• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 307
  • Last Modified:

ipchains and ipmasqadm quickie

Ok I have an ipchains firewall script that is called from the ip-up script (PPP connection). Within this ipchains script I wish to forward any ftp and telnet requests coming in to the ppp0 device to another machine within the ineternal  network - say 192.168.0.2

What I need to know is what is the rule I should use for ipchains, I have this so far...  (I don't have the script with me at the mo so I am trying to remember this from my head!!)....

<snip>
ipchains -A forward -p tcp -s $INTERNET -d $PPPIP telnet -j ACCEPT

#and the the ipmasqadm

<snip>
ipmasqadm portfw -a -P tcp -L $PPPIP 23 -R 192.168.0.12 23

is that right? Or does the ipchains -A command need to be forward and/or the -j command REDIRECT

The last bit is: Does packet forwarding just need to be on the gateway (PPP machine) or all computers within the internal network?

Cheers

Anewbis_
0
Anewbis_
Asked:
Anewbis_
  • 3
  • 2
1 Solution
 
Anewbis_Author Commented:
Ooops forgot a bit! on the ipchains rule can the -j option be DENY as it is going to get forwarded to another machine or would it have to be ACCEPT? I do not want anyone from outside to be able to telnet to the firewall box itself - hence the port redirection ;-)

Cheers
0
 
liyangCommented:
Assuming your internal machine can send packets out at will, and your firewall machine will ACCEPT (*not* FORWARD!) packets on port 23, then all you need is:

ipmasqadm portfw -a -P tcp -L $PPPIP 23 -R 192.168.0.12 23

hth
/Liyang
0
 
Anewbis_Author Commented:
Answer accepted
0
 
Anewbis_Author Commented:
Cheers! It works! Except FTP seems to hang on LIST/GET/DIR commands - any ideas on that?
0
 
liyangCommented:
Have you done "modprobe ip_masq_ftp"? You'll need that in order to do active ftp from the inside. Place it in your rc.local script so it gets run at startup. Passive ftp should work either way, provided you don't restrict any outgoing connections.

hth
/Liyang

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now