Removing my original rule I get logged: Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] before: IN=eth1 OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00 SYN URGP=0 Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] after: IN=eth1 OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00 SYN URGP=0 Jan 25 18:13:19 gateway kernel: FORWARD DENY: IN=eth1 OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00 SYN URGP=0 Greg On Tue, 25 Jan 2005 10:09:43 -0800, Gary W. Smith <gary@xxxxxxxxxxxxxxx> wrote: > Crap, I had a typo. It should have been -i, not -o for the lan > interface > > $IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT > > Try that and let us know. > > Gary Wayne Smith > > > -----Original Message----- > From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx > [mailto:netfilter-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Greg Cope > Sent: Tuesday, January 25, 2005 9:59 AM > To: netfilter@xxxxxxxxxxxxxxxxxxx > Subject: Re: Help debugging iptables firewall.... > > I think we are getting there: > > The one you suggested gives an error: > > Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not allowed > > Looking at tcpdump on a few machines it looks like the packets are > getting through - but nothing gets sent: > > 17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S > 965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024 > 0,nop,wscale 0> (DF) [tos 0x10] > > And then nothing else - sadly I am not a tcpdump expert..... > > Any clues? I am at a loss as to why this was working and now it does > not..... > > Greg > >
