Re: IPChains rules

[Tobias Diedrich <ranma@example.com>]

A.Sajjad Zaidi wrote:

> But if I do something like this:
>
> ipchains -A input -b -s 99.99.99.99 -d 88.88.88.88 ! 21:22  -p tcp -j DENY
> ipchains -A input -b -s 99.99.99.99 -d 88.88.88.88 ! 80  -p tcp -j DENY
>
> it blocks everything.
>
> You dont mean a seperate deny rule for every unwanted port do you? That'll be
> a pain.

With ipchains you should either use ALLOW policy and explicitly DENY
everything you don't want or use DENY policy and explicitly ALLOW
everything you need.

You could write a script to generate that rules.

For iptables there is a "multiple port match" target IIRC, but you would
have to upgrade your kernel to 2.4 then.
iptables also has the advantage of being a "stateful" packet-filter, which
can make the rules much simpler (in case of a firewall you might
basically just say "allow all traffic from lan to the outside and allow
only known existing incoming connections")

-- Tobias