith <gary@xxxxxxxxxxxxxxx> wrote: > Are you getting the connection coming back? Try > > $IPTABLES -A FORWARD -o $DMZ_IFACE -o $LAN_IFACE -j ACCEPT > > And see if it makes any difference. Forward works in both directions. > We typically allow established,related to return the path that it came > from. You might need to do the same. > > > -----Original Message----- > From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx > [mailto:netfilter-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Greg Cope > Sent: Tuesday, January 25, 2005 9:25 AM > To: netfilter@xxxxxxxxxxxxxxxxxxx > > Subject: Re: Help debugging iptables firewall.... > > Hi Gary, > > Pinholes? If you mean specific IP to specific IP:PORT on specfic > interfaces then yes. > > DB is an oracle listener (port 1521) > > I have these: > > # for ssh to db server from webserver > $IPTABLES -A FORWARD -p tcp --dport 22 -i $DMZ_IFACE -s $DMZ_EDGE_IP > -o $LAN_IFACE -d $TROT_IP -j ACCEPT > > $IPTABLES -A FORWARD -p tcp --dport 1521 -i $DMZ_IFACE -s $DMZ_EDGE_IP > -o $LAN_IFACE -d $TROT_IP -j ACCEPT > > I added 2 of your examples one before one after, and only see: > > Jan 25 17:21:43 gateway kernel: Oracle 1521 [tcp] before: IN=eth1 > OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 > TTL=63 ID=30447 DF PROTO=TCP SPT=32907 DPT=1521 WINDOW=5840 RES=0x00 > SYN URGP=0 > > Which would imply that the rule is ok and the packets goes through - > but why I am not getting a connection? > > Thanks, > > Greg > >
