On Mon, 2005-03-07 at 12:15 +0100, Jörg Harmuth wrote: > Hi, Hi > your port 8000 - and all others - can be accessed, because you allowed > it. First: > > iptables -A INPUT -s 195.140.140.100 -j ACCEPT I need to allow that machine. > you accept all connections from this box: Second: > > iptables -A INPUT -p tcp --syn -m limit --limit 5/s -j ACCEPT > you allow 5 connections per second from everywhere, including the > internet. This is the second rule and as ACCEPT is a terminating > target, chain traversing stops right here. So your services are all > available to the whole world. Oooooooh yes! that was my mistake. > You can remove the second rule or do it more specifically, e.g. with > interfaces or ports like this: I choose to remove it. > In the last rule you should specify addresses, that may connect to > port 8000. You can also combine it like this: > iptables -A INPUT -p tcp -i ethn --dport 8000 -s SOME_ADDRESS -m limit No. It's an Icecast server behind (Web Radio, broadcasting music). All the world needs to acces from that port. It really helped. Thank you. -- ASPO Infogérance http://aspo.rktmb.org/activites/infogerance Unofficial FAQ fcolc http://faq.fcolc.eu.org/ LUG sur Orléans et alentours (France). Tél : 02 34 08 26 04 / 06 33 26 13 14
