Linux Firewall Config 1

[Dimonet]

I have built a Fedora Core 2 box and I am running the firewall currently. I only have SSH/VNC/FTP allowed and I am not trusting my Interface card. So basically other than those three ports the system is totally locked down.

I would like to know if there is a way to tell th box that I trust all traffic from a particular subnet. Or alternatively if I can tell it that I trust all traffic from a particular host. I have done some reading and haven't found anything where I can say "Trust this IP" or "Trust this subnet".

If anyone could tell me how and in what file I could accomplish this I would appreciate it.

Thanks,
Dimo

 

[sleipnir214]

It's a simple matter of sending packets from your machine or subnet to the ACCEPT target.

For a single machine (assuming the single machine has an IP address of 10.10.10.10 and that your Linux machine's interface is eth0:

iptables -A INPUT -i eth0 -s 10.10.10.10 -j ACCEPT

For a subnet (assuming that you want to allow all machines from the 10.10.10.0 subnet 255.255.255.0 network in):

iptables -A INPUT -i eth0 -s 10.10.10.0/24 -j ACCEPT

or

iptables -A INPUT -i eth0 -s 10.10.10.0/255.255.255.0 -j ACCEPT



Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[Dimonet]

Thanks so much for the tip. I only have one more question. When you perform this command what file is it writing to. Are there multiple files the firewall reads or just one?

Thanks,
Dimo

 

[sleipnir214]

The examples I've given are run from the command-line.

What I generally do is create a bash script containing the iptables commands to configure the firewall, then have the init system run the script at boot.




Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[thedaver]

Prefab scripts are often useful if you're not comfortable hacking IPTables code

Jay's Firewall

http://firewall-jay.sf.net/

Monmotha's Firewall script

http://monmotha.mplug.org/firewall/index.php

Surfinbox.com Business Internet Services - National Dialup, DSL, T-1 and more.

http://www.surfinbox.com/business/

 

[rpearson]

What he said....

 

[ericbrunson]

Dude, check out fwbuilder on source forge. It rocks for generating complex firewall configs.