<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
<font size="2">maybe shorewall can do your live so easy.....
<br />
<br />--
<br />
<br />
<br /><b>---------- Original Message
-----------</b>
<br />
From: Robert Moskowitz <rgm@htt-consult.com>
<br />
To: CentOS mailing list <centos@centos.org>
<br />
Sent: Thu, 3 Jan 2008 08:03:09 -0500
<br />
Subject: Re: [CentOS] Firewall frustration
<br />
<br />> Christopher Chan wrote:
<br />>
>
<br />>
>> I tried it. I had everything open. Then I blocked everything. Then I
<br />>
>> set up a rule to allow SSH in to eth0 and out eth1 (and the other
<br />>
>> way). At least I thought that was what the rules said, but no SSH
<br />>
>> connectivity through the firewall. That was when I realized that I
<br />>
>> had not found the necessary incantation, and I had already shot most
<br />>
>> of tuesday.
<br />>
>>
<br />>
>
<br />>
> Too bad you missed the documentation on netfilter then.
<br />>
And that is the crux of the problem. Finding the right documentation....
<br />>
<br />>
And to look at documentation on netfilter besides iptables.
<br />>
> It would have told you that the INPUT chain controls what comes to the
<br />>
> box, the OUTPUT chain what originates from the box and the FORWARD
<br />>
> chain what goes through the box.
<br />>
>
<br />>
> You would have needed a rule in FORWARD to allow ssh connections
<br />>
> through the box. The rules in the INPUT and OUTPUT chains would have
<br />>
> zero effect on connections going through.
<br />>
>
<br />>
> Anyways, you have something now but in case you want to give iptables
<br />>
> another go...
<br />>
> _______________________________________________
<br />>
> CentOS mailing list
<br />>
> CentOS@centos.org
<br />>
> <a target="_blank" href="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</a>
<br />>
>
<br />>
_______________________________________________
<br />>
CentOS mailing list
<br />>
CentOS@centos.org
<br />>
<a target="_blank" href="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</a>
<br />>
<br />>
--
<br />>
Este mensaje ha sido analizado por MailScanner
<br />>
en busca de virus y otros contenidos peligrosos,
<br />>
y se considera que está limpio.
<br />>
For all your IT requirements visit: <a target="_blank" href="http://www.transtec.co.uk/">http://www.transtec.co.uk</a>
<br /><b>------- End of Original
Message
-------</b>
<br />
</font>
</BODY>
<br />--
<br />Este mensaje ha sido analizado por
<a href="http://www.mailscanner.info/"><b>MailScanner</b></a>
<br />en busca de virus y otros contenidos peligrosos,
<br />y se considera que está limpio.
<br />MailScanner agradece a <a href="http://www.transtec.co.uk/">transtec Computers</a> por su apoyo.
</HTML>