Dzianis Kahanovich wrote:
Eial Czerwacki wrote:
-A INPUT -p tcp -m state --state NEW --dport 135 -s 132.72.144.0/20
-j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 139 -s 132.72.144.0/20
-j ACCEPT
-A INPUT -p udp -m state --state NEW --dport 137:138 -s
132.72.144.0/20 -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 426 -s 132.72.144.0/20
-j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 445 -s 132.72.144.0/20
-j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 135 -s 192.168.114.0/24
-j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 139 -s 192.168.114.0/24
-j ACCEPT
-A INPUT -p udp -m state --state NEW --dport 137:138 -s
192.168.114.0/24 -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 426 -s 192.168.114.0/24
-j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 445 -s 192.168.114.0/24
-j ACCEPT
# up to 5 Bit-torrent connections
-A INPUT -p tcp -m state --state NEW --dport 6881:6886 -j ACCEPT
#else
-A INPUT -j REJECT --reject-with icmp-port-unreachable
You ACCEPTing only NEW connection state - initial packets for every
session.
Remove "-m state -- state NEW".
or at least add stateful rules for output. but it is true that managing
state in this case is cumbersome at best.
Another thing is that he is no allowing ICMP. It may be just me, but I
tend to consider a machine as disconnected if it does not respond to
ping... and while it be argued that this is helpful to protect winboxes,
I would be frightened if this argument applied to a (not too old) linux
or bsd ;-p
Finally, adding a rule to log rejected packets would help debugging
whatever issues happen.
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
