| Welcome, Guest |
You have to register before you can post on our site.
|
| Online Users |
There are currently 475 online users.
» 0 Member(s) | 472 Guest(s)
Applebot, Bing, Google
|
| Latest Threads |
How to install Archboot i...
Forum: Network Problems
Last Post: Meup
2025-05-13, 01:41 PM
» Replies: 0
» Views: 449
|
clear logs in smoothwall
Forum: Security and Firewalls
Last Post: amanda63
2024-03-10, 03:27 PM
» Replies: 8
» Views: 88,182
|
I cannot install RedHat 8...
Forum: Redhat
Last Post: hybrid
2023-11-11, 01:01 PM
» Replies: 1
» Views: 41,801
|
How things are done, usin...
Forum: Xorg Problems
Last Post: ross
2023-09-04, 09:03 AM
» Replies: 0
» Views: 1,892
|
Im back.....
Forum: Hello
Last Post: anyweb
2021-01-17, 11:36 AM
» Replies: 1
» Views: 5,374
|
add mp3 plugin to xmms in...
Forum: Fedora
Last Post: anyweb
2021-01-17, 11:30 AM
» Replies: 11
» Views: 41,445
|
Configuring VSFTPd Server
Forum: FTP Server
Last Post: Johnbaca
2020-10-14, 10:25 AM
» Replies: 32
» Views: 117,751
|
Wolf won't play sound!
Forum: Game Problems
Last Post: Guest
2020-10-03, 05:51 PM
» Replies: 1
» Views: 55,596
|
Using git + python
Forum: How Do I?
Last Post: Clueless puppy
2020-08-21, 04:37 PM
» Replies: 0
» Views: 45,605
|
what does your nick mean ...
Forum: Hello
Last Post: volt
2020-08-06, 03:25 PM
» Replies: 28
» Views: 42,036
|
|
|
| WAR AVERTED BETWEEN IRELAND AND FRANCE |
|
Posted by: P38 - 2005-04-30, 09:46 PM - Forum: Jokes
- Replies (3)
|
 |
Jacques Chirac, the French Prime Minister, was sitting in his office wondering what kind of mischief he could perpetrate against the United States when his telephone rang.
"Hallo, Mr. Chirac!" a heavily accented voice said. "This is Paddy down at the Harp Pub in County Sligo, Ireland. I am ringing to inform ya that we are officially declaring war on ya!"
"Well, Paddy," Chirac replied, "this is indeed important news! How big is your army?"
"Right now," said Paddy, after a moment's calculation, "there is meself, me cousin Sean, me next door neighbor Seamus, and the entire dart team from the pub. That makes eight!"
Chirac paused. "I must tell you, Paddy, that I have one hundred thousand men in my army waiting to move on my command."
"Begorra!" said Paddy. "I'll have to ring ya back!"
Sure enough, the next day, Paddy called again. "Mr. Chirac, the war is still on. We have managed to get us some infantry equipment!"
"And what equipment would that be, Paddy?" Chirac asked.
"Well, we have two combines, a bulldozer, and Murphy's farm tractor." Chirac sighed, amused. "I must tell you, Paddy, that I have 6,000 tanks and 5,000 armored personnel carriers. Also, I've increased my army to one hundred fifty thousand since we last spoke."
"Saints preserve us!" said Paddy. "I'll have to get back to ya."
Sure enough, Paddy rang again the next day. "Mr. Chirac, the war is still on! We have managed to get ourselves airborne! We've modified Jackie McLaughlin's ultra-light with a coople of shotguns in the cockpit, and four boys from the Shamrock Pub have joined us as well!"
Chirac was silent for a minute and then cleared his throat. "I must tell you, Paddy, that I have 100 bombers and 200 fighter planes. My military complex is surrounded by laser-guided, surface-to-air missile sites. And since we last spoke, I've increased my army to two hundred thousand!"
"Begorra!" said Paddy. "Again I'll have to ring ya back."
Sure enough, Paddy called again the next day. "Top o' the mornin', Mr.Chirac! I am sorry to tell ya that we have had to call off the war."
"I'm sorry to hear that," said Chirac. "Why the sudden change of heart?"
"Well," said Paddy, "we've all had a long chat over a bunch of pints, and decided there's no way we can feed two hundred thousand prisoners."
|
|
|
| Another Example Firewall |
|
Posted by: P38 - 2005-04-30, 09:33 PM - Forum: Security and Firewalls
- No Replies
|
|
Here is another firewall example for you to review and offer me suggestions on how I can make it better. Feel free to use it in your own machines if you like the way it looks.
To use this firewall, copy it to a file on your machine, remove this text down to the line that starts #!/bin/sh leaving. Chmod the file to 700 or some such so that it can only be run as root. Edit the file and change the IP address variables at the top of the file to match your system. Then, run the script you have created. The firewall should load without errors. If there are errors, you will need to determine their cause and clear them up before you go forward.
After the script has run, do a "/etc/init.d/iptables restart" in order to save the firewall to your systems iptables cache. You will not need to re-run this script until/unless you make changes to it.
Now, this firewall, as configured, has one external interface. The external interface has three static ip addresses assigned to it. On my system, the three addresses are each assigned to a separate apache virtual server for serving up three different domains.
The firewall box, in my configuration, runs a web server, a mail server and a ssh server. You will notice ports open for this in the firewall. You will also notice that it only allows connections, with the exception of the web server, to the "primary external" ip address. Connections to the other external addresses are blocked.
Most incoming traffic is subject to rate restrictions on incoming new connections. There are exceptions to this because some services are better run with the limitations, but the ability to rate limit incoming connections has proven beneficial over and over in keeping out the bad traffic.
I continue to experiment with this firewall so you may see a few entries commented out. As I try different things, this is how I temporarily turn off things that I am currently not using.
If you have questions about how something works, please post them. I learn every time I dig into iptables and I will be happy to try to help.
P38
Code: #!/bin/sh -x
################################################################################
###################################################
# EXTERNAL INTERFACE CONFIGURATION
INET_IP="1.1.1.1" # External Interface 1
INET_IP2="1.1.1.2" # External Interface 2
INET_IP3="1.1.1.3" # External Inferface 3
INET_IFACE="eth0+"
INET_BROADCAST="1.1.1.255"
################################################################################
###################################################
# LOCAL LAN
LAN0_IP="172.16.1.1" # Internal Interface 1
LAN0_IP_RANGE="172.16.1.0/24"
LAN0_IFACE="tun+"
LAN1_IP="172.16.2.1" # Internal Interface 2
LAN1_IP_RANGE="172.16.2.0/24"
LAN1_IFACE="eth1"
BOB="172.16.2.100" # Internal Machine with PCAnywhere Access
PCANYWHERE_PORT1="5631" # PCAnywhere port
PCANYWHERE_PORT2="5632" # PCAnywhere port
SAM="172.16.2.116" # Internal Game Machine that runs World of Warcraft
WOW_PORT1="3724" #
WOW_PORT2="6112" # World of Warcraft ports
WOW_PORT3="6881:6999" #
LAN2_IP="172.16.3.0" # Internal Interface 3
LAN2_IP_RANGE="172.16.3.0/24" #
LAN2_IFACE="eth2" #
################################################################################
###################################################
# LOCALHOST
LO_IFACE="lo"
LO_IP="127.0.0.1"
################################################################################
###################################################
# SET PATH to BINARIES
IPTABLES="/sbin/iptables"
MODPROBE="/sbin/modprobe"
DEPMOD="/sbin/depmod"
E="/bin/echo"
################################################################################
###################################################
# IP Ranges only used for internal networks.
MARTIN0="10.0.0.0/8"
MARTIN1="172.16.0.0/12"
MARTIN2="192.168.0.0/16"
MARTIN3="192.254.0.0/16"
################################################################################
###################################################
# MULTICAST
MULTICAST_RANGE="224.0.0.0/8"
################################################################################
###################################################
# MODULES
$DEPMOD -a
$MODPROBE ip_tables
$MODPROBE ip_conntrack
$MODPROBE iptable_filter
$MODPROBE iptable_mangle
$MODPROBE iptable_nat
$MODPROBE ipt_LOG
$MODPROBE ipt_limit
$MODPROBE ipt_state
$MODPROBE ipt_owner
$MODPROBE ipt_REJECT
$MODPROBE ipt_MASQUERADE
$MODPROBE ip_conntrack_ftp
$MODPROBE ip_conntrack_irc
$MODPROBE ip_nat_ftp
$MODPROBE ip_nat_irc
################################################################################
###################################################
# FLUSH and DELETE all existing rules
$E "0" > /proc/sys/net/ipv4/ip_forward
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F POSTROUTING
$IPTABLES -t nat -F PREROUTING
$IPTABLES -F bad_tcp_packets
$IPTABLES -X bad_tcp_packets
$IPTABLES -F tcp_packets
$IPTABLES -X tcp_packets
$IPTABLES -F udp_packets
$IPTABLES -X udp_packets
$IPTABLES -F icmp_packets
$IPTABLES -X icmp_packets
$IPTABLES -F allowed
$IPTABLES -F allowed_2
$IPTABLES -X allowed
$IPTABLES -X allowed_2
################################################################################
###################################################
# POLICIES
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
################################################################################
###################################################
# CREATE CHAINS
$IPTABLES -N bad_tcp_packets
$IPTABLES -N allowed
$IPTABLES -N allowed_2
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets
################################################################################
###################################################
# bad_tcp_packets chain
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:NEW_not_SYN] '
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
################################################################################
###################################################
# allowed chain (rate limits enforced)
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP --syn -m limit --limit 3/minute --limit-burst 3 -j ACCEPT
$IPTABLES -A allowed -p TCP -j LOG --log-level "NOTICE" --log-prefix '[DROP:RATE_LIMIT] '
$IPTABLES -A allowed -p TCP -j REJECT
################################################################################
###################################################
# allowed_2 chain (no rate limits)
$IPTABLES -A allowed_2 -p TCP --syn -j ACCEPT
$IPTABLES -A allowed_2 -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed_2 -p TCP -j LOG --log-level "NOTICE" --log-prefix '[DROP:NOT_ALLOWED] '
$IPTABLES -A allowed_2 -p TCP -j REJECT
################################################################################
###################################################
# tcp_packets chain
# less restricted TCP connection attempts (no rate limiting and no allow to any external interface)
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 25 -j allowed_2 # allow smtp
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed_2 # allow http
# restricted TCP connections (with rate limiting and restricted to primary external interface)
$IPTABLES -A tcp_packets -p TCP -s 0/0 -d $INET_IP --dport 22 -j allowed # allow ssh
$IPTABLES -A tcp_packets -p TCP -s 0/0 -d $INET_IP --dport 113 -j allowed # allow ident
$IPTABLES -A tcp_packets -p TCP -s 0/0 -d $INET_IP --dport 5000 -j allowed # allow openvpn
$IPTABLES -A tcp_packets -p TCP -s 0/0 -d $INET_IP --dport 6881:6999 -j ACCEPT # unrestricted access to ports bittorrent download/upload
$IPTABLES -A tcp_packets -p TCP -s 0/0 -d $INET_IP --dport 40000:40099 -j allowed # ports for ssh port forwarding and local irc dcc
# Drop Microsoft Packets (TCP) so they don't show up in the logs
$IPTABLES -A tcp_packets -p TCP -i $INET_IFACE --destination-port 135:139 -j DROP
$IPTABLES -A tcp_packets -p TCP -i $INET_IFACE --destination-port 445 -j DROP
# Drop and log the rest
$IPTABLES -A tcp_packets
$IPTABLES -A tcp_packets -p TCP -j LOG --log-level "NOTICE" --log-prefix '[DROP:TCP_PACKETS] '
$IPTABLES -A tcp_packets -p TCP -j REJECT --reject-with tcp-reset
################################################################################
###################################################
# UDP ports
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 123 -j ACCEPT # ntp
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 5000 -j ACCEPT # openssh
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 40000:40099 -j ACCEPT # used for ssh port forwarding
# Drop Microsoft Packets (UDP) so they don't show up in the firewall logs
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE --destination-port 135:139 -j DROP
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE --destination-port 67:68 -j DROP
# Drop and log the rest
$IPTABLES -A udp_packets -p UDP -j LOG --log-level "NOTICE" --log-prefix '[DROP:UDP_PACKETS] '
$IPTABLES -A udp_packets -p UDP -j REJECT
################################################################################
###################################################
# ICMP rules
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
# Drop and log the rest
$IPTABLES -A icmp_packets -p ICMP -j LOG --log-level "NOTICE" --log-prefix '[DROP:ICMP_PACKETS] '
$IPTABLES -A icmp_packets -p ICMP -j REJECT
################################################################################
###################################################
################################################################################
###################################################
# INPUT chain
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
# Allow DHCP from internal networks
$IPTABLES -A INPUT -p ALL -i $LAN0_IFACE -s 0.0.0.0/32 -j ACCEPT # allow for DHCP
$IPTABLES -A INPUT -p ALL -i $LAN1_IFACE -s 0.0.0.0/32 -j ACCEPT # allow for DHCP
$IPTABLES -A INPUT -p ALL -i $LAN2_IFACE -s 0.0.0.0/32 -j ACCEPT # allow for DHCP
# Internal Networks
$IPTABLES -A INPUT -p ALL -i $LAN0_IFACE -s $LAN0_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LAN1_IFACE -s $LAN1_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LAN2_IFACE -s $LAN2_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN0_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN1_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN2_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP2 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP3 -j ACCEPT
# Rules for denied IP or NETWORKs
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:SPOOF] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP2 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:SPOOF] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP3 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:SPOOF] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP2 -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP3 -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN0 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:MARTIN_0] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN1 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:MARTIN_1] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN2 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:MARTIN_2] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN3 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:MARTIN_3] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN0 -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN1 -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN2 -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN3 -j DROP
$IPTABLES -A INPUT -p ALL -i $LAN0_IFACE -s ! $LAN0_IP_RANGE -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:BAD_INTERNAL_IP0] '
$IPTABLES -A INPUT -p ALL -i $LAN1_IFACE -s ! $LAN1_IP_RANGE -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:BAD_INTERNAL_IP1] '
$IPTABLES -A INPUT -p ALL -i $LAN2_IFACE -s ! $LAN2_IP_RANGE -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:BAD_INTERNAL_IP2] '
$IPTABLES -A INPUT -p ALL -i $LAN0_IFACE -s ! $LAN0_IP_RANGE -j DROP
$IPTABLES -A INPUT -p ALL -i $LAN1_IFACE -s ! $LAN1_IP_RANGE -j DROP
$IPTABLES -A INPUT -p ALL -i $LAN2_IFACE -s ! $LAN2_IP_RANGE -j DROP
# Drop Multicast from the external network.
$IPTABLES -A INPUT -i $INET_IFACE -d $MULTICAST_RANGE -j REJECT
$IPTABLES -A INPUT -i $INET_IFACE -s $MULTICAST_RANGE -j REJECT
# Rules for incoming packets from the internet.
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $INET_IP2 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $INET_IP3 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
# Log weird packets that don't match the above.
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[ALERT!!] '
################################################################################
###################################################
################################################################################
###################################################
# FORWARD chain
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
# Accept the packets we actually want to forward
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $LAN0_IFACE -j ACCEPT
$IPTABLES -A FORWARD -i $LAN1_IFACE -j ACCEPT
$IPTABLES -A FORWARD -i $LAN2_IFACE -j ACCEPT
# Forward PCANYWHERE PORTS to BOB
# Port 5631/tcp (PCANYWHERE_PORT1)
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p tcp --dport $PCANYWHERE_PORT1 -m limit --limit 3/minute --limit-burst 3 -j ACCEPT
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p tcp --dport $PCANYWHERE_PORT1 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:PCA_FWD_RATE_LMT] '
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p tcp --dport $PCANYWHERE_PORT1 -j DROP
# Port 5632/udp (PCANYWHERE_PORT2)
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p tcp --dport $PCANYWHERE_PORT2 -m limit --limit 3/minute --limit-burst 3 -j ACCEPT
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p tcp --dport $PCANYWHERE_PORT2 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:PCA_FWD_RATE_LMT] '
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p udp --dport $PCANYWHERE_PORT2 -j DROP
# WOW Ports
#$IPTABLES -A FORWARD -i $INET_IFACE -d $SAM -p tcp --dport $WOW_PORT1 -j ACCEPT
#$IPTABLES -A FORWARD -i $INET_IFACE -d $SAM -p tcp --dport $WOW_PORT2 -j ACCEPT
#$IPTABLES -A FORWARD -i $INET_IFACE -d $SAM -p tcp --dport $WOW_PORT3 -j ACCEPT
# Log weird packets that don't match the above.
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:FORWARD_PACKET_DIED] '
################################################################################
###################################################
################################################################################
###################################################
# OUTPUT chain
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN0_IP -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
################################################################################
###################################################
# Special OUTPUT rules to decide which IP's to allow.
$IPTABLES -A OUTPUT -p ALL -s $LAN1_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN2_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP2 -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP3 -j ACCEPT
################################################################################
###################################################
# Log weird packets that don't match the above.
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:OUTPUT_PACKET_DIED] '
################################################################################
###################################################
################################################################################
###################################################
# NAT table
################################################################################
###################################################
# IP Forwarding and Network Address Translation
$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE -d $INET_IP --dport $PCANYWHERE_PORT1 -j DNAT --to-destination $BOB:$PCANYWHERE_PORT1
$IPTABLES -t nat -A PREROUTING -p udp -i $INET_IFACE -d $INET_IP --dport $PCANYWHERE_PORT2 -j DNAT --to-destination $BOB:$PCANYWHERE_PORT2
#$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE -d $INET_IP --dport $WOW_PORT1 -j DNAT --to-destination $SAM:$WOW_PORT1
#$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE -d $INET_IP --dport $WOW_PORT2 -j DNAT --to-destination $SAM:$WOW_PORT2
#$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE -d $INET_IP --dport $WOW_PORT3 -j DNAT --to-destination $SAM:$WOW_PORT3
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP
################################################################################
###################################################
################################################################################
###################################################
$E "1" > /proc/sys/net/ipv4/ip_forward
|
|
|
|
| GnuPG Fedora Core 3 |
|
Posted by: xDamox - 2005-04-30, 05:11 PM - Forum: Security and Firewalls
- Replies (6)
|
 |
Well I though I would write a little tutorial on GnuPG encryption.
Quote:GnuPG is a complete and free replacement for PGP. Because it does not use the patented IDEA algorithm, it can be used without any restrictions. GnuPG is a RFC2440 (OpenPGP) compliant application.
The first step to using GnuPG is to generate a private and public key which will be used for
encrypting files/signing documents.
First create a .gnupg dir in your home directory as shown below:
This is the directory your public and private key will be stored. The next step is to create the
keys so type the command:
Once that command has been enter you will be prompted with:
Code: gpg (GnuPG) 1.2.6; Copyright (C) 2004 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.
Please select what kind of key you want:
(1) DSA and ElGamal (default)
(2) DSA (sign only)
(4) RSA (sign only)
Your selection?
if you will be encrypting file and signing files use DSA and ELGamal or if your just using
it to sign files choose DSA or RSA.
Once you have selected your key type you will then be presented with a screen asking
for a keysize as shown below:
Code: DSA keypair will have 1024 bits.
About to generate a new ELG-E keypair.
minimum keysize is 768 bits
default keysize is 1024 bits
highest suggested keysize is 2048 bits
What keysize do you want? (1024)
The keysize can be any depending on the file you want to encrypt/sign the keysize I settle for
is 4096 :)
if you do enter a keysize over 2048 you will be prompted with a message saying:
Code: Keysizes larger than 2048 are not suggested because
computations take REALLY long!
Are you sure that you want this keysize?
just type yes :)the next screen you will be prompted with is asking how long you want the
keys to last.
Code: Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
Then it will ask three more questions asking for your name etc.
Now that the key is created you will be able to encrypt files by issuing the following:
Code: gpg -e file_to_encrypt.txt
you can also add -a to armor the encryption. once that is do it will create a file called:
file_to_encrypt.txt.gpg or .asc thats about it you can also have a look at what other arguments
gpg takes by typing:
well good luck
|
|
|
|
| Read only linux |
|
Posted by: AndyC - 2005-04-28, 11:03 AM - Forum: Filesystem Management
- Replies (3)
|
|
Hi All
An utter noob to Linux I now have a mini itx pc to build. I am going to be installing it in my car and it will have a 8" touch screen. I need it to do the following:
1 play Mp3's
2 play the odd dvd/divx
3 work as a sat nav system (http://www.directions.ltd.uk/)
Now because of speed and shock resistance I have the following storage devices:
IDE- to compact flash converter + 512mb CF
20gb 2.5 hdd
DVDr / CDr/rw drive
I want to install Linux to the CF and make it read only as this apparently stops the CF from breaking down over time with use. the other thing i would like to do is get it so that the MP3 file that is being played (+ the next one ideally) are played form ram and not the hard disk, while the HDD isnt in use I'd like it to self park so that when i hit those big potholes the hdd doesn't get damaged by the shock.
Interface wise I've used KDE and Gnome so I'm happy with either of them. I have a suse 9.3 DVD here but will go with what ever people feel is best! I will have to install samba as I need to copy multimedia to the HDD from time to time.
Can any one help?
Thanks
Andy
|
|
|
|
| Partitioning two hd's |
|
Posted by: K0K0NUT_h3lmut - 2005-04-27, 09:00 PM - Forum: Filesystem Management
- Replies (9)
|
|
I've tried to install Fedora Core3 but I'm having trouble with the partitioning and boot-loader. I want to install it on my hard drive with Windows XP on it, but I also want to reserve some storage on the other, bigger hard-drive. I also don't want windows to boot automatically, I want to choose which one to boot from a menu. Please help me into the linux community, I'm learning C++ and would like to be able to contribute oneday. :)
|
|
|
|
| Partition Info |
|
Posted by: NaMu - 2005-04-25, 08:20 PM - Forum: Fedora
- Replies (2)
|
|
I want to install FC3 on a partition but i need some more info.
1)Size
2)Label
3)Logical or Primary?
4)File System Tpe
5)Drive Letter
Thanks
-Namu
|
|
|
|
| apm + klaptop |
|
Posted by: KobrAs - 2005-04-25, 07:32 AM - Forum: How Do I?
- Replies (8)
|
 |
Hello,
I can get apm to work either klaptop. The problem is that apm and klaptop shows always im connected to AC, even if i remove the AC cable from the laptop.
/proc/apm says :
# cat /proc/apm
1.16ac 1.2 0x03 0x01 0xff 0x80 -1% -1 ?
and apm -v -d says :
# apm -v -d
APM BIOS 1.2 (kernel driver 1.16ac)
AC on-line, no system battery
Using device 0x0a86, 1.16ac: 1.2
APM Flags = 0x03; AC Line Status = 0x01
Battery Status = 0xff; Battery Flags = 0x80
Battery %age = -1; Battery Time = -1, use_mins=0
Anyone has an ideea ?
01:33.45 < KobrAs> i forgot there to say, its fc3 that im using
|
|
|
|
| congrats to miss_lia ! |
|
Posted by: anyweb - 2005-04-24, 03:44 PM - Forum: General Chat
- Replies (21)
|
 |
hi all,
this morning at 6:32am Miss_lia gave birth to our third son, Benjamin
he's 4650 gr and 53 centimetres in length and he's beautiful
we now have 3 beautiful boys, Christopher, Sebastian and Benjamin
more info about Benjamins birth and his pic here
[/url][url=http://www.helsingborgslasarett.se/medicin...ec80009541.html]http://www.helsingborgslasarett.se/medicin...ec80009541.html
well done to miss_lia and she's doing just fine, but we are both tired i tell ya ;)
cheers
anyweb (proud dad for the third time)
|
|
|
|
| Problem with Battery Icon |
|
Posted by: gnj - 2005-04-24, 07:17 AM - Forum: Fedora
- Replies (1)
|
|
I have recently installed Fedora Core 3 on my presario 2100 notebook. It works however it's not accurate. Sometimes the gnome panel wont tell me if it's charging untill I reboot, also If I take out my AC when the battery is fully charged the icon stays at 100 % until I reboot or log out. Can someone help me?
|
|
|
|
|
