> My iptables is the default per F14 installation: > +++ > # Generated by iptables-save v1.4.9 on Tue Aug 16 22:13:30 2011 > # Used command "iptables-save > iptables_F14_ORIGINAL_yoyo" > *filter > > :INPUT ACCEPT [0:0] > :FORWARD ACCEPT [0:0] > :OUTPUT ACCEPT [9950:627381] >
iptables entries are processed in the order found... > -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT Above line jumps to "ACCEPT" for any packet with an established connection. > -A INPUT -p icmp -j ACCEPT Above line jumps to "ACCEPT" for any icmp packet. > -A INPUT -i lo -j ACCEPT Above line jumps to "ACCEPT" for any packet from the loopback interface. > -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT Above line jumps to "ACCEPT" for any ssh packet establishing a new connection. May I suggest inserting an entry, at this spot, for mail, something like the following. -A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT The goal of the previous line is to jump to "ACCEPT" for any mail packet establishing a new connection. Instead of the above line, you might want to specify a source IP address range to limit which IP addresses can send mail to your machine. -A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -s 192.168.2.0/24 -j ACCEPT The goal of -s 192.168.2.0/24, in the above line, is to only accept incoming connections to port 25 (the default smtp port), if the source IP address of the packet is in the range 192.168.2.0 - 192.168.2.255. > -A INPUT -j REJECT --reject-with icmp-host-prohibited Above line jumps to "REJECT" for any packet destined to the host. As I said the order of entries is important. > -A FORWARD -j REJECT --reject-with icmp-host-prohibited Above line jumps to "REJECT" for any packet the host might forward. > COMMIT > # Completed on Tue Aug 16 22:13:30 2011 > +++ > I apologize for not reading your original message and going off on a telnet/ssh tangent in a previous email. -- users mailing list [email protected] To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
