| Welcome, Guest |
You have to register before you can post on our site.
|
| Forum Statistics |
» Members: 5,235
» Latest member: pwcreator
» Forum threads: 4,030
» Forum posts: 16,405
Full Statistics
|
| Online Users |
There are currently 359 online users. » 0 Member(s) | 354 Guest(s) Applebot, Baidu, Bing, Google, Yandex
|
| Latest Threads |
Wi-Fi works for a few min...
Forum: Network Problems
Last Post: kabifff
2025-12-15, 12:57 AM
» Replies: 0
» Views: 61
|
How to install Archboot i...
Forum: Network Problems
Last Post: Meup
2025-05-13, 01:41 PM
» Replies: 0
» Views: 3,607
|
clear logs in smoothwall
Forum: Security and Firewalls
Last Post: amanda63
2024-03-10, 03:27 PM
» Replies: 8
» Views: 113,445
|
I cannot install RedHat 8...
Forum: Redhat
Last Post: hybrid
2023-11-11, 01:01 PM
» Replies: 1
» Views: 61,356
|
How things are done, usin...
Forum: Xorg Problems
Last Post: ross
2023-09-04, 09:03 AM
» Replies: 0
» Views: 4,969
|
Im back.....
Forum: Hello
Last Post: anyweb
2021-01-17, 11:36 AM
» Replies: 1
» Views: 8,643
|
add mp3 plugin to xmms in...
Forum: Fedora
Last Post: anyweb
2021-01-17, 11:30 AM
» Replies: 11
» Views: 46,042
|
Configuring VSFTPd Server
Forum: FTP Server
Last Post: Johnbaca
2020-10-14, 10:25 AM
» Replies: 32
» Views: 144,949
|
Wolf won't play sound!
Forum: Game Problems
Last Post: Guest
2020-10-03, 05:51 PM
» Replies: 1
» Views: 80,103
|
Using git + python
Forum: How Do I?
Last Post: Clueless puppy
2020-08-21, 04:37 PM
» Replies: 0
» Views: 62,842
|
|
|
| Rules for Dogs |
|
Posted by: P38 - 2005-04-30, 09:53 PM - Forum: Jokes
- No Replies
|
 |
15 RULES for Dogs
1. Dogs are never permitted in the house. The dog stays outside in a
specially built wooden compartment named, for very good reason, the dog
house.
2. Okay, the dog can enter the house, but only for short visits or if his
own house is under renovation.
3. Okay, the dog can stay in the house on a permanent basis, provided his
dog house can be sold in a yard sale to a rookie dog owner.
4. Inside the house, the dog is not allowed to run free and is confined
to a comfortable but secure metal cage.
5. Okay, the cage becomes part of a two-for-one deal along with the dog
house in the yard sale, and the dog can go wherever the hell he pleases.
6. The dog is never allowed on the furniture.
7. Okay, the dog can get on the old furniture but not the new furniture.
8. Okay, the dog can get up on the new furniture until it looks like the
old furniture and then we'll sell the whole damn works and buy new
furniture...upon which the dog will most definitely not be allowed.
9. The dog never sleeps on the bed. Period.
10. Okay, the dog can sleep at the foot of the bed.
11. Okay, the dog can sleep alongside you, but he's not allowed under the
covers.
12. Okay, the dog can sleep under the covers but not with his head on the
pillow.
13. Okay, the dog can sleep alongside you under the covers with his head
on the pillow, but if he snores he's got to leave the room.
14. Okay, the dog can sleep and snore and have nightmares in bed, but
he's not to come in and sleep on the couch in the TV room, where I am now
sleeping. That's just not fair.
15. The dog never gets listed on the census questionnaire as "primary
resident," even if it's true.
QUOTES (from the famous and otherwise)..........
"The reason a dog has so many friends is that he wags his tail instead of
his tongue." - Anonymous
"Don't accept your dog's admiration as conclusive evidence that you are
wonderful." -
Ann Landers
"If there are no dogs in Heaven, then when I die I want to go where they
went." -
Will Rogers
"There is no psychiatrist in the world like a puppy licking your face." -
Ben Williams
"A dog is the only thing on earth that loves you more than he loves
himself." -
Josh Billings
"The average dog is a nicer person than the average person." -
Andrew A. Rooney
"We give dogs time we can spare, space we can spare and love
we can spare. And in return, dogs give us their all. It's the best deal
man has ever made." - M. Facklam
"Dogs love their friends and bite their enemies, quite unlike people, who
are incapable of pure love and always have to mix love and hate." -
Sigmund Freud
"If I have any beliefs about immortality, it is that certain dogs I have
known will go to heaven, and very, very few persons." -
James Thurber
"I wonder what goes through his mind when he sees us peeing in his water
bowl." -
Penny Ward Moser
"A dog teaches a boy fidelity, perseverance, and to turn around three times
before lying down." - Robert Benchley
"I wonder if other dogs think poodles are members of a weird religious
cult." - Rita Rudner
"Dogs need to sniff the ground; it's how they keep abreast of current
events. The ground is a giant dog newspaper, containing all kinds of
late-breaking dog news items, which, if they are especially urgent, are
often continued in the next yard." - Dave Barry
"Anybody who doesn't know what soap tastes like never washed a dog." -
Franklin P. Jones
"My dog is worried about the economy because Alpo is up to $3.00 a can.
That's almost $21.00 in dog money." - Joe Weinstein
"Outside of a dog, a book is probably man's best friend; inside of a dog,
it's too dark to read." - Groucho Marx
"Ever consider what they must think of us? I mean, here we come back from
a grocery store with the most amazing haul -- chicken, pork, half a cow.
They must think we're the greatest hunters on earth!" - Anne Tyler
"Women and cats will do as they please, and men and dogs should relax and
get used to the idea." - Robert A. Heinlein
|
|
|
| WAR AVERTED BETWEEN IRELAND AND FRANCE |
|
Posted by: P38 - 2005-04-30, 09:46 PM - Forum: Jokes
- Replies (3)
|
 |
Jacques Chirac, the French Prime Minister, was sitting in his office wondering what kind of mischief he could perpetrate against the United States when his telephone rang.
"Hallo, Mr. Chirac!" a heavily accented voice said. "This is Paddy down at the Harp Pub in County Sligo, Ireland. I am ringing to inform ya that we are officially declaring war on ya!"
"Well, Paddy," Chirac replied, "this is indeed important news! How big is your army?"
"Right now," said Paddy, after a moment's calculation, "there is meself, me cousin Sean, me next door neighbor Seamus, and the entire dart team from the pub. That makes eight!"
Chirac paused. "I must tell you, Paddy, that I have one hundred thousand men in my army waiting to move on my command."
"Begorra!" said Paddy. "I'll have to ring ya back!"
Sure enough, the next day, Paddy called again. "Mr. Chirac, the war is still on. We have managed to get us some infantry equipment!"
"And what equipment would that be, Paddy?" Chirac asked.
"Well, we have two combines, a bulldozer, and Murphy's farm tractor." Chirac sighed, amused. "I must tell you, Paddy, that I have 6,000 tanks and 5,000 armored personnel carriers. Also, I've increased my army to one hundred fifty thousand since we last spoke."
"Saints preserve us!" said Paddy. "I'll have to get back to ya."
Sure enough, Paddy rang again the next day. "Mr. Chirac, the war is still on! We have managed to get ourselves airborne! We've modified Jackie McLaughlin's ultra-light with a coople of shotguns in the cockpit, and four boys from the Shamrock Pub have joined us as well!"
Chirac was silent for a minute and then cleared his throat. "I must tell you, Paddy, that I have 100 bombers and 200 fighter planes. My military complex is surrounded by laser-guided, surface-to-air missile sites. And since we last spoke, I've increased my army to two hundred thousand!"
"Begorra!" said Paddy. "Again I'll have to ring ya back."
Sure enough, Paddy called again the next day. "Top o' the mornin', Mr.Chirac! I am sorry to tell ya that we have had to call off the war."
"I'm sorry to hear that," said Chirac. "Why the sudden change of heart?"
"Well," said Paddy, "we've all had a long chat over a bunch of pints, and decided there's no way we can feed two hundred thousand prisoners."
|
|
|
| Another Example Firewall |
|
Posted by: P38 - 2005-04-30, 09:33 PM - Forum: Security and Firewalls
- No Replies
|
 |
Here is another firewall example for you to review and offer me suggestions on how I can make it better. Feel free to use it in your own machines if you like the way it looks.
To use this firewall, copy it to a file on your machine, remove this text down to the line that starts #!/bin/sh leaving. Chmod the file to 700 or some such so that it can only be run as root. Edit the file and change the IP address variables at the top of the file to match your system. Then, run the script you have created. The firewall should load without errors. If there are errors, you will need to determine their cause and clear them up before you go forward.
After the script has run, do a "/etc/init.d/iptables restart" in order to save the firewall to your systems iptables cache. You will not need to re-run this script until/unless you make changes to it.
Now, this firewall, as configured, has one external interface. The external interface has three static ip addresses assigned to it. On my system, the three addresses are each assigned to a separate apache virtual server for serving up three different domains.
The firewall box, in my configuration, runs a web server, a mail server and a ssh server. You will notice ports open for this in the firewall. You will also notice that it only allows connections, with the exception of the web server, to the "primary external" ip address. Connections to the other external addresses are blocked.
Most incoming traffic is subject to rate restrictions on incoming new connections. There are exceptions to this because some services are better run with the limitations, but the ability to rate limit incoming connections has proven beneficial over and over in keeping out the bad traffic.
I continue to experiment with this firewall so you may see a few entries commented out. As I try different things, this is how I temporarily turn off things that I am currently not using.
If you have questions about how something works, please post them. I learn every time I dig into iptables and I will be happy to try to help.
P38
Code: #!/bin/sh -x
################################################################################
###################################################
# EXTERNAL INTERFACE CONFIGURATION
INET_IP="1.1.1.1" # External Interface 1
INET_IP2="1.1.1.2" # External Interface 2
INET_IP3="1.1.1.3" # External Inferface 3
INET_IFACE="eth0+"
INET_BROADCAST="1.1.1.255"
################################################################################
###################################################
# LOCAL LAN
LAN0_IP="172.16.1.1" # Internal Interface 1
LAN0_IP_RANGE="172.16.1.0/24"
LAN0_IFACE="tun+"
LAN1_IP="172.16.2.1" # Internal Interface 2
LAN1_IP_RANGE="172.16.2.0/24"
LAN1_IFACE="eth1"
BOB="172.16.2.100" # Internal Machine with PCAnywhere Access
PCANYWHERE_PORT1="5631" # PCAnywhere port
PCANYWHERE_PORT2="5632" # PCAnywhere port
SAM="172.16.2.116" # Internal Game Machine that runs World of Warcraft
WOW_PORT1="3724" #
WOW_PORT2="6112" # World of Warcraft ports
WOW_PORT3="6881:6999" #
LAN2_IP="172.16.3.0" # Internal Interface 3
LAN2_IP_RANGE="172.16.3.0/24" #
LAN2_IFACE="eth2" #
################################################################################
###################################################
# LOCALHOST
LO_IFACE="lo"
LO_IP="127.0.0.1"
################################################################################
###################################################
# SET PATH to BINARIES
IPTABLES="/sbin/iptables"
MODPROBE="/sbin/modprobe"
DEPMOD="/sbin/depmod"
E="/bin/echo"
################################################################################
###################################################
# IP Ranges only used for internal networks.
MARTIN0="10.0.0.0/8"
MARTIN1="172.16.0.0/12"
MARTIN2="192.168.0.0/16"
MARTIN3="192.254.0.0/16"
################################################################################
###################################################
# MULTICAST
MULTICAST_RANGE="224.0.0.0/8"
################################################################################
###################################################
# MODULES
$DEPMOD -a
$MODPROBE ip_tables
$MODPROBE ip_conntrack
$MODPROBE iptable_filter
$MODPROBE iptable_mangle
$MODPROBE iptable_nat
$MODPROBE ipt_LOG
$MODPROBE ipt_limit
$MODPROBE ipt_state
$MODPROBE ipt_owner
$MODPROBE ipt_REJECT
$MODPROBE ipt_MASQUERADE
$MODPROBE ip_conntrack_ftp
$MODPROBE ip_conntrack_irc
$MODPROBE ip_nat_ftp
$MODPROBE ip_nat_irc
################################################################################
###################################################
# FLUSH and DELETE all existing rules
$E "0" > /proc/sys/net/ipv4/ip_forward
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F POSTROUTING
$IPTABLES -t nat -F PREROUTING
$IPTABLES -F bad_tcp_packets
$IPTABLES -X bad_tcp_packets
$IPTABLES -F tcp_packets
$IPTABLES -X tcp_packets
$IPTABLES -F udp_packets
$IPTABLES -X udp_packets
$IPTABLES -F icmp_packets
$IPTABLES -X icmp_packets
$IPTABLES -F allowed
$IPTABLES -F allowed_2
$IPTABLES -X allowed
$IPTABLES -X allowed_2
################################################################################
###################################################
# POLICIES
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
################################################################################
###################################################
# CREATE CHAINS
$IPTABLES -N bad_tcp_packets
$IPTABLES -N allowed
$IPTABLES -N allowed_2
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets
################################################################################
###################################################
# bad_tcp_packets chain
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:NEW_not_SYN] '
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
################################################################################
###################################################
# allowed chain (rate limits enforced)
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP --syn -m limit --limit 3/minute --limit-burst 3 -j ACCEPT
$IPTABLES -A allowed -p TCP -j LOG --log-level "NOTICE" --log-prefix '[DROP:RATE_LIMIT] '
$IPTABLES -A allowed -p TCP -j REJECT
################################################################################
###################################################
# allowed_2 chain (no rate limits)
$IPTABLES -A allowed_2 -p TCP --syn -j ACCEPT
$IPTABLES -A allowed_2 -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed_2 -p TCP -j LOG --log-level "NOTICE" --log-prefix '[DROP:NOT_ALLOWED] '
$IPTABLES -A allowed_2 -p TCP -j REJECT
################################################################################
###################################################
# tcp_packets chain
# less restricted TCP connection attempts (no rate limiting and no allow to any external interface)
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 25 -j allowed_2 # allow smtp
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed_2 # allow http
# restricted TCP connections (with rate limiting and restricted to primary external interface)
$IPTABLES -A tcp_packets -p TCP -s 0/0 -d $INET_IP --dport 22 -j allowed # allow ssh
$IPTABLES -A tcp_packets -p TCP -s 0/0 -d $INET_IP --dport 113 -j allowed # allow ident
$IPTABLES -A tcp_packets -p TCP -s 0/0 -d $INET_IP --dport 5000 -j allowed # allow openvpn
$IPTABLES -A tcp_packets -p TCP -s 0/0 -d $INET_IP --dport 6881:6999 -j ACCEPT # unrestricted access to ports bittorrent download/upload
$IPTABLES -A tcp_packets -p TCP -s 0/0 -d $INET_IP --dport 40000:40099 -j allowed # ports for ssh port forwarding and local irc dcc
# Drop Microsoft Packets (TCP) so they don't show up in the logs
$IPTABLES -A tcp_packets -p TCP -i $INET_IFACE --destination-port 135:139 -j DROP
$IPTABLES -A tcp_packets -p TCP -i $INET_IFACE --destination-port 445 -j DROP
# Drop and log the rest
$IPTABLES -A tcp_packets
$IPTABLES -A tcp_packets -p TCP -j LOG --log-level "NOTICE" --log-prefix '[DROP:TCP_PACKETS] '
$IPTABLES -A tcp_packets -p TCP -j REJECT --reject-with tcp-reset
################################################################################
###################################################
# UDP ports
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 123 -j ACCEPT # ntp
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 5000 -j ACCEPT # openssh
$IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 40000:40099 -j ACCEPT # used for ssh port forwarding
# Drop Microsoft Packets (UDP) so they don't show up in the firewall logs
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE --destination-port 135:139 -j DROP
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE --destination-port 67:68 -j DROP
# Drop and log the rest
$IPTABLES -A udp_packets -p UDP -j LOG --log-level "NOTICE" --log-prefix '[DROP:UDP_PACKETS] '
$IPTABLES -A udp_packets -p UDP -j REJECT
################################################################################
###################################################
# ICMP rules
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
# Drop and log the rest
$IPTABLES -A icmp_packets -p ICMP -j LOG --log-level "NOTICE" --log-prefix '[DROP:ICMP_PACKETS] '
$IPTABLES -A icmp_packets -p ICMP -j REJECT
################################################################################
###################################################
################################################################################
###################################################
# INPUT chain
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
# Allow DHCP from internal networks
$IPTABLES -A INPUT -p ALL -i $LAN0_IFACE -s 0.0.0.0/32 -j ACCEPT # allow for DHCP
$IPTABLES -A INPUT -p ALL -i $LAN1_IFACE -s 0.0.0.0/32 -j ACCEPT # allow for DHCP
$IPTABLES -A INPUT -p ALL -i $LAN2_IFACE -s 0.0.0.0/32 -j ACCEPT # allow for DHCP
# Internal Networks
$IPTABLES -A INPUT -p ALL -i $LAN0_IFACE -s $LAN0_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LAN1_IFACE -s $LAN1_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LAN2_IFACE -s $LAN2_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN0_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN1_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN2_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP2 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP3 -j ACCEPT
# Rules for denied IP or NETWORKs
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:SPOOF] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP2 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:SPOOF] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP3 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:SPOOF] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP2 -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $INET_IP3 -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN0 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:MARTIN_0] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN1 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:MARTIN_1] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN2 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:MARTIN_2] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN3 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:MARTIN_3] '
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN0 -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN1 -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN2 -j DROP
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s $MARTIN3 -j DROP
$IPTABLES -A INPUT -p ALL -i $LAN0_IFACE -s ! $LAN0_IP_RANGE -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:BAD_INTERNAL_IP0] '
$IPTABLES -A INPUT -p ALL -i $LAN1_IFACE -s ! $LAN1_IP_RANGE -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:BAD_INTERNAL_IP1] '
$IPTABLES -A INPUT -p ALL -i $LAN2_IFACE -s ! $LAN2_IP_RANGE -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:BAD_INTERNAL_IP2] '
$IPTABLES -A INPUT -p ALL -i $LAN0_IFACE -s ! $LAN0_IP_RANGE -j DROP
$IPTABLES -A INPUT -p ALL -i $LAN1_IFACE -s ! $LAN1_IP_RANGE -j DROP
$IPTABLES -A INPUT -p ALL -i $LAN2_IFACE -s ! $LAN2_IP_RANGE -j DROP
# Drop Multicast from the external network.
$IPTABLES -A INPUT -i $INET_IFACE -d $MULTICAST_RANGE -j REJECT
$IPTABLES -A INPUT -i $INET_IFACE -s $MULTICAST_RANGE -j REJECT
# Rules for incoming packets from the internet.
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $INET_IP2 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $INET_IP3 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
# Log weird packets that don't match the above.
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[ALERT!!] '
################################################################################
###################################################
################################################################################
###################################################
# FORWARD chain
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
# Accept the packets we actually want to forward
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $LAN0_IFACE -j ACCEPT
$IPTABLES -A FORWARD -i $LAN1_IFACE -j ACCEPT
$IPTABLES -A FORWARD -i $LAN2_IFACE -j ACCEPT
# Forward PCANYWHERE PORTS to BOB
# Port 5631/tcp (PCANYWHERE_PORT1)
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p tcp --dport $PCANYWHERE_PORT1 -m limit --limit 3/minute --limit-burst 3 -j ACCEPT
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p tcp --dport $PCANYWHERE_PORT1 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:PCA_FWD_RATE_LMT] '
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p tcp --dport $PCANYWHERE_PORT1 -j DROP
# Port 5632/udp (PCANYWHERE_PORT2)
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p tcp --dport $PCANYWHERE_PORT2 -m limit --limit 3/minute --limit-burst 3 -j ACCEPT
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p tcp --dport $PCANYWHERE_PORT2 -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:PCA_FWD_RATE_LMT] '
$IPTABLES -A FORWARD -i $INET_IFACE -d $BOB -p udp --dport $PCANYWHERE_PORT2 -j DROP
# WOW Ports
#$IPTABLES -A FORWARD -i $INET_IFACE -d $SAM -p tcp --dport $WOW_PORT1 -j ACCEPT
#$IPTABLES -A FORWARD -i $INET_IFACE -d $SAM -p tcp --dport $WOW_PORT2 -j ACCEPT
#$IPTABLES -A FORWARD -i $INET_IFACE -d $SAM -p tcp --dport $WOW_PORT3 -j ACCEPT
# Log weird packets that don't match the above.
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:FORWARD_PACKET_DIED] '
################################################################################
###################################################
################################################################################
###################################################
# OUTPUT chain
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN0_IP -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
################################################################################
###################################################
# Special OUTPUT rules to decide which IP's to allow.
$IPTABLES -A OUTPUT -p ALL -s $LAN1_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN2_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP2 -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP3 -j ACCEPT
################################################################################
###################################################
# Log weird packets that don't match the above.
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level "NOTICE" --log-prefix '[DROP:OUTPUT_PACKET_DIED] '
################################################################################
###################################################
################################################################################
###################################################
# NAT table
################################################################################
###################################################
# IP Forwarding and Network Address Translation
$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE -d $INET_IP --dport $PCANYWHERE_PORT1 -j DNAT --to-destination $BOB:$PCANYWHERE_PORT1
$IPTABLES -t nat -A PREROUTING -p udp -i $INET_IFACE -d $INET_IP --dport $PCANYWHERE_PORT2 -j DNAT --to-destination $BOB:$PCANYWHERE_PORT2
#$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE -d $INET_IP --dport $WOW_PORT1 -j DNAT --to-destination $SAM:$WOW_PORT1
#$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE -d $INET_IP --dport $WOW_PORT2 -j DNAT --to-destination $SAM:$WOW_PORT2
#$IPTABLES -t nat -A PREROUTING -p tcp -i $INET_IFACE -d $INET_IP --dport $WOW_PORT3 -j DNAT --to-destination $SAM:$WOW_PORT3
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP
################################################################################
###################################################
################################################################################
###################################################
$E "1" > /proc/sys/net/ipv4/ip_forward
|
|
|
| GnuPG Fedora Core 3 |
|
Posted by: xDamox - 2005-04-30, 05:11 PM - Forum: Security and Firewalls
- Replies (6)
|
 |
Well I though I would write a little tutorial on GnuPG encryption.
Quote:GnuPG is a complete and free replacement for PGP. Because it does not use the patented IDEA algorithm, it can be used without any restrictions. GnuPG is a RFC2440 (OpenPGP) compliant application.
The first step to using GnuPG is to generate a private and public key which will be used for
encrypting files/signing documents.
First create a .gnupg dir in your home directory as shown below:
This is the directory your public and private key will be stored. The next step is to create the
keys so type the command:
Once that command has been enter you will be prompted with:
Code: gpg (GnuPG) 1.2.6; Copyright (C) 2004 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.
Please select what kind of key you want:
(1) DSA and ElGamal (default)
(2) DSA (sign only)
(4) RSA (sign only)
Your selection?
if you will be encrypting file and signing files use DSA and ELGamal or if your just using
it to sign files choose DSA or RSA.
Once you have selected your key type you will then be presented with a screen asking
for a keysize as shown below:
Code: DSA keypair will have 1024 bits.
About to generate a new ELG-E keypair.
minimum keysize is 768 bits
default keysize is 1024 bits
highest suggested keysize is 2048 bits
What keysize do you want? (1024)
The keysize can be any depending on the file you want to encrypt/sign the keysize I settle for
is 4096 :)
if you do enter a keysize over 2048 you will be prompted with a message saying:
Code: Keysizes larger than 2048 are not suggested because
computations take REALLY long!
Are you sure that you want this keysize?
just type yes :)the next screen you will be prompted with is asking how long you want the
keys to last.
Code: Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0)
Then it will ask three more questions asking for your name etc.
Now that the key is created you will be able to encrypt files by issuing the following:
Code: gpg -e file_to_encrypt.txt
you can also add -a to armor the encryption. once that is do it will create a file called:
file_to_encrypt.txt.gpg or .asc thats about it you can also have a look at what other arguments
gpg takes by typing:
well good luck
|
|
|
| Read only linux |
|
Posted by: AndyC - 2005-04-28, 11:03 AM - Forum: Filesystem Management
- Replies (3)
|
 |
Hi All
An utter noob to Linux I now have a mini itx pc to build. I am going to be installing it in my car and it will have a 8" touch screen. I need it to do the following:
1 play Mp3's
2 play the odd dvd/divx
3 work as a sat nav system (http://www.directions.ltd.uk/)
Now because of speed and shock resistance I have the following storage devices:
IDE- to compact flash converter + 512mb CF
20gb 2.5 hdd
DVDr / CDr/rw drive
I want to install Linux to the CF and make it read only as this apparently stops the CF from breaking down over time with use. the other thing i would like to do is get it so that the MP3 file that is being played (+ the next one ideally) are played form ram and not the hard disk, while the HDD isnt in use I'd like it to self park so that when i hit those big potholes the hdd doesn't get damaged by the shock.
Interface wise I've used KDE and Gnome so I'm happy with either of them. I have a suse 9.3 DVD here but will go with what ever people feel is best! I will have to install samba as I need to copy multimedia to the HDD from time to time.
Can any one help?
Thanks
Andy
|
|
|
| Partitioning two hd's |
|
Posted by: K0K0NUT_h3lmut - 2005-04-27, 09:00 PM - Forum: Filesystem Management
- Replies (9)
|
 |
I've tried to install Fedora Core3 but I'm having trouble with the partitioning and boot-loader. I want to install it on my hard drive with Windows XP on it, but I also want to reserve some storage on the other, bigger hard-drive. I also don't want windows to boot automatically, I want to choose which one to boot from a menu. Please help me into the linux community, I'm learning C++ and would like to be able to contribute oneday. :)
|
|
|
| Partition Info |
|
Posted by: NaMu - 2005-04-25, 08:20 PM - Forum: Fedora
- Replies (2)
|
 |
I want to install FC3 on a partition but i need some more info.
1)Size
2)Label
3)Logical or Primary?
4)File System Tpe
5)Drive Letter
Thanks
-Namu
|
|
|
| apm + klaptop |
|
Posted by: KobrAs - 2005-04-25, 07:32 AM - Forum: How Do I?
- Replies (8)
|
 |
Hello,
I can get apm to work either klaptop. The problem is that apm and klaptop shows always im connected to AC, even if i remove the AC cable from the laptop.
/proc/apm says :
# cat /proc/apm
1.16ac 1.2 0x03 0x01 0xff 0x80 -1% -1 ?
and apm -v -d says :
# apm -v -d
APM BIOS 1.2 (kernel driver 1.16ac)
AC on-line, no system battery
Using device 0x0a86, 1.16ac: 1.2
APM Flags = 0x03; AC Line Status = 0x01
Battery Status = 0xff; Battery Flags = 0x80
Battery %age = -1; Battery Time = -1, use_mins=0
Anyone has an ideea ?
01:33.45 < KobrAs> i forgot there to say, its fc3 that im using
|
|
|
| congrats to miss_lia ! |
|
Posted by: anyweb - 2005-04-24, 03:44 PM - Forum: General Chat
- Replies (21)
|
 |
hi all,
this morning at 6:32am Miss_lia gave birth to our third son, Benjamin
he's 4650 gr and 53 centimetres in length and he's beautiful
we now have 3 beautiful boys, Christopher, Sebastian and Benjamin
more info about Benjamins birth and his pic here
[/url][url=http://www.helsingborgslasarett.se/medicin...ec80009541.html]http://www.helsingborgslasarett.se/medicin...ec80009541.html
well done to miss_lia and she's doing just fine, but we are both tired i tell ya ;)
cheers
anyweb (proud dad for the third time)
|
|
|
|