<br><br><div><span class="gmail_quote">On 2/17/07, <b class="gmail_sendername">Robert Spangler</b> <<a href="mailto:lazydog@zoominternet.net">lazydog@zoominternet.net</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Sat February 17 2007 03:11, Indunil Jayasooriya wrote:<br><br>> > I am setting up a firewall on CENTOS 4.4.<br>> ><br>> ><br>> > I have enabled ICMP to <a href="http://www.google.com">www.google.com
</a><br>> ><br>> > iptables -A OUTPUT -p icmp -d <a href="http://64.233.189.104">64.233.189.104</a> -j ACCEPT<br>> > iptables -A INPUT -p icmp -s <a href="http://64.233.189.104">64.233.189.104</a> -j ACCEPT
<br>><br>> traceroute uses by default UDP with port 33434.<br><br>While this is true for a starting point, this is not the whole story.<br><br>Traceroute starts on this port but every time it sends out a packet the port
<br>number is increased automatically. Why? Simple, the TTL is exceeded so<br>traceroute sends out on the next port in numerical order. Thus traceroute<br>needs more then 33434 open there should be a range of ports open. Traceroute
<br>does not always start on this port either I have found out. Sometimes it<br>starts on a hight port but only by a few hopes.<br><br>> I wrote below 2 rules<br>><br>> iptables -A OUTPUT -p udp -d <a href="http://64.233.189.104">
64.233.189.104</a> --dport 33434 -j ACCEPT<br>> iptables -A INPUT -p udp -s <a href="http://64.233.189.104">64.233.189.104</a> --sport 33434 -j ACCEPT<br><br>I have the following ( I do not restrict traceroute destination);
<br><br>-A OUTPUT -o eth0 -p udp --dport 33200:33500 -m state --state NEW -j ACCEPT<br><br>Also you don't need the INPUT statement if you have ESTABLISHED,RELATED at the<br>top of your INPUT chain.</blockquote><div><br>
I have included ESTABLISHED,RELATED at the top of your INPUT chain as below<br><br>#Allow established,related trafffic to come back<br>#(for OUTPUT traffic to come back)<br>iptables -A INPUT -i eth0 -d <a href="http://192.168.101.60">
192.168.101.60</a> -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT<br><br>But without an INPUT statament it does not work. BUT for TCP OUTPUT traffice , that will be appilicalbe. But other than tcp (i.e UPD and ICMP ) I will have to include a INPUT staement.
<br><br>A few OUTPUT rules that I need INPUT statemet are give below. (not TCP)<br><br>#UDP<br>iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT<br>iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT<br><br>#ICMP (for ping
<a href="http://www.google.com">www.google.com</a>)<br><br>iptables -A OUTPUT -p icmp -d <a href="http://64.233.189.104">64.233.189.104</a> -j ACCEPT<br>iptables -A INPUT -p icmp -s <a href="http://64.233.189.104">64.233.189.104
</a> -j ACCEPT<br><br>And this is for TCP ( it does not nedd a INPUT satatment .it works fine) <br><br>iptables -A OUTPUT -p tcp -o eth0 --dport 22 -j ACCEPT<br><br><br>PLs expalin, why? <br><br><br><br><br><br><br><br><br>
<br> </div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">> Then I tried as below<br><br>[snip]<br><br>> But Still the same.<br>
><br>> WHY?<br><br>I placing my money on the port settings<br><br>> IF my rules are wrong can you rectify it ?<br><br>See above.<br><br><br>--<br><br>Regards<br>Robert<br><br>Smile... it increases your face value!
<br>_______________________________________________<br>CentOS mailing list<br><a href="mailto:CentOS@centos.org">CentOS@centos.org</a><br><a href="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos
</a><br></blockquote></div><br><br clear="all"><br>-- <br>Thank you<br>Indunil Jayasooriya<br>