[plug] Iptables Help - UDP

Timothy White weirdo at tigris.org
Fri Feb 4 11:07:52 WST 2005


My dad is trying to connect to the Alcoa VPN over an NATed Optus Dialup.
As far as I know it uses UDP and he tried too 2 different gateways.
Unfortunately it appears that the firewall (iptables) dropped the
packets. The following is my iptables config[2] with the appropriate
kernel/iptables log/drop messages[1].

I hope somebody can help me get this working.

Thanks

Tim

[1] (Please do not abuse the destination IP address
Feb  4 10:00:17 edo kernel: fp=UDP:2 a=DROP IN=eth0 OUT=ppp0
SRC=192.168.0.48 DST=203.38.101.24 LEN=850 TOS=0x00 PREC=0x00 TTL=127
ID=293 PROTO=UDP SPT=500 DPT=500 LEN=830
Feb  4 10:00:22 edo kernel: fp=UDP:2 a=DROP IN=eth0 OUT=ppp0
SRC=192.168.0.48 DST=203.38.101.24 LEN=850 TOS=0x00 PREC=0x00 TTL=127
ID=321 PROTO=UDP SPT=500 DPT=500 LEN=830
Feb  4 10:00:28 edo kernel: fp=UDP:2 a=DROP IN=eth0 OUT=ppp0
SRC=192.168.0.48 DST=203.38.101.24 LEN=850 TOS=0x00 PREC=0x00 TTL=127
ID=348 PROTO=UDP SPT=500 DPT=500 LEN=830
Feb  4 10:00:33 edo kernel: fp=UDP:2 a=DROP IN=eth0 OUT=ppp0
SRC=192.168.0.48 DST=203.38.101.24 LEN=850 TOS=0x00 PREC=0x00 TTL=127
ID=369 PROTO=UDP SPT=500 DPT=500 LEN=830
Feb  4 10:00:50 edo kernel: fp=UDP:2 a=DROP IN=eth0 OUT=ppp0
SRC=192.168.0.48 DST=159.111.2.251 LEN=849 TOS=0x00 PREC=0x00 TTL=127
ID=442 PROTO=UDP SPT=500 DPT=500 LEN=829
Feb  4 10:00:55 edo kernel: fp=UDP:2 a=DROP IN=eth0 OUT=ppp0
SRC=192.168.0.48 DST=159.111.2.251 LEN=849 TOS=0x00 PREC=0x00 TTL=127
ID=465 PROTO=UDP SPT=500 DPT=500 LEN=829
Feb  4 10:01:00 edo kernel: fp=UDP:2 a=DROP IN=eth0 OUT=ppp0
SRC=192.168.0.48 DST=159.111.2.251 LEN=849 TOS=0x00 PREC=0x00 TTL=127
ID=486 PROTO=UDP SPT=500 DPT=500 LEN=829
Feb  4 10:01:05 edo kernel: fp=UDP:2 a=DROP IN=eth0 OUT=ppp0
SRC=192.168.0.48 DST=159.111.2.251 LEN=849 TOS=0x00 PREC=0x00 TTL=127
ID=507 PROTO=UDP SPT=500 DPT=500 LEN=829

(These aren't from the same computer. From these it appears that
iptables is dropping UDP packets)
Feb  4 10:02:05 edo kernel: fp=UDP:2 a=DROP IN=eth0 OUT=ppp0
SRC=192.168.0.8 DST=210.188.237.146 LEN=76 TOS=0x10 PREC=0x00 TTL=63
ID=4544 DF PROTO=UDP SPT=123 DPT=123 LEN=56
Feb  4 10:02:22 edo kernel: fp=UDP:2 a=DROP IN=eth0 OUT=ppp0
SRC=192.168.0.8 DST=80.190.241.157 LEN=76 TOS=0x10 PREC=0x00 TTL=63
ID=4545 DF
PROTO=UDP SPT=123 DPT=123 LEN=56

[2] I hope this can be understood. If not, goto [3] which has the output
of iptables -L
/var/lib/iptables$ cat active
# Generated by iptables-save v1.2.11 on Tue Feb  1 15:00:28 2005
*mangle
:PREROUTING ACCEPT [269371:88468268]
:INPUT ACCEPT [247687:81991142]
:FORWARD ACCEPT [21591:6470542]
:OUTPUT ACCEPT [253968:138369419]
:POSTROUTING ACCEPT [276011:144958851]
COMMIT
# Completed on Tue Feb  1 15:00:28 2005
# Generated by iptables-save v1.2.11 on Tue Feb  1 15:00:28 2005
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:CHECKBADFLAG - [0:0]
:ICMPINBOUND - [0:0]
:ICMPOUTBOUND - [0:0]
:LBADFLAG - [0:0]
:LDROP - [0:0]
:LINVALID - [0:0]
:LPINGFLOOD - [0:0]
:LREJECT - [0:0]
:LSPECIALPORT - [0:0]
:LSYNFLOOD - [0:0]
:SPECIALPORTS - [0:0]
:TCPACCEPT - [0:0]
[0:0] -A INPUT -m state --state INVALID -j LINVALID
[239681:81134318] -A INPUT -p tcp -j CHECKBADFLAG
[5824:1040726] -A INPUT -i lo -j ACCEPT
[0:0] -A INPUT -d 127.0.0.0/255.0.0.0 -j LREJECT
[215608:46056600] -A INPUT -s 192.168.0.0/255.255.255.0 -i eth0 -j ACCEPT
[0:0] -A INPUT -s 192.168.0.0/255.255.255.0 -j LREJECT
[0:0] -A INPUT -i ppp0 -p icmp -j ICMPINBOUND
[0:0] -A INPUT -p udp -m udp --dport 33434:33523 -j LDROP
[83:4980] -A INPUT -i ppp0 -p tcp -m tcp --dport 113 -j REJECT
--reject-with tcp-reset
[26159:34884286] -A INPUT -i ppp0 -j SPECIALPORTS
[26075:34876957] -A INPUT -i ppp0 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i ppp0 -p tcp -m tcp --dport 1024:65535 -m state --state
RELATED -j TCPACCEPT
[0:0] -A INPUT -i ppp0 -p udp -m udp --dport 1024:65535 -m state --state
RELATED -j ACCEPT
[96:11801] -A INPUT -j LDROP
[0:0] -A FORWARD -o ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss
--mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
[0:0] -A FORWARD -m state --state INVALID -j LINVALID
[21537:6466630] -A FORWARD -p tcp -j CHECKBADFLAG
[10626:904463] -A FORWARD -s 192.168.0.0/255.255.255.0 -i eth0 -o ppp0
-p tcp -m tcp --sport 1024:65535 -j ACCEPT
[0:0] -A FORWARD -s 192.168.0.0/255.255.255.0 -i eth0 -o ppp0 -p udp -m
udp --sport 1024:65535 -j ACCEPT
[2:56] -A FORWARD -s 192.168.0.0/255.255.255.0 -i eth0 -o ppp0 -p icmp
-j ACCEPT
[10913:5562223] -A FORWARD -i ppp0 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -i ppp0 -p tcp -m tcp --dport 1024:65535 -m state
--state RELATED -j TCPACCEPT
[0:0] -A FORWARD -i ppp0 -p udp -m udp --dport 1024:65535 -m state
--state RELATED -j ACCEPT
[0:0] -A FORWARD -i ppp0 -p icmp -m state --state RELATED -j ACCEPT
[50:3800] -A FORWARD -j LDROP
[5824:1040726] -A OUTPUT -o lo -j ACCEPT
[223747:135755650] -A OUTPUT -d 192.168.0.0/255.255.255.0 -o eth0 -j ACCEPT
[0:0] -A OUTPUT -o ppp0 -p icmp -j ICMPOUTBOUND
[83:3320] -A OUTPUT -o ppp0 -p tcp -m tcp --sport 113 -j REJECT
--reject-with tcp-reset
[23316:1497955] -A OUTPUT -o ppp0 -p tcp -m tcp --sport 1024:65535 -j ACCEPT
[998:71768] -A OUTPUT -o ppp0 -p udp -m udp --sport 1024:65535 -j ACCEPT
[0:0] -A OUTPUT -j LDROP
[0:0] -A CHECKBADFLAG -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
FIN,PSH,URG -j LBADFLAG
[0:0] -A CHECKBADFLAG -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
FIN,SYN,RST,ACK,URG -j LBADFLAG
[0:0] -A CHECKBADFLAG -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
FIN,SYN,RST,PSH,ACK,URG -j LBADFLAG
[0:0] -A CHECKBADFLAG -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG
NONE -j LBADFLAG
[0:0] -A CHECKBADFLAG -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LBADFLAG
[0:0] -A CHECKBADFLAG -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j LBADFLAG
[0:0] -A ICMPINBOUND -p icmp -m icmp --icmp-type 8 -m limit --limit
5/sec --limit-burst 10 -j ACCEPT
[0:0] -A ICMPINBOUND -p icmp -m icmp --icmp-type 8 -j LPINGFLOOD
[0:0] -A ICMPINBOUND -p icmp -m icmp --icmp-type 5 -j LDROP
[0:0] -A ICMPINBOUND -p icmp -m icmp --icmp-type 13 -j LDROP
[0:0] -A ICMPINBOUND -p icmp -m icmp --icmp-type 14 -j LDROP
[0:0] -A ICMPINBOUND -p icmp -m icmp --icmp-type 17 -j LDROP
[0:0] -A ICMPINBOUND -p icmp -m icmp --icmp-type 18 -j LDROP
[0:0] -A ICMPINBOUND -p icmp -j ACCEPT
[0:0] -A ICMPOUTBOUND -p icmp -m icmp --icmp-type 5 -j LDROP
[0:0] -A ICMPOUTBOUND -p icmp -m icmp --icmp-type 11/0 -j LDROP
[0:0] -A ICMPOUTBOUND -p icmp -m icmp --icmp-type 11/1 -j LDROP
[0:0] -A ICMPOUTBOUND -p icmp -m icmp --icmp-type 12 -j LDROP
[0:0] -A ICMPOUTBOUND -p icmp -m icmp --icmp-type 13 -j LDROP
[0:0] -A ICMPOUTBOUND -p icmp -m icmp --icmp-type 14 -j LDROP
[0:0] -A ICMPOUTBOUND -p icmp -m icmp --icmp-type 17 -j LDROP
[0:0] -A ICMPOUTBOUND -p icmp -m icmp --icmp-type 18 -j LDROP
[0:0] -A ICMPOUTBOUND -p icmp -j ACCEPT
[0:0] -A LBADFLAG -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=BADFLAG:1 a=DROP "
[0:0] -A LBADFLAG -j DROP
[77:3680] -A LDROP -p tcp -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=TCP:1 a=DROP "
[69:11921] -A LDROP -p udp -m limit --limit 2/sec --limit-burst 10 -j
LOG --log-prefix "fp=UDP:2 a=DROP "
[0:0] -A LDROP -p icmp -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=ICMP:3 a=DROP "
[0:0] -A LDROP -f -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=FRAGMENT:4 a=DROP "
[146:15601] -A LDROP -j DROP
[0:0] -A LINVALID -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=INVALID:1 a=DROP "
[0:0] -A LINVALID -j DROP
[0:0] -A LPINGFLOOD -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=PINGFLOOD:1 a=DROP "
[0:0] -A LPINGFLOOD -j DROP
[0:0] -A LREJECT -p tcp -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=TCP:1 a=REJECT "
[0:0] -A LREJECT -p udp -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=UDP:2 a=REJECT "
[0:0] -A LREJECT -p icmp -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=ICMP:3 a=REJECT "
[0:0] -A LREJECT -f -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=FRAGMENT:4 a=REJECT "
[0:0] -A LREJECT -p tcp -j REJECT --reject-with tcp-reset
[0:0] -A LREJECT -p udp -j REJECT --reject-with icmp-port-unreachable
[0:0] -A LREJECT -j REJECT --reject-with icmp-port-unreachable
[0:0] -A LSPECIALPORT -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=SPECIALPORT:1 a=DROP "
[0:0] -A LSPECIALPORT -j DROP
[0:0] -A LSYNFLOOD -m limit --limit 2/sec --limit-burst 10 -j LOG
--log-prefix "fp=SYNFLOOD:1 a=DROP "
[0:0] -A LSYNFLOOD -j DROP
[0:0] -A SPECIALPORTS -p tcp -m tcp --dport 6670 -j LSPECIALPORT
[0:0] -A SPECIALPORTS -p tcp -m tcp --dport 1243 -j LSPECIALPORT
[0:0] -A SPECIALPORTS -p udp -m udp --dport 1243 -j LSPECIALPORT
[0:0] -A SPECIALPORTS -p tcp -m tcp --dport 27374 -j LSPECIALPORT
[0:0] -A SPECIALPORTS -p udp -m udp --dport 27374 -j LSPECIALPORT
[0:0] -A SPECIALPORTS -p tcp -m tcp --dport 6711:6713 -j LSPECIALPORT
[0:0] -A SPECIALPORTS -p tcp -m tcp --dport 12345:12346 -j LSPECIALPORT
[0:0] -A SPECIALPORTS -p tcp -m tcp --dport 20034 -j LSPECIALPORT
[0:0] -A SPECIALPORTS -p udp -m udp --dport 31337:31338 -j LSPECIALPORT
[0:0] -A SPECIALPORTS -p tcp -m tcp --dport 6000:6063 -j LSPECIALPORT
[0:0] -A SPECIALPORTS -p udp -m udp --dport 28431 -j LSPECIALPORT
[0:0] -A TCPACCEPT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m limit
--limit 5/sec --limit-burst 10 -j ACCEPT
[0:0] -A TCPACCEPT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j LSYNFLOOD
[0:0] -A TCPACCEPT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -j ACCEPT
COMMIT
# Completed on Tue Feb  1 15:00:28 2005
# Generated by iptables-save v1.2.11 on Tue Feb  1 15:00:28 2005
*nat
:PREROUTING ACCEPT [2148:192720]
:POSTROUTING ACCEPT [1021:110532]
:OUTPUT ACCEPT [1835:166355]
[176:10392] -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT
--to-ports 3128
[1347:85447] -A POSTROUTING -o ppp0 -j MASQUERADE
COMMIT
# Completed on Tue Feb  1 15:00:28 2005


[3]
$ sudo iptables -L (Go to bottom for NAT tables)
Chain INPUT (policy DROP)
target     prot opt source               destination
LINVALID   all  --  anywhere             anywhere            state INVALID
CHECKBADFLAG  tcp  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
LREJECT    all  --  anywhere             127.0.0.0/8
ACCEPT     all  --  localnet/24          anywhere
LREJECT    all  --  localnet/24          anywhere
ICMPINBOUND  icmp --  anywhere             anywhere
LDROP      udp  --  anywhere             anywhere            udp
dpts:33434:33523
REJECT     tcp  --  anywhere             anywhere            tcp
dpt:auth reject-with tcp-reset
SPECIALPORTS  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state
ESTABLISHED
TCPACCEPT  tcp  --  anywhere             anywhere            tcp
dpts:1024:65535 state RELATED
ACCEPT     udp  --  anywhere             anywhere            udp
dpts:1024:65535 state RELATED
LDROP      all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
TCPMSS     tcp  --  anywhere             anywhere            tcp
flags:SYN,RST/SYN tcpmss match 1400:1536 TCPMSS clamp to PMTU
LINVALID   all  --  anywhere             anywhere            state INVALID
CHECKBADFLAG  tcp  --  anywhere             anywhere
ACCEPT     tcp  --  localnet/24          anywhere            tcp
spts:1024:65535
ACCEPT     udp  --  localnet/24          anywhere            udp
spts:1024:65535
ACCEPT     icmp --  localnet/24          anywhere
ACCEPT     all  --  anywhere             anywhere            state
ESTABLISHED
TCPACCEPT  tcp  --  anywhere             anywhere            tcp
dpts:1024:65535 state RELATED
ACCEPT     udp  --  anywhere             anywhere            udp
dpts:1024:65535 state RELATED
ACCEPT     icmp --  anywhere             anywhere            state RELATED
LDROP      all  --  anywhere             anywhere

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             localnet/24
ICMPOUTBOUND  icmp --  anywhere             anywhere
REJECT     tcp  --  anywhere             anywhere            tcp
spt:auth reject-with tcp-reset
ACCEPT     tcp  --  anywhere             anywhere            tcp
spts:1024:65535
ACCEPT     udp  --  anywhere             anywhere            udp
spts:1024:65535
LDROP      all  --  anywhere             anywhere

Chain CHECKBADFLAG (2 references)
target     prot opt source               destination
LBADFLAG   tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
LBADFLAG   tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
LBADFLAG   tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
LBADFLAG   tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/NONE
LBADFLAG   tcp  --  anywhere             anywhere            tcp
flags:SYN,RST/SYN,RST
LBADFLAG   tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN/FIN,SYN

Chain ICMPINBOUND (1 references)
target     prot opt source               destination
ACCEPT     icmp --  anywhere             anywhere            icmp
echo-request limit: avg 5/sec burst 10
LPINGFLOOD  icmp --  anywhere             anywhere            icmp
echo-request
LDROP      icmp --  anywhere             anywhere            icmp redirect
LDROP      icmp --  anywhere             anywhere            icmp
timestamp-request
LDROP      icmp --  anywhere             anywhere            icmp
timestamp-reply
LDROP      icmp --  anywhere             anywhere            icmp
address-mask-request
LDROP      icmp --  anywhere             anywhere            icmp
address-mask-reply
ACCEPT     icmp --  anywhere             anywhere

Chain ICMPOUTBOUND (1 references)
target     prot opt source               destination
LDROP      icmp --  anywhere             anywhere            icmp redirect
LDROP      icmp --  anywhere             anywhere            icmp
ttl-zero-during-transit
LDROP      icmp --  anywhere             anywhere            icmp
ttl-zero-during-reassembly
LDROP      icmp --  anywhere             anywhere            icmp
parameter-problem
LDROP      icmp --  anywhere             anywhere            icmp
timestamp-request
LDROP      icmp --  anywhere             anywhere            icmp
timestamp-reply
LDROP      icmp --  anywhere             anywhere            icmp
address-mask-request
LDROP      icmp --  anywhere             anywhere            icmp
address-mask-reply
ACCEPT     icmp --  anywhere             anywhere

Chain LBADFLAG (6 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=BADFLAG:1 a=DROP '
DROP       all  --  anywhere             anywhere

Chain LDROP (17 references)
target     prot opt source               destination
LOG        tcp  --  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=TCP:1 a=DROP '
LOG        udp  --  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=UDP:2 a=DROP '
LOG        icmp --  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=ICMP:3 a=DROP '
LOG        all  -f  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=FRAGMENT:4 a=DROP '
DROP       all  --  anywhere             anywhere

Chain LINVALID (2 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=INVALID:1 a=DROP '
DROP       all  --  anywhere             anywhere

Chain LPINGFLOOD (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=PINGFLOOD:1 a=DROP '
DROP       all  --  anywhere             anywhere

Chain LREJECT (2 references)
target     prot opt source               destination
LOG        tcp  --  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=TCP:1 a=REJECT '
LOG        udp  --  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=UDP:2 a=REJECT '
LOG        icmp --  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=ICMP:3 a=REJECT '
LOG        all  -f  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=FRAGMENT:4 a=REJECT '
REJECT     tcp  --  anywhere             anywhere            reject-with
tcp-reset
REJECT     udp  --  anywhere             anywhere            reject-with
icmp-port-unreachable
REJECT     all  --  anywhere             anywhere            reject-with
icmp-port-unreachable

Chain LSPECIALPORT (11 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=SPECIALPORT:1 a=DROP '
DROP       all  --  anywhere             anywhere

Chain LSYNFLOOD (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            limit: avg
2/sec burst 10 LOG level warning prefix `fp=SYNFLOOD:1 a=DROP '
DROP       all  --  anywhere             anywhere

Chain SPECIALPORTS (1 references)
target     prot opt source               destination
LSPECIALPORT  tcp  --  anywhere             anywhere            tcp dpt:6670
LSPECIALPORT  tcp  --  anywhere             anywhere            tcp dpt:1243
LSPECIALPORT  udp  --  anywhere             anywhere            udp dpt:1243
LSPECIALPORT  tcp  --  anywhere             anywhere            tcp dpt:asp
LSPECIALPORT  udp  --  anywhere             anywhere            udp dpt:asp
LSPECIALPORT  tcp  --  anywhere             anywhere            tcp
dpts:6711:6713
LSPECIALPORT  tcp  --  anywhere             anywhere            tcp
dpts:12345:12346
LSPECIALPORT  tcp  --  anywhere             anywhere            tcp
dpt:20034
LSPECIALPORT  udp  --  anywhere             anywhere            udp
dpts:31337:31338
LSPECIALPORT  tcp  --  anywhere             anywhere            tcp
dpts:x11:6063
LSPECIALPORT  udp  --  anywhere             anywhere            udp
dpt:28431

Chain TCPACCEPT (2 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp
flags:SYN,RST,ACK/SYN limit: avg 5/sec burst 10
LSYNFLOOD  tcp  --  anywhere             anywhere            tcp
flags:SYN,RST,ACK/SYN
ACCEPT     tcp  --  anywhere             anywhere            tcp
flags:!SYN,RST,ACK/SYN


$ sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
REDIRECT   tcp  --  anywhere             anywhere            tcp dpt:www
redir ports 3128

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination


--
Tim White - Use the Fox, Luke!
PGP/GPG id: 602E944D, Pub Key Serv: subkeys.pgp.net
Fingerprint: 04C2 9682 B7B2 3006 009D  A9F3 067E EDCD 602E 944D
Hi! I'm a .signature virus! Copy me into your ~/.signature to help me spread!
--

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
URL: <http://lists.plug.org.au/pipermail/plug/attachments/20050204/6bb25d53/attachment.pgp>


More information about the plug mailing list