asked on

Can the firewall from linux (centOS 5) able to filter some of ip?

Dear Sir/Madam

I just install an linux (centOS 5) with oracle 11g.
When I setup the firewall of an linux (centOS 5), I have an question.
My question is can I set the firewall only able to be access from some of ip through the port 1521 to linux (centOS 5)?
(e.g.) the port 1521 only accessable from 192.168.0.1,192.168.0.2,192.168.0.3 to my oracle server (centOS 5), all the others are denied, will it possible?

Thanks
Francis SZE
Screenshot.png

http:// thevpn.guru

using command line execute

iptables -A INPUT --source 192.168.0.1 -p tcp --dport 1521 -j ACCEPT
iptables -A INPUT --source 192.168.0.2 -p tcp --dport 1521 -j ACCEPT
iptables -A INPUT --source 192.168.0.3 -p tcp --dport 1521 -j ACCEPT
iptables -A INPUT -p tcp --dport 1521 -j DROP

sonicefu

I think you can do this using ipchains

http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-fw.html

http:// thevpn.guru

that is iptables, ipchains are outdated.

SOLUTION

Kamran Arshad

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

http:// thevpn.guru

Has anyone read my comment..the first one ?

sonicefu

Important Commands
Commands.pdf

sonicefu

Alternative Method
If you are using managed switch, you can achieve this goal by configuring access-list

Kin Fat SZE

ASKER

Dear Sir/Madam

I would like to know if I only accept 192.168.123.x to access linux (centOS 5) through the port 1521.
The only things I sould do is as following?

After that, all finished?
After saved (/sbin/service iptables save), after reboot, I would have same setting as before?

 iptables -F
 iptables -P INPUT DROP
 iptables -P FORWARD DROP
 iptables -P OUTPUT ACCEPT
 iptables -A INPUT -i lo -j ACCEPT
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
 iptables -A INPUT -s 192.168.123.0/24 -p tcp --dport 1521 -j ACCEPT  
 /sbin/service iptables save

Open in new window

http:// thevpn.guru

yes however add

iptables -A INPUT -s -p tcp --dport 1521 -j DROP

if you change your default policy to ACCEPT in future time.

Kin Fat SZE

ASKER

So, I run following command once all done!?
Also, I would like to know what's meaning of 24 from the command line
iptables -A INPUT -s 192.168.123.0/<b>24</b> -p tcp --dport 1521 -j ACCEPT

 iptables -F
 iptables -P INPUT DROP
 iptables -P FORWARD DROP
 iptables -P OUTPUT ACCEPT
 iptables -A INPUT -i lo -j ACCEPT
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 iptables -A INPUT -i eth0 -j ACCEPT
 iptables -A INPUT -s 192.168.123.0/24 -p tcp --dport 1521 -j ACCEPT  # using standard slash notation
 iptables -A INPUT -s  -p tcp --dport 1521 -j DROP 
 
 /sbin/service iptables save

Open in new window

Kamran Arshad

24 shows the number of bits used as network. Your IP address is class C address which has by default 24 bits for network and 8 bits for host.

xxxxxxxx.xxxxxxxx.xxxxxxxx.hhhhhhhh

Where x are network bits.

ASKER CERTIFIED SOLUTION

http:// thevpn.guru

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

Kin Fat SZE

ASKER

Dear Sir/Madam

I would like to know the port number of samba?
Because I may need to share samba from the linux (centOS 5) to windows XP.

Thanks
Francis SZE

http:// thevpn.guru

netbios-ns      137/tcp                        # NETBIOS Name Service
netbios-ns      137/udp
netbios-dgm      138/tcp                        # NETBIOS Datagram Service
netbios-dgm      138/udp
netbios-ssn      139/tcp                        # NETBIOS session service
netbios-ssn      139/udp

http:// thevpn.guru

Hmm..and 445

Kin Fat SZE

ASKER

Dear sir/madam

Am I need to delete line7 "iptables -A INPUT -i eth0 -j ACCEPT"?

Is the following to open samba for anothers computer?

netbios-ns 137/tcp # NETBIOS Name Service
netbios-ns 137/udp
netbios-dgm 138/tcp # NETBIOS Datagram Service
netbios-dgm 138/udp
netbios-ssn 139/tcp # NETBIOS session service
netbios-ssn 139/udp

Manay Thanks
Francis SZE

Kin Fat SZE

ASKER

Dear sir/madam

I had input command as below , But the samba is not work fine.
anyone can help me!?

Many Thanks
Francis SZE

 iptables -F
 iptables -P INPUT DROP
 iptables -P FORWARD DROP
 iptables -P OUTPUT ACCEPT
 iptables -A INPUT -i lo -j ACCEPT
 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 
 iptables -A INPUT -s 192.168.123.0/24 -p tcp --dport 1521 -j ACCEPT  
 iptables -A INPUT -s 192.168.123.0/24 -p tcp --dport 445 -j ACCEPT  
 
 /sbin/service iptables save

Open in new window

access.PNG

Kin Fat SZE

ASKER

iptables -F
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -s 192.168.123.0/24 -p tcp --dport 1521 -j ACCEPT
iptables -A INPUT -s 192.168.123.0/24 -p tcp --dport 445 -j ACCEPT

iptables -A INPUT -s 192.168.123.0/24 -p tcp --dport 137 -j ACCEPT
iptables -A INPUT -s 192.168.123.0/24 -p tcp --dport 138 -j ACCEPT
iptables -A INPUT -s 192.168.123.0/24 -p tcp --dport 139 -j ACCEPT
iptables -A INPUT -s 192.168.123.0/24 -p udp --dport 137 -j ACCEPT
iptables -A INPUT -s 192.168.123.0/24 -p udp --dport 138 -j ACCEPT
iptables -A INPUT -s 192.168.123.0/24 -p udp --dport 139 -j ACCEPT

/sbin/service iptables save