Re: Re: Firewall

hello
do you have an script able to create masquarade and
port forwarding..?
i use masquarade but i cant use yahoo mess or
neetmeeting...

best regard 
marcel 
--- [email protected] wrote:
> Thomas,
> 
> Thanks very much for replying this is exactly what I
> am after :). I will need to turn web surfing on and
> off as and when needed. Can you recommend some
> iptables entries for this also?
> 
> Thanks again,
> 
> Steve
> 
> 
> 
> >Steve,
> >
> >Assuming you don't want to web-surf or anything,
> this is the minimalist 
> >set of rules that will allow ssh into the linux box
> and tunneled VNC 
> >into the windows box.
> >
> ># start with a clean slate
> >iptables --flush
> >
> ># turn off everything by default
> >iptables --policy FORWARD  DROP
> >iptables --policy INPUT  DROP
> >iptables --policy OUTPUT  DROP
> >
> ># let's poke holes in it....
> ># if you can't trust yourself....
> >iptables --append INPUT  --in-interface lo --jump
> ACCEPT
> >iptables --append OUTPUT --out-interface lo --jump
> ACCEPT
> >
> ># allow continuation of previously approved traffic
> >iptables --append INPUT  --proto tcp --state
> REALTED --jump ACCEPT
> >iptables --append OUTPUT --proto tcp --state
> REALTED --jump ACCEPT
> >
> ># allow traffic from the LINUX box to the VNC port
> on the windos one
> ># put eth<whatever> in place of $XXX
> ># put IP address of window box in place of $YYY
> >iptables --append OUTPUT --out-interface $XXX
> --proto tcp --destination $YYY  --destination-port
> 5900 --jump ACCEPT
> >
> ># allow traffic from the WWW on port to the ssh
> port
> ># put eth<whatever> or ppp<whatever> in place of
> $ZZZ
> >iptables --append INPUT --in-interface $ZZZ --proto
> tcp --destination-port 22 --jump ACCEPT
> >
> ># now save it so that your box will load these
> things
> >iptables-save > /etc/sysconfig/iptables
> >
> ># use ntsysv to make sure iptables is loaded AND
> ipchains IS NOT!
> >
> >
> >locked down very tight, sacrificing functionality
> for security.
> >You'll probably need more holes in the f/w to allow
> you to do things like web-surfing etc.
> >I'd advise against NAT or anything like that, just
> run proxy servers on your linux box and 
> >run XP through those.
> >
> >Now you need to ssh into the linux box and with -R
> 5900:<ip-of-XP>:5900, the vnc to localhost and
> you're in!
> >sshd can be tightened down also so that it won't
> allow local shell logins, only port forwarding to
> the XP box.
> >
> >
> >
> >On Sat, 5 Apr 2003, SWilkes wrote:
> >
> >> Hello all,
> >>  
> >> I am about to build a firewall for my home
> network which will have a
> >> broadband connection. After much investigation I
> have decided to use
> >> RedHat (8 or 9) as a software firewall. I will be
> installing it on an
> >> old PC I have (400Mhz AMD K63, 96MB, 20GB HD,
> GF2) and will be dedicated
> >> as a firewall. Has anyone done this already and
> have a sample iptables
> >> entry they can share with me?
> >>  
> >> My ultimate goal is to be able to log onto my XP
> machine at home from
> >> any computer that has an internet connection. I
> plan to use VNC and
> >> tunnel this through Open SSH connection for
> security. Therefore, I
> >> believe that I will only need to have one ssh
> port open to the internet.
> >> If anyone can share any knowledge about this then
> please let me know.
> >>  
> >> Thanks in advance.
> >>  
> >> Steve
> >> 
> >
> >-- 
> >Thomas Sprinkmeier     /"\
> >Ebor Computing         \ /    ASCII Ribbon Campaign
> >+61 8 8351 7122         X     Against   HTML   Mail
> >+61 8 8351 7079 (fax)  / \  Better  Safe  Than 
> Sorry
> >
> >pub  1024D/40521F2E 2001-11-02
> <[email protected]>
> >     9561 6DD5 A0D2 7334 1853  B227 2053 74D1 4052
> 1F2E
> >sub  1024g/736BCEAC 2001-11-02
> >
> >"Everything should be made as simple as possible,
> but not simpler."
> >		Albert Einstein
> >
> 
> 
> 
> _______________________________________________
> Redhat-secure-server mailing list
> [email protected]
>
https://listman.redhat.com/mailman/listinfo/redhat-secure-server


__________________________________________________
Do you Yahoo!?
Yahoo! Tax Center - File online, calculators, forms, and more
http://tax.yahoo.com