On Thu, 2005-01-27 at 05:13, varun_saa@xxxxxxxx wrote: > Hello, > My server is Mandrake 10.1 > eth0 is WAN with static IP connected to 512k DSL > eth1 is LAN > > I am trying to write iptables rules and I am > stuck with some error. > > My iptable file is as follows : > > # Generated by iptables-save v1.2.9 on Thu Oct 21 05:32:36 2004 > *nat > :OUTPUT ACCEPT [0:0] > :PREROUTING ACCEPT [0:0] > :POSTROUTING ACCEPT [0:0] > -A POSTROUTING -o eth0 -j MASQUERADE > COMMIT > # Completed on Thu Oct 21 05:32:36 2004 > # Generated by iptables-save v1.2.9 on Thu Oct 21 05:32:36 2004 > *mangle > :PREROUTING ACCEPT [32056:3889577] > :INPUT ACCEPT [32010:3885659] > :FORWARD ACCEPT [0:0] > :OUTPUT ACCEPT [31637:4617585] > :POSTROUTING ACCEPT [31639:4618071] > COMMIT > # Completed on Thu Oct 21 05:32:36 2004 > # Generated by iptables-save v1.2.9 on Thu Oct 21 05:32:36 2004 > *filter > :FORWARD ACCEPT [0:0] > :INPUT DROP [0:0] > :OUTPUT ACCEPT [0:0] > -A INPUT -j ACCEPT > -A INPUT -s 127.0.0.1 -j ACCEPT > -A INPUT -p tcp -m tcp -i eth1 -o eth0 --dport 3128 --sport 80 -j ACCEPT > -A INPUT -p udp -m udp -i eth1 -o eth0 --dport 3128 --sport 80 -j ACCEPT > COMMIT > # Completed on Thu Oct 21 05:32:36 2004 > > When I am trying to save I get the following error : > > iptables-restore v1.2.9: Can't use -o with INPUT > > Error occurred at line: 25 > Try `iptables-restore -h' or 'iptables-restore --help' for more information. > > Can anybody guide me ? yeah--you can't use "-o" with INPUT. if you are under the impression that the traffic you're trying to filter has both an inbound and outbound interface and that the packet is FORWARD-ed from one to the other--you should be adding that rule to the FORWARD chain, not the INPUT chain. btw--what traffic do you believe has a source port of 80 and a destination port of 3128? -j -- "Oh, people can come up with statistics to prove anything, Kent. 14% of people know that." --The Simpsons
