[Devil-linux-commit] build/config/etc/init.d firewall.rules.2nic, 1.16, 1.17 firewall.rules.3nic, 1.13, 1.14

[Bruce S. <bl...@us...>]

Update of /cvsroot/devil-linux/build/config/etc/init.d
In directory fdv4jf1.ch3.sourceforge.com:/tmp/cvs-serv18459

Modified Files:
	firewall.rules.2nic firewall.rules.3nic 
Log Message:
Fix obsolete rules


Index: firewall.rules.3nic
===================================================================
RCS file: /cvsroot/devil-linux/build/config/etc/init.d/firewall.rules.3nic,v
retrieving revision 1.13
retrieving revision 1.14
diff -u -d -r1.13 -r1.14
--- firewall.rules.3nic	10 Aug 2005 20:38:51 -0000	1.13
+++ firewall.rules.3nic	10 Jun 2009 01:07:50 -0000	1.14
@@ -103,6 +103,10 @@
 ${IPTABLES} -A INPUT  -p icmp -j ACCEPT
 ${IPTABLES} -A OUTPUT -p icmp -j ACCEPT
 
+# Accept DNS requests from the DMZ
+${IPTABLES} -A INPUT -p TCP -i ${DMZ_DEV} --dport 53 -j ACCEPT
+${IPTABLES} -A INPUT -p UDP -i ${DMZ_DEV} --dport 53 -j ACCEPT
+
 # Fast reject for Ident to eliminate email delays.
 ${IPTABLES} -A INPUT -p TCP --dport 113 -i ${OUT_DEV} -j REJECT --reject-with tcp-reset
 
@@ -184,12 +188,8 @@
 ${IPTABLES} -A FORWARD -m state --state NEW -i ${DMZ_DEV} -j ACCEPT
 
 # Prevent NetBIOS and Samba from leaking.
-${IPTABLES} -t nat -A PREROUTING -p TCP --dport 135 -j DROP
-${IPTABLES} -t nat -A PREROUTING -p UDP --dport 135 -j DROP
-${IPTABLES} -t nat -A PREROUTING -p TCP --dport 137:139 -j DROP
-${IPTABLES} -t nat -A PREROUTING -p UDP --dport 137:139 -j DROP
-${IPTABLES} -t nat -A PREROUTING -p TCP --dport 445 -j DROP
-${IPTABLES} -t nat -A PREROUTING -p UDP --dport 445 -j DROP
+${IPTABLES} -A FORWARD -p TCP -m multiport --dports 135,137:139,445 -j DROP
+${IPTABLES} -A FORWARD -p UDP -m multiport --dports 135,137:139,445 -j DROP
 
 # Log invalid packets from DROP policy:
 if [ -n "$LOGGING" ] ; then

Index: firewall.rules.2nic
===================================================================
RCS file: /cvsroot/devil-linux/build/config/etc/init.d/firewall.rules.2nic,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -d -r1.16 -r1.17
--- firewall.rules.2nic	21 Sep 2005 12:36:30 -0000	1.16
+++ firewall.rules.2nic	10 Jun 2009 01:07:49 -0000	1.17
@@ -160,12 +160,8 @@
 ${IPTABLES} -A FORWARD -m state --state NEW -i ${INT_DEV} -j ACCEPT
 
 # Prevent NetBIOS and Samba from leaking.
-${IPTABLES} -t nat -A PREROUTING -p TCP --dport 135 -j DROP
-${IPTABLES} -t nat -A PREROUTING -p UDP --dport 135 -j DROP
-${IPTABLES} -t nat -A PREROUTING -p TCP --dport 137:139 -j DROP
-${IPTABLES} -t nat -A PREROUTING -p UDP --dport 137:139 -j DROP
-${IPTABLES} -t nat -A PREROUTING -p TCP --dport 445 -j DROP
-${IPTABLES} -t nat -A PREROUTING -p UDP --dport 445 -j DROP
+${IPTABLES} -A FORWARD -p TCP -m multiport --dports 135,137:139,445 -j DROP
+${IPTABLES} -A FORWARD -p UDP -m multiport --dports 135,137:139,445 -j DROP
 
 # Log invalid packets from DROP policy:
 if [ -n "$LOGGING" ] ; then