Hi folks,


Ubuntu 7.04 server amd64
VMware
router IP address - 192.168.0.10


I'm building a virtual machine with Ubuntu as Host OS and playing round on following packages;
- denyhosts
- sshd
- iptables

with following files edited;

1)
/etc/hosts.allow
Code:
sshd: 127.0.0.1

# Domain
sshd: .mydomain.com

# myISP from home
sshd: *.myISP
/etc/hosts.deny
Code:
sshd:ALL EXCEPT localhost \
: spawn /bin/echo `/bin/date` access denied for %a %h>>/var/log/sshd.log

ALL: ALL
$ sudo /etc/init.d/denyhosts start


2)
/etc/ssh/sshd_config
uncomment following line and change "no" to "yes"
# PasswordAuthentication yes

uncomment following line and change "0.0.0.0" to "192.168.0.10"
# ListenAddress 0.0.0.0

…where 192.168.0.10 is the IP of the management network interface (server's router IP address) so that ssh daemon will not listen on the NICs dedicated to the VMs.

Then run;
$ sudo /etc/init.d/ssh restart


3)
Copy following file on /etc/rc.local
Code:
#
# INPUT
#

# allow all incoming traffic from the management interface NIC
# as long as it is a part of an established connection
iptables -I INPUT 1 -j ACCEPT -d MGMT_NIC_IP -m state --state RELATED,ESTABLISHED

# allow all ssh traffic to the management interface NIC
iptables -I INPUT 2 -j ACCEPT -p TCP -d MGMT_NIC_IP --destination-port 22

# allow all VMware MUI HTTP traffic to the management interface NIC
iptables -I INPUT 3 -j ACCEPT -p TCP -d MGMT_NIC_IP --destination-port 8222

# allow all VMware MUI HTTPS traffic to the management interface NIC
iptables -I INPUT 4 -j ACCEPT -p TCP -d MGMT_NIC_IP --destination-port 8333

# allow all VMware Authorization Daemon traffic to the management interface NIC
iptables -I INPUT 5 -j ACCEPT -p TCP -d MGMT_NIC_IP --destination-port 902

# reject all other traffic to the management interface NIC
iptables -I INPUT 6 -j REJECT -d MGMT_NIC_IP --reject-with icmp-port-unreachable


#
# OUTPUT
#

# allow all outgoing traffic from the management interface NIC
# if it is a part of an established connection
iptables -I OUTPUT 1 -j ACCEPT -s MGMT_NIC_IP -m state --state RELATED,ESTABLISHED

# allow all DNS queries from the management interface NIC
iptables -I OUTPUT 2 -j ACCEPT -s MGMT_NIC_IP -p UDP --destination-port 53

# reject all other traffic from localhost
iptables -I OUTPUT 3 -j REJECT -s 127.0.0.1 --reject-with icmp-port-unreachable

# reject all other traffic from the management interface NIC
iptables -I OUTPUT 4 -j REJECT -s MGMT_NIC_IP --reject-with icmp-port-unreachable
and change "MGMT_NIC_IP" to "192.168.0.10"

Then run;
$ sudo /etc/init.d/rc.local start


Afterwards I can't browse Internet.

Then I run;

$ sudo /etc/init.d/denyhosts stop
$ sudo /etc/init.d/rc.local stop

and revert all files to their original states. Still I can't browse Internet.


Reboot PC. Internet connection works again.


My questions are;

a)
Whether I have to run;
Code:
sudo iptables -F
just run;
Code:
sudo /etc/rc.local stop
is not sufficient.


b)
Is changing "MGMT_NIC_IP" to "192.168.0.10" CORRECT ?


c)
If I have only ONE NIC, I don't need to uncomment following line and changeing "0.0.0.0" to "192.168.0.10"
# ListenAddress 0.0.0.0

???


d)
Whether I need adding follow to bottom of /etc/hosts.allow
Code:
ALL:CLIENT_HOSTNAME_1, CLIENT_HOSTNAME_2, CLIENT_IP_ADDRESS_1,
*.CLIENT.DOMAIN.COM
If for local network, whether adding IP addresses of the workstation as "CLIENT_HOSTNAME_1"

???


e)
Any advice on above files? What makes Internet connection not working?


TIA


B.R.
satimis