# iptables override settings.

## GentooBox

Hi.

I got this firewall to work:

```
#!/bin/sh

IPTABLES=/sbin/iptables

EXTIF="eth0"

INTIF="eth1"

INTNET="192.168.1.0/24"

INTIP="192.168.1.254/24"

UNIVERSE="0.0.0.0/0"

$IPTABLES -P INPUT DROP

$IPTABLES -F INPUT 

$IPTABLES -P OUTPUT DROP

$IPTABLES -F OUTPUT 

$IPTABLES -P FORWARD DROP

$IPTABLES -F FORWARD 

$IPTABLES -F -t nat

$IPTABLES -N drop-and-log-it

$IPTABLES -A drop-and-log-it -j LOG --log-level info 

$IPTABLES -A drop-and-log-it -j REJECT

$IPTABLES -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT

$IPTABLES -A INPUT -i $INTIF -s $INTNET -d $UNIVERSE -j ACCEPT

$IPTABLES -A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j drop-and-log-it

$IPTABLES -A INPUT -i $EXTIF -p ICMP -s $UNIVERSE -d $EXTIP -j ACCEPT

$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it

$IPTABLES -A OUTPUT -o lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT

$IPTABLES -A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j ACCEPT

$IPTABLES -A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j ACCEPT

$IPTABLES -A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j drop-and-log-it

$IPTABLES -A OUTPUT -o $EXTIF -s $EXTIP -d $UNIVERSE -j ACCEPT

$IPTABLES -A OUTPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it

$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT

$IPTABLES -A FORWARD -j drop-and-log-it

$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP
```

I dont know much about iptables, and now i got a problem.

my internal network cant connect on port 21 (FTP) to the outside world.

some other ports is also crashed.

i think its the "ESTABLISHED,RELATED -j ACCEPT" rule that mess up things.

how do i make a override rule ?

eksample:

only ESTABLISHED RELATED stuf is ACCEPTed "ESTABLISHED,RELATED -j ACCEPT" but port 21 is open and the "ESTABLISHED,RELATED -j ACCEPT" does not apply to that port.

can i do that ?

----------

## GentooBox

port 600 is my DCgui-qt client.

it works only in passive mode.

the client is installed on the firewall / router.

is there a way i can make it active ? override rules again ?

----------

## GentooBox

someone please help me.

i need to open port 600 on my firewall.

----------

## joshdr77

google works nicly - 

but this might help

```
$IPTABLES -A INPUT -p tcp -i $IFACE --dport 23073 -j ACCEPT #ftp
```

this should be self explainitry....$IFACE is the interface and 23073 is a desired port to open[/code]

----------

## To

I changed a few things in your script... *Quote:*   

> #bin/sh
> 
> IPTABLES=/sbin/iptables
> 
> EXTIF="eth0"
> ...

 

 *GentooBox wrote:*   

> I dont know much about iptables, and now i got a problem.
> 
> my internal network cant connect on port 21 (FTP) to the outside world.
> 
> some other ports is also crashed.
> ...

 

----------

## To

Sorry I was working and made some typos on the previous message, I've allready edited it and correct some.

Btw to open a new port you can use:

$IPTABLES -A INPUT -i eth0 -p tcp --dport 600 -j ACCEPT 

In this case it's the port 600 has you requested, if you need to use both tcp and udp it's:

$IPTABLES -A INPUT -i eth0 -p udp --dport 600 -j ACCEPT

Tó

----------

## GentooBox

Thanks.

Gentoo Linux´s forum is the best   :Exclamation: 

thanks to "joshdr77" and "to"

----------

## joshdr77

no problem

----------

## To

You're welcome.

You may want to take a look at  *Quote:*   

> *  net-firewall/shorewall
> 
>       Latest version available: 1.4.6-r1

 

It's a nice tool and uses iptables, tha configuration it's quite simple all you need to follow is the 2 interfaces guide on their webpage http://www.shorewall.net/two-interface.htm.

Try it  :Wink: 

Tó

----------

