Chris Henry wrote:
> On Fri, Mar 21, 2008 at 2:44 AM, Frédéric Massot
> <frederic@[EMAIL PROTECTED]
> wrote:
>> Hi,
>>
>> I have servers with public IP addresses in a DMZ behind a firewall.
>>
>> The firewall has two network interface, one connected to the DMZ, the
>> other to the ISP router.
>>
>> From local network, I can access the server via SSH on ****t 22/TCP.
>>
>> I would like to access the server from the outside on another ****t
like
>> 12345/TCP. I try to translate the SSH ****t on the firewall with a DNAT
rule.
>>
>> I have these rules :
>>
>> iptables -A FORWARD -i $EXTERNAL_INTERFACE -o $INTERNAL_INTERFACE -p
tcp
>> --s****t $UNPRIV****TS -d $SERVER --d****t 22 -m state --state NEW -j
ACCEPT
>>
>> iptables -t nat -A PREROUTING -i $EXTERNAL_INTERFACE -p tcp -d $SERVER
>> --d****t 12345 -j DNAT --to-destination $SERVER:22
>>
>> With these rules I can access the server on ****ts 22/TCP and
12345/TCP.
>>
>> How I can ensure that access will possible only on ****t 12345/TCP and
>> not on ****t 22/TCP ?
> Do you set default policy for INPUT (and possibly FORWARD if you don't
> want any connection to be forwarded to internal LAN) to be
> DROP/REJECT? With default policy, as long as you don't specify any
> rule, it will be dropped/rejected.
>
> iptables -P INPUT DROP
> iptables -P FORWARD DROP
Hi,
All chains have DROP policy on table filter, I open only the necessary
****ts.
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
iptables -t mangle -P PREROUTING ACCEPT
iptables -t mangle -P POSTROUTING ACCEPT
iptables -t mangle -P INPUT ACCEPT
iptables -t mangle -P OUTPUT ACCEPT
iptables -t mangle -P FORWARD ACCEPT
Is it that I should put policy DROP on the tables nat and mangle ?
Regards.
--
==============================================
| FRÉDÉRIC MASSOT |
| http://www.juliana-multimedia.com
|
| mailto:frederic@[EMAIL PROTECTED]
|
===========================Debian=GNU/Linux===
--
To UNSUBSCRIBE, email to debian-firewall-REQUEST@[EMAIL PROTECTED]
a subject of "unsubscribe". Trouble? Contact
listmaster@[EMAIL PROTECTED]
|
