Newsgroup: it.comp.os.linux.sys
Titolo: Snat !!!

Spero d non essere OT
Ho visto vari esempi di configurazione ma tutti basati sulle connessioni
internet !!!
Quello che sto cercado di fare è una connessione lan to lan verso un server
web !!
E solo su quello !!!!! tutto il resto del traffico deve essere scartato !!
altrimenti pago inutilmente
mi spiego con il caso
(Client winzoz )172.16.1.x
[172.16.1.50 <-(floppyfw)-> 192.168.50.50]
[Router 192.168.50.200]
[Server web 10.5.1.1]
Ciao Cirò

 Ciao Cirņ
Scusa la franchezza, ma non ci ho capito una mazza :-P
Che diamine vuol dire "una connessione lan to lan verso un server web",
visto che un server web *non* č una lan?!?!?
e mi spieghi la differenza tra una configurazione "basata sulla
connessione internet" e un'altra?
'ao...
-- 
Emanuele Balla  aka Skull -  Public Key #661E5CBF on 
www.keyserver.com
+----------------------------------------------------------------------+
"And 1.1.81 is officially BugFree(tm), so if you receive any bug-reports
on it, you know they are just evil lies." (By Linus Torvalds)

[CUT]
Fai bene a essere franco !!!
e che ogni tanto faccio fatica pure io a capirmi !!
Vediamo se ci riesco !!
ho due lan collegate via adsl (pagamento a traffico)
dalla lan (A) (gateway impostato a 172.46.1.50) devo aprire delle sessioni
terminal su un server nella LAN (B).
Quello che che vorrei capire è come faccio a fermare tutto il traffico
inutile sulla scheda interna di floppyfw
[172.16.1.50 <-(floppyfw)-> 192.168.50.50]
Mi rispiego:
Se la mia richiesta va verso 10.5.1.1 passa
altrimenti blocca tutto
Ciao Cirò
Confusionario e mi sa un poco incompetente in linux!!
Abbiate pietà di me !!

 altrimenti blocca tutto
questa è comprensibile, ma non capisco il senso dello snat che hai messo
in subj nè chi dovrebbe essere 10.5.1.1...
se devi bloccare del traffico passante attraverso il tuo firewall, la
chain che devi manipolare è quella di forward:
iptables -P FORWARD DROP
( ovvero non far passare nulla che non sia accettato esplicitamente)
iptables -A FORWARD -i <interfaccia interna> -d 10.5.1.1 -j ACCEPT
(accetta quello che viene da dentro e deve andare a 10.5.1.1)
Ma lo snat?


(accetta quello che viene da dentro e deve andare a 10.5.1.1)
chiaro !!
Quindi la mia conf deve essere questa !!!
#!/bin/sh
# Firewall setup.
#
# This is a conversion of the ipchains/ipmasqadm based firewall.ini
# from the 1.x series of floppyfw, it's pretty simple and the
# corresponding ipchains rules are kept for references.
#
# Setting up iptables
#
. /etc/config
#
# Do you want to do port forwaring to an internal server?
# Set the server IP here and sort out the port stuff later in this file.
#
SERVER_IP=
#
# Stopping forwarding (this script may be run during normal uptime because
# for re-lease of HDCP or demand dialing / PPPoE.
#
echo "0" > /proc/sys/net/ipv4/ip_forward
#
# Overriding the /etc/config and adding additional information.
#
. /etc/
outside.info
. /etc/
inside.info
#
# Brad suggested this:
# And he suggested to check and maybe change the formatting.
# We'll do that later.
#
echo "Starting firewall with the following config:"
echo
echo " Inside Outside"
echo " Network: ${INSIDE_NETWORK} ${OUTSIDE_NETWORK}"
echo " Device: ${INSIDE_DEVICE} ${OUTSIDE_DEVICE}"
echo "IP Address: ${INSIDE_IP} ${OUTSIDE_IP}"
echo " Netmask: ${INSIDE_NETMASK} ${OUTSIDE_NETMASK}"
echo " Broadcast: ${INSIDE_BROADCAST} ${OUTSIDE_BROADCAST}"
echo " Gateway: [None Set] ${OUTSIDE_GATEWAY}"
echo
#
# Flushing the chains.
#
iptables -F
# iptables -t nat -F
# iptables -t mangle -F
# or:
for i in `cat /proc/net/ip_tables_names`; do iptables -F -t $i ; done
iptables -X
iptables -Z # zero all counters
#
# Policy for chains DROP everything
#
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#
# Good old masquerading.
#
iptables -t nat -A POSTROUTING -o ${OUTSIDE_DEVICE} -j MASQUERADE
#
# Keep state.
#
iptables -A FORWARD -m state --state NEW -i ${INSIDE_DEVICE} -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state NEW,INVALID -i ${OUTSIDE_DEVICE} -j
DROP
"modifica da inserire"
==========================================================================
iptables -A FORWARD -i ${INSIDE_DEVICE} -d 10.5.1.1 -j ACCEPT
==========================================================================
#
# This is mainly for PPPoE usage but it won't hurt anyway so we'll just
# keep it here.
#
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j
TCPMSS --clamp-mss-to-pmtu
#
# We don't like the NetBIOS and Samba leaking..
#
iptables -t nat -A PREROUTING -p TCP -i ${INSIDE_DEVICE} --dport 135:139 -j
DROP
iptables -t nat -A PREROUTING -p UDP -i ${INSIDE_DEVICE} --dport 137:139 -j
DROP
iptables -t nat -A PREROUTING -p TCP -i ${INSIDE_DEVICE} --dport 445 -j DROP
iptables -t nat -A PREROUTING -p UDP -i ${INSIDE_DEVICE} --dport 445 -j DROP
#
# We would like to ask for names from our floppyfw box
#
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# Ping and friends.
iptables -A OUTPUT -p icmp -j ACCEPT # to both sides.
iptables -A INPUT -p icmp -j ACCEPT
# And also, DHCP, but we can basically accept anything from the inside.
iptables -A INPUT -i ${INSIDE_DEVICE} -j ACCEPT
iptables -A OUTPUT -o ${INSIDE_DEVICE} -j ACCEPT
#
# If the user wants to have the fake identd running, the identd has to
# be able to answer.
#
if [ ${FAKEIDENT} ]
then
iptables -A INPUT -p TCP --dport 113 -i ${OUTSIDE_DEVICE} -j ACCEPT
else
iptables -A INPUT -p TCP --dport 113 -i ${OUTSIDE_DEVICE} -j
REJECT --reject-with tcp-reset
fi
#
# And, some attempt to get interactive sesions a bit more interactive
# under load:
#
iptables -A PREROUTING -t mangle -p tcp --sport ssh -j TOS --set-tos
Minimize-Delay
iptables -A PREROUTING -t mangle -p tcp --sport ftp -j TOS --set-tos
Minimize-Delay
iptables -A PREROUTING -t mangle -p tcp --sport ftp-data -j TOS --set-tos
Maximize-Throughput
#
# Finally, list what we have
#
#
iptables -L
# If broken DNS:
#iptables -L -n
#
# This enables dynamic IP address following
#
echo 7 > /proc/sys/net/ipv4/ip_dynaddr
#
# trying to stop some smurf attacks.
#
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
#
# Rules set, we can enable forwarding in the kernel.
#
echo "Enabling IP forwarding."
echo "1" > /proc/sys/net/ipv4/ip_forward

 Quindi la mia conf deve essere questa !!!
non l'ho letta tutta, ma mi pare plausibile...
hola!
