RE: MSN v/s Iptables !

[Glover George]

Title: MSN v/s Iptables !

I haven’t seen this, but also don’t know how it would work.  MSN encapsulates the local ip of the machine behind the firewall in the data packet.  And especially if this ip address is in the private ip range, iptables isn’t going to be able to handle it with out a packet mangling module.  Because the machine outside the firewall is going to try to connect to the ip address that was in the packet, not the source ip of the packet it came in on.  What you need is http://linux-igd.sourceforge.net.   Give that a try, don’t mean to plug other software on this list, but it is related, and as of yet this is the only clean way to do it.   Glover George Systems/Networks Administrator Gulf Sales & Supply, Inc. [EMAIL PROTECTED] (228)-762-0268   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Rajeev Jain Sent: Friday, June 21, 2002 5:26 PM To: '[EMAIL PROTECTED]' Subject: MSN v/s Iptables !   Hi, I read some document about allowing MSN voice using Iptables and setup the following commented ruleset in my firewall rules startup file. I did it manually too but didn't help. Could you please take a look at the ruleset below and advice me the correct order OR ruleset to allow MSN voice chat ? I would really appreciate your reply. Thanks Rajeev   $EXTIF=eth0=12.12.12.12 (Public IP) $INTIF=eth1=192.168.1.1 (Private IP of Router) # echo "   clearing any existing rules and setting default policy.." $IPTABLES -P INPUT ACCEPT $IPTABLES -F INPUT $IPTABLES -P OUTPUT ACCEPT $IPTABLES -F OUTPUT $IPTABLES -P FORWARD DROP $IPTABLES -F FORWARD $IPTABLES -t nat -F echo "   FWD: Allow all connections OUT and only existing and related ones IN" $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT $IPTABLES -A FORWARD -j LOG #echo " Allow MSN Messenger connection " #$IPTABLES -A FORWARD -p TCP --dport 1863 -j ACCEPT #$IPTABLES -A FORWARD -p TCP --dport 7801:7825 -j ACCEPT #$IPTABLES -A FORWARD -p TCP --dport 6891:6900 -j ACCEPT #$IPTABLES -A FORWARD -d 64.4.13.0/24 -j ACCEPT echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF" $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE echo -e "\nrc.firewall-2.4 v$FWVER done.\n"