On 8/29/2013 6:01 AM, Thomas Harold wrote: > On 8/28/2013 8:43 PM, Tom Eastep wrote: >> On 8/28/2013 4:43 PM, Tom Eastep wrote: >>> On 8/28/2013 3:44 PM, Thomas Harold wrote: >>> >>> Shorewall 4.5.4 Dump at fw2-sec - Wed Aug 28 18:31:52 EDT 2013 >>> ----- >>> >>> Support for /etc/shorewall/stoppedrules wasn't added until Shorewall >>> 4.5.8. In 4.5.8, you must use /etc/shorewall/routestopped. >>> >> >> In 4.5.4, you must use /etc/shorewall/routestopped. >> ----- > > Thanks for the heads-up. I'm not sure the following rules do exactly > what I was looking for, but the nmap testing shows those ports are open > when shorewall has been stopped. Goals met. > > Goals (when shorewall is stopped): > - Allow icmp (ping) from everywhere to the interface > - Allow tcp/22 only on the internal (bond0) interface > - Allow udp/123 only on the internal (bond0) interface > - Allow tcp/880 from everywhere > > /etc/shorewall/routestopped > > bond0 - - icmp > bond0 - - tcp 22 > bond0 - - udp 123 > bond0 - - tcp 880 > > want1 - source icmp > want1 - source tcp 880 > > wancbl - source icmp > wancbl - source tcp 880 > > Maybe not the cleanest looking iptables -L output, but it works:
iptables output when neither the -n nor the -v option is specified is really pretty useless. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Learn the latest--Visual Studio 2012, SharePoint 2013, SQL 2012, more! Discover the easy way to master current and previous Microsoft technologies and advance your career. Get an incredible 1,500+ hours of step-by-step tutorial videos with LearnDevNow. Subscribe today and save! http://pubads.g.doubleclick.net/gampad/clk?id=58040911&iu=/4140/ostg.clktrk
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
