Text 12814, 103 rader
Skriven 2009-06-15 17:52:10 av WAYNE CHIRNSIDE (1:123/140)
     Kommentar till en text av MARTIN ATKINS
Ärende: firewalls
=================
-> -=> WAYNE CHIRNSIDE wrote to MARTIN ATKINS <=-
-> 
->  -> --=> WAYNE CHIRNSIDE wrote to MARTIN ATKINS <=-
->  ->
->  ->  ->  WC> http://projectfiles.com/firewall/
->  ->  ->  WC> Copyright (C) 2001-2003 Scott Bartlett
<srb@mnsolutions.com>
->  ->  WC> -
->  ->
->  ->  WC> You know I've figured out a strategy that just might work.
->  ->  WC> Using comments to altering ACCEPT to drop in one line
->  ->  WC> in your original script.
->  ->
->  -> If the rest of the script works, then yes you can do that. When I
wrote
->  -> the script I delberatly kept simple but rock solid for our kind of
set
-> .
-> 
->  WC> No, your script bombs entirely in Slack 12.2.
->  WC> What I meant is to use your script where you comment to the fact of
how
->  WC> to either reject or accept pings in the last four lines or so.
-> 
->  "Bombs entirely" is not a very helpful description. There could be a
number
->  of things that lead to failure. We will have to be methodical
especially as

It's not a problem with your script but the syntax of iptables
has radically changed as Maurice Kinal first pointed out to me.

->  we are both using different systems. I have already seen one reason
your cable
->  connect will fail but we deal with that later.

Not a problem as the cable connnection does work.
I've tested it at www.grc.com (Shields Up)
and all that failes is the ping is returned which I wish to do away with.

Don't spend much time on this Martin as I've already downloaded
Slack 10.2 which DOES work with your script after I'd made some ( 13 or so)
modifications none of which were too challenging.
  
->  I need to know where your firewall script is being called from. Is it
something
->  like /etc/firewall.conf?

|Xactly.

->  
->  I want to try and write some simple scripts so firewalls can be called,
->  dropped and cleared so when things go wrong you don't have to fiddle
around 
->  bringing up your working set up. The first thing we need to do is make
sure
-> the 
->  modules are loading. For the time being ponder this part of the script.
->  
-> #!/bin/sh/ 
-> 
-> # Load modules/
-> 
-> /sbin/modprobe ip_conntrack_ftp
-> /sbin/modprobe ip_tables
-> /sbin/modprobe ip_conntrack
-> /sbin/modprobe iptable_filter
-> /sbin/modprobe iptable_mangle
-> /sbin/modprobe iptable_nat
-> /sbin/modprobe ipt_LOG
-> /sbin/modprobe ipt_limit
-> /sbin/modprobe ipt_state
->  
->  You should be able to run this as a script without any problems why you
have
->  a working wall up. Note any errors.
->  
-> I noticed in you original post you had this as the first two lines.
-> 
-> /#!/bin/sh/ 
-> /# Load modules/
-> 
-> Any instances of the above will fail the script.
-> 
-> #!/bin/sh/ 
-> # Load modules
-> 
-> Is correct.
-> 
-> The first line invokes the shell and the second is a comment. So no more
of
-> this "/" where it is not required or the shell will be looking for a
directory.
 

Oh boy, you got me there I probably messed it up sometime
after I'd got overtired and exasperated.

I'll copy and paste the above kwrite saved as unix
and try it... tommorrow.
I'm beat
--- Platinum Xpress/Win/WINServer v3.0pr5
 * Origin: Doc's Place BBS Fido Since 1991 docsplace.tzo.com (1:123/140)