Results 1 to 3 of 3
I recently built a new linux box running ubuntu 9.04 on an Asus eeebox. So far everything works great, but I am having an issue setting up my iptables rules. ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
- 06-02-2009 #1
- Join Date
- Jun 2009
I recently built a new linux box running ubuntu 9.04 on an Asus eeebox. So far everything works great, but I am having an issue setting up my iptables rules. What I am trying to do is only allow bittorrent traffic over my vpn connection ppp0. I have created a rule to drop all bittorrent traffic over eth0 and allow all bittorrent traffic over ppp0. Currently my script is not blocking the eth0 connection, so I am still able to download over eth0. Here is my iptables script. I hope someone can look at it a tell me what I have done wrong or what I am missing. Thanks in advance for all the help
#!/bin/bash # Remove all rules and chains iptables -F iptables -X # first set the default behaviour => accept connections iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT # Allow ESTABLISHED and RELATED incoming connection iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow loopback traffic iptables -A INPUT -i lo -j ACCEPT # DROP all forward packets, I don't share this internet connection iptables -A FORWARD -j DROP # Drop all Bittorrent packets going over eth0 iptables -A OUTPUT -o eth0 -p tcp -m multiport --dport 6881:6999 -j DROP # Allow all Bittorent traffic going over vpn connection pp0 iptables -A OUTPUT -o ppp0 -p tcp -m multiport --dport 6881:6999 -j ACCEPT # End message echo " [iptables rules are set]"
- 06-03-2009 #2
The problem here is that you're attempting to filter traffic the wrong way around. Your packets will be _received_ on 6881:6999 rather than sent. Change OUTPUT to INPUT and see if this works.
- 06-04-2009 #3
Where does eth0 connect?
Where does ppp0 connect?
Because your Policy is set to ACCEPT on all INPUT, OUTPUT and FORWARD the following rules are redundant;
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o ppp0 -p tcp -m multiport --dport 6881:6999 -j ACCEPT
You are thinking sdrawkcabssa!
You should be blocking everything and only allowing in what you want in or out. As to the other posters comment about switching OUTPUT and INPUT it doesn't matter as you are accepting everything anyway.
This TUTORIAL is a starting place and has examples in it.
The adventure of a life time.
Linux User #296285