iptables a zakaz :80

[Petr Žanta]

A co takhle?...

/sbin/ipchains -N noweb
/sbin/ipchains -A input -j noweb
/sbin/ipchains -A output -j noweb
/sbin/ipchains -A noweb -p tcp -s 172.16.0.0/16 -d 0/0 www -j REJECT -l
/sbin/ipchains -A noweb -p tcp -s 192.168.1.0/24 -d 0/0 www -j REJECT -l

Pet...


> 
> On Fri, Aug 31, 2001 at 12:58:40PM +0200, Vladim?r Vol?ko wrote:
> > DD!!
> >     Potrebuji zakazat 80 port a nejak se nedari ...
> zkousim: iptables
> > -A INPUT -p tcp  -s 192.168.0.0/16 -d 0/0 --dport 80  -j
> DROP iptables
> > -A INPUT -p udp -s 192.168.0.0/16 -d 0/0 --dport 80  -j DROP
> 
> a) udp netreba
> b) odporucam dat to do OUTPUT chainu, s vasou vonkajsou
> zdrojovou adresou. alebo do FORWARD chainu. teraz hlada 
> kernel pakety ktore k nemu pridu, maju zdroj 192.168 a 
> destinatination port 80. pakety ktore routujete z vnutornej 
> siete idu cez FORWARD chain, takze sa INPUT chainu nedotknu 
> -> nebudu dropnute
> 
> > 
> > [root na spoje at /etc/rc.d] iptables -L -n -v
> > Chain INPUT (policy ACCEPT 6 packets, 300 bytes)
> >  pkts bytes target     prot opt in     out     source       
>         destination
> >     0     0 DROP       tcp  --  *      *       
> 192.168.0.0/16       0.0.0.0/0          tcp dpt:80
> >     0     0 DROP       udp  --  *      *       
> 192.168.0.0/16       0.0.0.0/0          udp dpt:80
> > 
> > Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
> >  pkts bytes target     prot opt in     out     source       
>         destination
> > 
> > Chain OUTPUT (policy ACCEPT 4 packets, 300 bytes)
> >  pkts bytes target     prot opt in     out     source       
>         destination
> > 
> > ... inet vsak jede smele dal. Nevite nekdo jak na to?
> 
> aaaaach jaj. web != inet. to co 'jede smele dal' je web. inet > web.
> 
> [e]
> 
> ps. snad som sa nekopol
>