Hello Askar/A.Dreyer, Thank you very much for your insights, now i see how badly our IPTables is setup. Will re-configure along your recommended settings, and see how system goes. I will post whatever our final rules will look like. Best regards! ---jake On Apr 4, 2005 7:32 PM, Askar <askarali@xxxxxxxxx> wrote: > On Apr 4, 2005 3:59 PM, J A <jake.lists@xxxxxxxxx> wrote: > > Sorry, when i replied to the thread, i seemed to have copied only > > guido, here's a re-send: > > > > Here are our rules (pls refer to the thread for the problem > > description), hope you could share us your vasluable insight. > > -------------------------------------------------------------------------- > > *filter > > :INPUT ACCEPT [0:0] > > :FORWARD ACCEPT [0:0] > > :OUTPUT ACCEPT [0:0] > > :RH-Lokkit-0-50-INPUT - [0:0] > > -A INPUT -j RH-Lokkit-0-50-INPUT > > -A FORWARD -j RH-Lokkit-0-50-INPUT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 25 --syn -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 21 --syn -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 23 --syn -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT > > -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT > > -A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT > > -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT > > COMMIT > > -------------------------------------------------------------------------- > > > > > > On Apr 4, 2005 5:40 PM, Askar <askarali@xxxxxxxxx> wrote: > > > how should we suggest something without watchen your iptables rules set? > > > > > > regards > > > > > > > > > On Apr 4, 2005 8:11 AM, J A <jake.lists@xxxxxxxxx> wrote: > > > > Hello All, > > > > > > > > We're using Redhat 9 > > > > We've been running a Web Server (Apache & Tomcat), and were told to > > > > run a firewall, in this case IPTables. When we enabled IPTables, many > > > > of our web sites (BUT not all) could no longer be browsed from the > > > > Internet. > > > > > > > > Could you tell us which specific IPTables parameter is doing this, so > > > > we could disable only the specific parameter? > > > > Or is it not advisable to run IPTables side-by-side with Web services? > > > > > > > > Thanks, appreciate your ideas. > > > > > > > > ---jake > > > > > > > > > > > > > > -- > > > I love deadlines. I like the whooshing sound they make as they fly by. > > > Douglas Adams > > > > > > okay try these iptables rules as starting point, > > # Load the FTP connection state helper module. > #Clear \ Flush all the rules from the different chains and tables > for table in mangle nat filter; do > iptables -t $table -F > iptables -t $table -X > done > # Set the default filter table policy > iptables --policy INPUT DROP > iptables --policy OUTPUT ACCEPT > iptables --policy FORWARD DROP > > # Using Connection State to By-pass Rule Checking > iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT > iptables -A INPUT -p tcp -m multiport --dport 25,80,21,22,23 -m state > --state NEW -j ACCEPT > > Note: save these rules to a file, then chmod +x the file and then > execute it with ./filename :) > > regards > > > -- > I love deadlines. I like the whooshing sound they make as they fly by. > Douglas Adams >
