[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Iptables :: priority of rules



On Fri, 23 Feb 2007, Luc MAIGNAN wrote:

Sorry for the information I've forgotten to give to you. I've set the INPUT policy to DROP

BR

so your accepts should work, no need to use any -j DROP if policy is DROP
its first come first served in matching, so it should find your internal IP's somewhere in its order and let you in, if it doesnt you have a bigger problem.





Res a écrit :
On Fri, 23 Feb 2007, Luc MAIGNAN wrote:

In fact, isn't what I wrote ?


No, I believe Tim meant a default drop "policy" then the rules you add are accepts.

eg:
iptables -P INPUT DROP
iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -s special.ip.allowed -j ACCEPT





Tim a écrit :
On Fri, 2007-02-23 at 11:26 +0100, Luc MAIGNAN wrote:

I don't understand how the priority of the rules of iptables is set.

My problem : I want to allow ssh from my local network(1), and from outside only for an IP(2)

So i Wrote :

(1) : iptables -I INPUT -p tcp -s 192.168.0.0/24 --dport ssh -j ACCEPT
(2) : iptables -I INPUT -p tcp -s ! x.x.x.x --dport ssh -j DROP

The result is that I can ssh only from the ousided IP, not from local network. If I switch the two rules, the result is the same.

Can anyone help me to understand ?


You can have a default drop rule on all input traffic, then add a couple
of specific rules to allow it from your local network, and another to
allow it from a specific address.








--
Cheers
Res

"We can be Heroes, just for one day" - Davey (Jones) Bowie


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]