From: Slava Dubrovskiy <slava@elan.com.ua> To: Community@altlinux.ru Subject: [Comm] Iptables и https Date: Wed, 29 Sep 2004 13:28:37 +0300 Message-ID: <415A8E55.1060307@elan.com.ua> (raw) Здравствуйте! Вот настроил iptables на сервере по Iptables Tutorial. Но никак немогу настроить протокол https. Не пускает пользователей. Добавляю вот такую строчку. $IPTABLES -A FORWARD -p tcp --dport 443 -i $LAN_IFACE -j ACCEPT Броузер в командной строке пишет соединено с ...... и ничего не показывает. Что еще ему надо? #!/bin/sh LAN_IFACE="eth0" LAN_IP="192.168.1.1" LAN_IP_RANGE="192.168.1.0/24" LAN_BROADCAST_ADDRESS="192.168.1.255/24" INET_IFACE="ppp0" INET_IP="ххх.ххх.ххх.ххх" INET_IP_RANGE="ххх.ххх.ххх.ххх/24" INET_BROADCAST_ADDRESS="ххх.ххх.ххх.255/24" TUNEL_IFACE="eth1" TUNEL_IP="ууу.ууу.ууу.ууу" TUNEL_IP2="192.168.10.1" TUNEL_IP_RANGE="yyy.yyy.yyy.yyy/24" TUNEL_IP_RANGE2="192.168.10.0/24" TUNEL_BROADCAST_ADDRESS="yyy.yyy.yyy.255/24" TUNEL_BROADCAST_ADDRESS2="192.168.10.255/24" LO_IFACE="lo" LO_IP="127.0.0.1" IPTABLES="/sbin/iptables" $IPTABLES -F $IPTABLES -F -t nat # Remove any existing user-defined chains. $IPTABLES -X $IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -N bad_tcp_packets $IPTABLES -N allowed $IPTABLES -N tcp_packets $IPTABLES -N udp_packets $IPTABLES -N icmp_packets $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \ --log-prefix "New not syn:" $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP $IPTABLES -A allowed -p TCP --syn -j ACCEPT $IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A allowed -p TCP -j DROP $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 20 -j allowed $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 25 -j allowed $IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT $IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT $IPTABLES -A udp_packets -p UDP -i $INET_IFACE --destination-port 135:139 -j DROP $IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 --destination-port 67:68 -j DROP $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT $IPTABLES -A INPUT -p tcp -j bad_tcp_packets $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT $IPTABLES -A INPUT -p ALL -i $LO_IFACE -j ACCEPT $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BROADCAST_ADDRESS -j ACCEPT # pptp $IPTABLES -A INPUT -p 47 -i $TUNEL_IFACE -j ACCEPT $IPTABLES -A INPUT -p tcp -i $TUNEL_IFACE --sport 1723 -j ACCEPT $IPTABLES -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets $IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets $IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets $IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \ --log-level DEBUG --log-prefix "IPT INPUT packet died: " $IPTABLES -A FORWARD -p tcp -j bad_tcp_packets $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \ --log-level DEBUG --log-prefix "IPT FORWARD packet died: " $IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets $IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT $IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT $IPTABLES -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT # pptp $IPTABLES -A OUTPUT -p tcp -o $TUNEL_IFACE --dport 1723 -j ACCEPT $IPTABLES -A OUTPUT -p 47 -o $TUNEL_IFACE -j ACCEPT $IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \ --log-level DEBUG --log-prefix "IPT OUTPUT packet died: " $IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP $IPTABLES -t nat -A PREROUTING -s $LAN_IP_RANGE -d ! $LAN_IP -p tcp --dport 80 -j REDIRECT --to-port 3128 $IPTABLES -t nat -A PREROUTING -s $LAN_IP_RANGE -p tcp --dport 8080 -j REDIRECT --to-port 3128 $IPTABLES -t nat -A PREROUTING -s $LAN_IP_RANGE -p tcp --dport 8081 -j REDIRECT --to-port 3128 $IPTABLES -t nat -A PREROUTING -s $LAN_IP_RANGE -p tcp --dport 1080 -j REDIRECT --to-port 3128 $IPTABLES -t nat -A PREROUTING -s $LAN_IP_RANGE -p tcp --dport 3128 -j REDIRECT --to-port 3128 С уважением, Дубровский Вячеслав.
next reply other threads:[~2004-09-29 10:28 UTC|newest] Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top 2004-09-29 10:28 Slava Dubrovskiy [this message] 2004-09-29 10:37 ` Alexey Morsov 2004-09-29 10:40 ` Slava Dubrovskiy 2004-09-29 10:43 ` Alexey Morsov 2004-09-29 10:47 ` Slava Dubrovskiy 2004-09-29 10:51 ` Slava Dubrovskiy 2004-09-29 10:57 ` Alexey Morsov 2004-09-29 10:52 ` Alexey Morsov 2004-09-29 10:56 ` Slava Dubrovskiy 2004-09-29 11:04 ` Alexey Morsov 2004-09-29 11:14 ` Slava Dubrovskiy 2004-09-29 11:30 ` Alexey Morsov 2004-09-29 12:36 ` Slava Dubrovskiy 2004-09-29 12:48 ` Nizamov Shavkat 2004-09-29 13:04 ` Slava Dubrovskiy 2004-09-29 12:49 ` Slava Dubrovskiy 2004-09-29 12:51 ` Nizamov Shavkat 2004-09-29 13:29 ` Alexey Morsov 2004-09-30 6:20 ` Slava Dubrovskiy 2004-09-30 6:34 ` Alexey Morsov 2004-09-30 6:46 ` Slava Dubrovskiy 2004-09-30 6:50 ` Alexey Morsov 2004-09-30 6:58 ` Slava Dubrovskiy 2004-09-29 13:03 ` [Comm] Iptables É https Peter Teslenko 2004-09-29 13:06 ` [Comm] Iptables и https Slava Dubrovskiy 2004-09-29 13:30 ` Alexey Morsov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=415A8E55.1060307@elan.com.ua \ --to=slava@elan.com.ua \ --cc=Community@altlinux.ru \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
ALT Linux Community general discussions This inbox may be cloned and mirrored by anyone: git clone --mirror http://lore.altlinux.org/community/0 community/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 community community/ http://lore.altlinux.org/community \ mandrake-russian@linuxteam.iplabs.ru community@lists.altlinux.org community@lists.altlinux.ru community@lists.altlinux.com public-inbox-index community Example config snippet for mirrors. Newsgroup available over NNTP: nntp://lore.altlinux.org/org.altlinux.lists.community AGPL code for this site: git clone https://public-inbox.org/public-inbox.git