[ LUGOS ] ipchains nastavitev za syslog

[Jernej Horvat]

On Wed, Oct 11, 2000 at 06:03:03PM +0200, Tadej Blatnik wrote:

> Zanima me kako napisati ukaz ipchains - da syslog ne bi logiral zahtev z 
> nekega znanega IPja. Ali je to sploh mozno? 

ipchains --help

--log         -l              turn on kernel logging for matching packets

Izkljuci logiranje.

> 193.189.176.176:5 193.189.176.180:0 

port 5 ??


general rule:

ipchains * -j DENY
ipchains dolocen_servis -J ACCEPT

...npr.


ip="tvoja.ip.stevilka.!"
# 
ipchains -F
ipchains -F input
ipchains -F forward
ipchains -F output

#
ipchains -P input DENY
ipchains -P forward DENY
ipchains -P output ACCEPT

#
ipchains -A input -i eth0 -p icmp --icmp-type echo-reply -j ACCEPT
#ipchains -A input -i eth0 -p icmp --icmp-type echo-request -j DENY
ipchains -A input -i eth0 -p icmp --icmp-type destination-unreachable -j ACCEPT
ipchains -A input -i eth0 -p icmp --icmp-type source-quench -j ACCEPT
ipchains -A input -i eth0 -p icmp --icmp-type time-exceeded -j ACCEPT
ipchains -A input -i eth0 -p icmp --icmp-type parameter-problem -j ACCEPT

# ftp
ipchains -A input -i eth0 -p tcp -d $ip/32 20 -j ACCEPT
ipchains -A input -i eth0 -p tcp -d $ip/32 21 -j ACCEPT

# http
ipchains -A input -i eth0 -p tcp -d $ip/32 80 -j ACCEPT

#smtp
ipchains -A input -i eth0 -p tcp -d $ip/32 25 -j ACCEPT

#ssh
ipchains -A input -i eth0 -p tcp -d $ip/32 22 -j ACCEPT

ipchains -A input -i eth0 -p tcp -d $ip/32 1023:65535 ! -y -j ACCEPT
ipchains -A input -i eth0 -p udp -d $ip/32 1023:65535 -j ACCEPT

# Dovoljeno iz lo
ipchains -A input -i lo  -p all -s 127.0.0.1/8       -j ACCEPT
ipchains -A input -i lo  -p all -s $ip/32            -j ACCEPT

-- 
tcpdump is your friend