Re: matching -d to a given interface without specifying ip address

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Dmitri wrote:
The problem with specifying an IP is that it may change, which breaks the rules and requires an update (and detection as well). Event for a static IP, that's an extra dependency to watch out for.

That's what variables in your firewall script are for.
Just re-run it when your network connection restarts:
EXTIF="eth0"
EXTIP=`ifconfig $EXTIF |perl -ne'print $1 if /inet addr:([\d.]+)/'`
iptables -A INPUT -j ACCEPT -i $EXTIF -p tcp -d $EXTIP --dport 80
--
    _.,-*~`^'~*-,._ Danny Rathjens _.,-*~`^'~*-,._
FireCast: Rock solid kiosk software: http://www.wirespring.com/



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux