On Wed, November 2, 2005 08:20, Nikolai Georgiev wrote:
>> Problem is that while they can connect OUT, nothing from the
>> outside can connect to them.
>>
> Hello there, i think this should do
> iptables -P INPUT DROP
> iptables -P OUTPUT DROP
> iptables -A INPUT --dst $YOUR_IP -m state --state ESTABLISHED,RELATED
> -j ACCEPT
> iptables -A OUTPUT --src $YOUR_IP -m state --state
> NEW,ESTABLISHED,RELATED -j ACCEPT
The INPUT and OUTPUT chains are for local traffic.
These kiosk hosts are probably *behind* iptables, so traffic will
travel through the FORWARD chain.
If you need external connections forwarded to hosts behind the
firewall, you need DNAT rules to make it happen.
In this case, the OP has 3 hosts to wich he wants to connect ("nothing
from the outside can connect to them", outgoing connections are
already working).
FTP only uses port 21/tcp (and 20). It's to my knowledge not possible
to forward 1 port to 3 hosts simultaneously (if that would do any
good), so he'll need to assign different ports for the second and
third host.
Something like :
21/tcp -> host 1
41/tcp -> host 2
61/tcp -> host 3
(if these ports are free).
Gr,
Rob
