Dave Nebinger schreef: >> I've been trying to build a simple firewall with a DMZ for a web >> server. > > > Dude, trying to use iptables directly was your first mistake. > > Take a spin out and look at shorewall (I'm sure others have different > recommendations). > > Shorewall will get you up and running in no time and will easily > handle the configuration stuff from your original post. > > Trying to manage such a complex config using iptables directly is > doomed to failure; any mistake in ordering of rules, etc., will break > your connectivity. Sticking with a tool like shorewall will > simplify rules maintenance and pose less of a problem when performing > updates later on. >
If you're trying to learn, James, there is something to be said for Dave's position; it's not as if the config files are going to disappear just because you used shorewall to write them with correct settings. It might be easier to understand how iptables works if you configure it through a system that will do it properly, *then* look at the configured rules and work out why they work (as opposed to what your self-made rules do), rather than wait to have a working configuration until you've understood iptables (which is apparently not really easy for most everybody). Holly -- gentoo-user@gentoo.org mailing list
