Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- ttx01.ttx-net.sk anywhere tcp flags:!FIN,SYN,RST,ACK/SYN
ACCEPT udp -- ttx01.ttx-net.sk anywhere
ACCEPT 0 -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere limit: avg 10/sec burst 5
DROP 0 -- anywhere 255.255.255.255
DROP 0 -- anywhere 10.10.10.255
DROP 0 -- BASE-ADDRESS.MCAST.NET/8 anywhere
DROP 0 -- anywhere BASE-ADDRESS.MCAST.NET/8
DROP 0 -- 255.255.255.255 anywhere
DROP 0 -- anywhere 0.0.0.0
DROP 0 -- anywhere anywhere state INVALID
LSI 0 -f anywhere anywhere limit: avg 10/min burst 5
INBOUND 0 -- anywhere anywhere
LOG_FILTER 0 -- anywhere anywhere
LOG 0 -- anywhere anywhere LOG level info prefix `Unknown Input'
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere limit: avg 10/sec burst 5
LOG_FILTER 0 -- anywhere anywhere
LOG 0 -- anywhere anywhere LOG level info prefix `Unknown Forward'
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- 10.10.10.57 ttx01.ttx-net.sk tcp dpt:domain
ACCEPT udp -- 10.10.10.57 ttx01.ttx-net.sk udp dpt:domain
ACCEPT 0 -- anywhere anywhere
DROP 0 -- BASE-ADDRESS.MCAST.NET/8 anywhere
DROP 0 -- anywhere BASE-ADDRESS.MCAST.NET/8
DROP 0 -- 255.255.255.255 anywhere
DROP 0 -- anywhere 0.0.0.0
DROP 0 -- anywhere anywhere state INVALID
OUTBOUND 0 -- anywhere anywhere
LOG_FILTER 0 -- anywhere anywhere
LOG 0 -- anywhere anywhere LOG level info prefix `Unknown Output'
Chain INBOUND (1 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere state RELATED,ESTABLISHED
LSI 0 -- anywhere anywhere
Chain LOG_FILTER (5 references)
target prot opt source destination
Chain LSI (2 references)
target prot opt source destination
LOG_FILTER 0 -- anywhere anywhere
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 1/sec burst 5 LOG level info prefix `Inbound '
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/RST limit: avg 1/sec burst 5 LOG level info prefix `Inbound '
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,ACK/RST
LOG icmp -- anywhere anywhere icmp echo-request limit: avg 1/sec burst 5 LOG level info prefix `Inbound '
DROP icmp -- anywhere anywhere icmp echo-request
LOG 0 -- anywhere anywhere limit: avg 5/sec burst 5 LOG level info prefix `Inbound '
DROP 0 -- anywhere anywhere
Chain LSO (0 references)
target prot opt source destination
LOG_FILTER 0 -- anywhere anywhere
LOG 0 -- anywhere anywhere limit: avg 5/sec burst 5 LOG level info prefix `Outbound '
REJECT 0 -- anywhere anywhere reject-with icmp-port-unreachable
Chain OUTBOUND (1 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT udp -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT 0 -- anywhere anywhere
firewall
mam ho pls dobre nastaveny?dakujem
Pre pridávanie komentárov sa musíte prihlásiť.
Chain INPUT (policy DROP 1100K packets, 115M bytes)
pkts bytes target prot opt in out source destination
141M 97G ACCEPT all -- !lo * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- !lo * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x17/0x02 state NEW
4579 275K ACCEPT all -- tun0 * 0.0.0.0/0 0.0.0.0/0
26438 12M ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * * 127.0.0.0/8 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 127.0.0.0/8
Chain FORWARD (policy ACCEPT 106M packets, 39G bytes)
pkts bytes target prot opt in out source destination
105 5488 DROP all -- * tun0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 94M packets, 8893M bytes)
pkts bytes target prot opt in out source destination
nestaci takto?
rucne to mas jednoduche, obvykle na desktop netreba ziadne kuzla, staci
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT a potom
seria prikazov iptables -A INPUT -p <protokol> [--dport <cielovy port>] -j ACCEPT pre porty, ktore chces povolit
ak nepotrebujes mat povolene ziadne porty dovnutra tak staci ten riadok so state a ako posledne iptables -P INPUT DROP
output a forward mozes nechat nevyplnene
viac man iptables
lime ma v podstate pravdu - v tvoj prospech bude, ked spoznas dalsie veci okolo lin...
ved aj o tom linux je, nie? (o spoznavani, objavovani, uceni sa...)