Re: [Devil-linux-develop] Firewall script for 2 NIC's & NAT.

[John v. V. <joh...@ya...>]

Wow Bruce, you are hot !!

--- Bruce Smith <bw...@ar...> wrote:
> > >I added a simple iptables script that supports 2 NIC's w/masquerading.
> > >Please take a look, and comment:
> > >
> > >http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/devil-linux/build/config/
> > >etc/init.d/firewall.rules.2nic?rev=HEAD
> > 
> > I wouldn't fix the interface to interna=eth1 and external=eth0 .
> > Let the user choose it.
> 
> I'm trying to come up with script(s) that I can copy to firewall.rules
> in my new setup script.  I need to default them to something.  I'm happy
> to switch them around if you like that better.
> 
> Also, in my experience, the numbering of ethernet interfaces is very
> arbitrary.  Even if the cards use two different drivers, I don't know
> how to tell which is which without examining the MAC addresses or trying
> them.  The output of "ifconfig" doesn't say which driver it's using.  
> 
> Asking a newbie if they want eth0 or eth1 connected to the internet
> isn't going to mean anything to them, unless I can tell them which card
> is which.
> 
> So, my instructions would be to plug one NIC into your cable/DSL modem,
> and the other into your internal LAN.  If it doesn't work, switch the
> cables, reboot DL & modem, and try again.
> 
> I'd appreciate advice, if there is a better way.
> 
> > I didn't look over the rules.
> 
> Please do, if you get the time.  I'd like many people to look at it
> seriously and test it.  This script is very preliminary (untested by
> myself), and I don't want it to have a security hole somewhere.
> 
> It's true that the code was "borrowed" from a different firewall
> package, but I made some changes.  We need to check to make sure I
> didn't break something while I was at it.  I will test it myself, when I
> get the time, but I'd feel much better if other people looked at it, and
> tested it too.
> 
> > >Much of the code was originally based on a script from my 2nd favorite
> > >dedicated Linux firewall distribution.  :-)
> > 
> > Thief ;-)
> 
> Open Source!  :-)
> 
>  - BS
> 
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: ObjectStore.
> If flattening out C++ or Java code to make your application fit in a
> relational database is painful, don't do it! Check out ObjectStore.
> Now part of Progress Software. http://www.objectstore.net/sourceforge
> _______________________________________________
> Devil-linux-develop mailing list
> Dev...@li...
> https://lists.sourceforge.net/lists/listinfo/devil-linux-develop


=====
CXN, Inc. Contact: jo...@th...
President, The Linux Society
http://groups.yahoo.com/group/linux-society
linux society distro -> http://www.thinman.com/eLSD/readme
ThinMan is a registered trademark of CXN, Inc

__________________________________
Do you Yahoo!?
Yahoo! Calendar - Free online calendar with sync to Outlook(TM).
http://calendar.yahoo.com