Запустил дома компьютер на дистрибутиве Debian Lenny для раздачи интернета по дому. Поднял vpn с помощью pptp-linux, настроил dhcp-server и поставил arno-iptables-firewall. Интернет раздаёт, да вот только проблема в том, что останавливаются любые однопоточные закачки (просмотр видео на ютубе внезапно останавливается, если слушать музыку в онлайне та же фигня, любые http-закачки так же обрываются), однако торрент работает нормально. VPN-соединение не падает, так как повторное подключение при разрыве я не прописывал.
Помогите решить проблему! Скину конфиги какие нужно.
LinuxForum.Fans
Рвутся соединения
Автор: Sanches1917
10 сообщений
2905 просмотров
Для начала: [console]iptables -L -v -n --line-numbers[/console]Также неплохо было бы привести конфиг фаерволла и пофлудить пингом тот же youtube, например, минут 10-12: [console]ping -f youtube.com[/console]Команды выполняются под пользователем root.
Показать
[console]servant:~# iptables -L -v -n --line-numbers
Chain INPUT (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
2 1042K 677M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED tcp dpts:1024:65535
4 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED udp dpts:1024:65535
5 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
6 3406 339K HOST_BLOCK all -- * * 0.0.0.0/0 0.0.0.0/0
7 1702 169K MAC_FILTER all -- eth1 * 0.0.0.0/0 0.0.0.0/0
8 3406 339K SPOOF_CHK all -- * * 0.0.0.0/0 0.0.0.0/0
9 1570 124K VALID_CHK all -- ppp+ * 0.0.0.0/0 0.0.0.0/0
10 1213 95656 EXT_INPUT_CHAIN !icmp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 state NEW
11 17 1004 EXT_INPUT_CHAIN icmp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 state NEW limit: avg 60/sec burst 100
12 0 0 EXT_ICMP_FLOOD_CHAIN icmp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 state NEW
13 134 46871 VALID_CHK all -- eth0 * 0.0.0.0/0 0.0.0.0/0
14 128 46487 EXT_INPUT_CHAIN !icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW
15 6 384 EXT_INPUT_CHAIN icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW limit: avg 60/sec burst 100
16 0 0 EXT_ICMP_FLOOD_CHAIN icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW
17 1702 169K LAN_INPUT_CHAIN all -- eth1 * 0.0.0.0/0 0.0.0.0/0
18 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 6 prefix `Dropped INPUT packet: '
19 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
2 18547 952K TCPMSS tcp -- * ppp+ 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
3 12 624 TCPMSS tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
4 1450K 956M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
5 1 60 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED tcp dpts:1024:65535
6 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED udp dpts:1024:65535
7 3588 398K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
8 42675 3228K HOST_BLOCK all -- * * 0.0.0.0/0 0.0.0.0/0
9 36074 2599K MAC_FILTER all -- eth1 * 0.0.0.0/0 0.0.0.0/0
10 6601 630K UPNP_FORWARD all -- ppp+ !ppp+ 0.0.0.0/0 0.0.0.0/0
11 0 0 UPNP_FORWARD all -- eth0 !eth0 0.0.0.0/0 0.0.0.0/0
12 42675 3228K SPOOF_CHK all -- * * 0.0.0.0/0 0.0.0.0/0
13 6601 630K VALID_CHK all -- ppp+ * 0.0.0.0/0 0.0.0.0/0
14 0 0 VALID_CHK all -- eth0 * 0.0.0.0/0 0.0.0.0/0
15 0 0 ACCEPT all -- eth1 eth1 0.0.0.0/0 0.0.0.0/0
16 34771 2516K LAN_INET_FORWARD_CHAIN all -- eth1 ppp+ 0.0.0.0/0 0.0.0.0/0
17 1303 82125 LAN_INET_FORWARD_CHAIN all -- eth1 eth0 0.0.0.0/0 0.0.0.0/0
18 1800 91541 ACCEPT tcp -- ppp+ !ppp+ 0.0.0.0/0 192.168.0.2 tcp dpt:31572
19 0 0 ACCEPT tcp -- eth0 !eth0 0.0.0.0/0 192.168.0.2 tcp dpt:31572
20 4801 538K ACCEPT udp -- ppp+ !ppp+ 0.0.0.0/0 192.168.0.2 udp dpt:31572
21 0 0 ACCEPT udp -- eth0 !eth0 0.0.0.0/0 192.168.0.2 udp dpt:31572
22 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/min burst 3 LOG flags 0 level 6 prefix `Dropped FORWARD packet: '
23 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 95 packets, 11992 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 TCPMSS tcp -- * ppp+ 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
2 1 60 TCPMSS tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
3 1054K 381M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
4 45141 3392K HOST_BLOCK all -- * * 0.0.0.0/0 0.0.0.0/0
5 0 0 LOG all -f * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `FRAGMENTED PACKET (OUT): '
6 0 0 DROP all -f * * 0.0.0.0/0 0.0.0.0/0
7 1679 169K EXT_OUTPUT_CHAIN all -- * ppp+ 0.0.0.0/0 0.0.0.0/0
8 43367 3211K EXT_OUTPUT_CHAIN all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain DMZ_INET_FORWARD_CHAIN (0 references)
num pkts bytes target prot opt in out source destination
Chain DMZ_INPUT_CHAIN (0 references)
num pkts bytes target prot opt in out source destination
Chain DMZ_LAN_FORWARD_CHAIN (0 references)
num pkts bytes target prot opt in out source destination
Chain EXT_ICMP_FLOOD_CHAIN (2 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-request(ping) flood: '
2 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
3 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-unreachable flood: '
4 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3
5 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-source-quench flood: '
6 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4
7 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-time-exceeded flood: '
8 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11
9 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-param.-problem flood: '
10 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12
11 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP(other) flood: '
12 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain EXT_INPUT_CHAIN (4 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:0 limit: avg 6/hour burst 1 LOG flags 0 level 6 prefix `TCP port 0 OS fingerprint: '
2 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:0 limit: avg 6/hour burst 1 LOG flags 0 level 6 prefix `UDP port 0 OS fingerprint: '
3 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:0
4 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:0
5 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:0 limit: avg 6/hour burst 5 LOG flags 0 level 6 prefix `TCP source port 0: '
6 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:0 limit: avg 6/hour burst 5 LOG flags 0 level 6 prefix `UDP source port 0: '
7 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:0
8 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:0
9 121 46140 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
10 23 1388 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 20/sec burst 100
11 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `ICMP-request: '
12 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-unreachable: '
13 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-source-quench: '
14 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-time-exceeded: '
15 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-param.-problem: '
16 13 1950 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535 flags:!0x17/0x02 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth scan (UNPRIV)?: '
17 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:0:1023 flags:!0x17/0x02 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth scan (PRIV)?: '
18 13 1950 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02
19 33 1672 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:0:1023 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (PRIV): '
20 18 850 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:0:1023 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (PRIV): '
21 54 2708 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (UNPRIV): '
22 345 30403 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (UNPRIV): '
23 164 8252 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
24 1042 85742 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
25 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
26 1 59 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/min burst 5 LOG flags 0 level 6 prefix `Other-IP connection attempt: '
27 1 59 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain EXT_OUTPUT_CHAIN (2 references)
num pkts bytes target prot opt in out source destination
1 45046 3380K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain HOST_BLOCK (3 references)
num pkts bytes target prot opt in out source destination
Chain INET_DMZ_FORWARD_CHAIN (0 references)
num pkts bytes target prot opt in out source destination
Chain LAN_INET_FORWARD_CHAIN (2 references)
num pkts bytes target prot opt in out source destination
1 15 1212 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 20/sec burst 100
2 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `ICMP-request: '
3 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
4 36059 2597K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain LAN_INPUT_CHAIN (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 20/sec burst 100
2 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `ICMP-request: '
3 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
4 1702 169K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain MAC_FILTER (2 references)
num pkts bytes target prot opt in out source destination
Chain RESERVED_NET_CHK (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG all -- * * 10.0.0.0/8 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class A address: '
2 0 0 LOG all -- * * 172.16.0.0/12 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class B address: '
3 0 0 LOG all -- * * 192.168.0.0/16 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class C address: '
4 0 0 LOG all -- * * 169.254.0.0/16 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class M$ address: '
5 0 0 DROP all -- * * 10.0.0.0/8 0.0.0.0/0
6 0 0 DROP all -- * * 172.16.0.0/12 0.0.0.0/0
7 0 0 DROP all -- * * 192.168.0.0/16 0.0.0.0/0
8 0 0 DROP all -- * * 169.254.0.0/16 0.0.0.0/0
Chain SPOOF_CHK (2 references)
num pkts bytes target prot opt in out source destination
1 37764 2763K RETURN all -- eth1 * 192.168.0.0/24 0.0.0.0/0
2 0 0 LOG all -- * * 192.168.0.0/24 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Spoofed packet: '
3 0 0 DROP all -- * * 192.168.0.0/24 0.0.0.0/0
4 8317 804K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain UPNP_FORWARD (2 references)
num pkts bytes target prot opt in out source destination
Chain VALID_CHK (4 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x29 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth XMAS scan: '
2 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x37 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth XMAS-PSH scan: '
3 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth XMAS-ALL scan: '
4 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x01 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth FIN scan: '
5 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth SYN/RST scan: '
6 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth SYN/FIN scan(?): '
7 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth Null scan: '
8 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x29
9 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x37
10 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F
11 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x01
12 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06
13 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03
14 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00
15 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=64 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `Bad TCP flag(64): '
16 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=128 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `Bad TCP flag(128): '
17 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=64
18 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=128
19 340 26971 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
20 0 0 LOG all -f * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 1 LOG flags 0 level 4 prefix `Fragmented packet: '
21 0 0 DROP all -f * * 0.0.0.0/0 0.0.0.0/0 [/console]
Chain INPUT (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
2 1042K 677M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED tcp dpts:1024:65535
4 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED udp dpts:1024:65535
5 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
6 3406 339K HOST_BLOCK all -- * * 0.0.0.0/0 0.0.0.0/0
7 1702 169K MAC_FILTER all -- eth1 * 0.0.0.0/0 0.0.0.0/0
8 3406 339K SPOOF_CHK all -- * * 0.0.0.0/0 0.0.0.0/0
9 1570 124K VALID_CHK all -- ppp+ * 0.0.0.0/0 0.0.0.0/0
10 1213 95656 EXT_INPUT_CHAIN !icmp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 state NEW
11 17 1004 EXT_INPUT_CHAIN icmp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 state NEW limit: avg 60/sec burst 100
12 0 0 EXT_ICMP_FLOOD_CHAIN icmp -- ppp+ * 0.0.0.0/0 0.0.0.0/0 state NEW
13 134 46871 VALID_CHK all -- eth0 * 0.0.0.0/0 0.0.0.0/0
14 128 46487 EXT_INPUT_CHAIN !icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW
15 6 384 EXT_INPUT_CHAIN icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW limit: avg 60/sec burst 100
16 0 0 EXT_ICMP_FLOOD_CHAIN icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW
17 1702 169K LAN_INPUT_CHAIN all -- eth1 * 0.0.0.0/0 0.0.0.0/0
18 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/sec burst 5 LOG flags 0 level 6 prefix `Dropped INPUT packet: '
19 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
2 18547 952K TCPMSS tcp -- * ppp+ 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
3 12 624 TCPMSS tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
4 1450K 956M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
5 1 60 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED tcp dpts:1024:65535
6 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED udp dpts:1024:65535
7 3588 398K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED
8 42675 3228K HOST_BLOCK all -- * * 0.0.0.0/0 0.0.0.0/0
9 36074 2599K MAC_FILTER all -- eth1 * 0.0.0.0/0 0.0.0.0/0
10 6601 630K UPNP_FORWARD all -- ppp+ !ppp+ 0.0.0.0/0 0.0.0.0/0
11 0 0 UPNP_FORWARD all -- eth0 !eth0 0.0.0.0/0 0.0.0.0/0
12 42675 3228K SPOOF_CHK all -- * * 0.0.0.0/0 0.0.0.0/0
13 6601 630K VALID_CHK all -- ppp+ * 0.0.0.0/0 0.0.0.0/0
14 0 0 VALID_CHK all -- eth0 * 0.0.0.0/0 0.0.0.0/0
15 0 0 ACCEPT all -- eth1 eth1 0.0.0.0/0 0.0.0.0/0
16 34771 2516K LAN_INET_FORWARD_CHAIN all -- eth1 ppp+ 0.0.0.0/0 0.0.0.0/0
17 1303 82125 LAN_INET_FORWARD_CHAIN all -- eth1 eth0 0.0.0.0/0 0.0.0.0/0
18 1800 91541 ACCEPT tcp -- ppp+ !ppp+ 0.0.0.0/0 192.168.0.2 tcp dpt:31572
19 0 0 ACCEPT tcp -- eth0 !eth0 0.0.0.0/0 192.168.0.2 tcp dpt:31572
20 4801 538K ACCEPT udp -- ppp+ !ppp+ 0.0.0.0/0 192.168.0.2 udp dpt:31572
21 0 0 ACCEPT udp -- eth0 !eth0 0.0.0.0/0 192.168.0.2 udp dpt:31572
22 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/min burst 3 LOG flags 0 level 6 prefix `Dropped FORWARD packet: '
23 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 95 packets, 11992 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 TCPMSS tcp -- * ppp+ 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
2 1 60 TCPMSS tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
3 1054K 381M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
4 45141 3392K HOST_BLOCK all -- * * 0.0.0.0/0 0.0.0.0/0
5 0 0 LOG all -f * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `FRAGMENTED PACKET (OUT): '
6 0 0 DROP all -f * * 0.0.0.0/0 0.0.0.0/0
7 1679 169K EXT_OUTPUT_CHAIN all -- * ppp+ 0.0.0.0/0 0.0.0.0/0
8 43367 3211K EXT_OUTPUT_CHAIN all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain DMZ_INET_FORWARD_CHAIN (0 references)
num pkts bytes target prot opt in out source destination
Chain DMZ_INPUT_CHAIN (0 references)
num pkts bytes target prot opt in out source destination
Chain DMZ_LAN_FORWARD_CHAIN (0 references)
num pkts bytes target prot opt in out source destination
Chain EXT_ICMP_FLOOD_CHAIN (2 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-request(ping) flood: '
2 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
3 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-unreachable flood: '
4 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3
5 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-source-quench flood: '
6 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4
7 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-time-exceeded flood: '
8 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11
9 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-param.-problem flood: '
10 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12
11 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP(other) flood: '
12 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain EXT_INPUT_CHAIN (4 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:0 limit: avg 6/hour burst 1 LOG flags 0 level 6 prefix `TCP port 0 OS fingerprint: '
2 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:0 limit: avg 6/hour burst 1 LOG flags 0 level 6 prefix `UDP port 0 OS fingerprint: '
3 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:0
4 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:0
5 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:0 limit: avg 6/hour burst 5 LOG flags 0 level 6 prefix `TCP source port 0: '
6 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:0 limit: avg 6/hour burst 5 LOG flags 0 level 6 prefix `UDP source port 0: '
7 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:0
8 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:0
9 121 46140 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
10 23 1388 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 20/sec burst 100
11 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `ICMP-request: '
12 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-unreachable: '
13 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-source-quench: '
14 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-time-exceeded: '
15 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix `ICMP-param.-problem: '
16 13 1950 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535 flags:!0x17/0x02 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth scan (UNPRIV)?: '
17 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:0:1023 flags:!0x17/0x02 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth scan (PRIV)?: '
18 13 1950 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02
19 33 1672 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:0:1023 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (PRIV): '
20 18 850 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:0:1023 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (PRIV): '
21 54 2708 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (UNPRIV): '
22 345 30403 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix `Connection attempt (UNPRIV): '
23 164 8252 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0
24 1042 85742 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
25 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
26 1 59 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 1/min burst 5 LOG flags 0 level 6 prefix `Other-IP connection attempt: '
27 1 59 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain EXT_OUTPUT_CHAIN (2 references)
num pkts bytes target prot opt in out source destination
1 45046 3380K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain HOST_BLOCK (3 references)
num pkts bytes target prot opt in out source destination
Chain INET_DMZ_FORWARD_CHAIN (0 references)
num pkts bytes target prot opt in out source destination
Chain LAN_INET_FORWARD_CHAIN (2 references)
num pkts bytes target prot opt in out source destination
1 15 1212 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 20/sec burst 100
2 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `ICMP-request: '
3 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
4 36059 2597K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain LAN_INPUT_CHAIN (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 20/sec burst 100
2 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `ICMP-request: '
3 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
4 1702 169K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain MAC_FILTER (2 references)
num pkts bytes target prot opt in out source destination
Chain RESERVED_NET_CHK (0 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG all -- * * 10.0.0.0/8 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class A address: '
2 0 0 LOG all -- * * 172.16.0.0/12 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class B address: '
3 0 0 LOG all -- * * 192.168.0.0/16 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class C address: '
4 0 0 LOG all -- * * 169.254.0.0/16 0.0.0.0/0 limit: avg 1/min burst 1 LOG flags 0 level 6 prefix `Class M$ address: '
5 0 0 DROP all -- * * 10.0.0.0/8 0.0.0.0/0
6 0 0 DROP all -- * * 172.16.0.0/12 0.0.0.0/0
7 0 0 DROP all -- * * 192.168.0.0/16 0.0.0.0/0
8 0 0 DROP all -- * * 169.254.0.0/16 0.0.0.0/0
Chain SPOOF_CHK (2 references)
num pkts bytes target prot opt in out source destination
1 37764 2763K RETURN all -- eth1 * 192.168.0.0/24 0.0.0.0/0
2 0 0 LOG all -- * * 192.168.0.0/24 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Spoofed packet: '
3 0 0 DROP all -- * * 192.168.0.0/24 0.0.0.0/0
4 8317 804K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain UPNP_FORWARD (2 references)
num pkts bytes target prot opt in out source destination
Chain VALID_CHK (4 references)
num pkts bytes target prot opt in out source destination
1 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x29 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth XMAS scan: '
2 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x37 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth XMAS-PSH scan: '
3 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth XMAS-ALL scan: '
4 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x01 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth FIN scan: '
5 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth SYN/RST scan: '
6 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth SYN/FIN scan(?): '
7 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00 limit: avg 3/min burst 5 LOG flags 0 level 6 prefix `Stealth Null scan: '
8 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x29
9 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x37
10 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x3F
11 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x01
12 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06
13 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03
14 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00
15 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=64 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `Bad TCP flag(64): '
16 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=128 limit: avg 3/min burst 1 LOG flags 0 level 6 prefix `Bad TCP flag(128): '
17 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=64
18 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp option=128
19 340 26971 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
20 0 0 LOG all -f * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 1 LOG flags 0 level 4 prefix `Fragmented packet: '
21 0 0 DROP all -f * * 0.0.0.0/0 0.0.0.0/0 [/console]
[console]servant:~# cat /etc/arno-iptables-firewall/debconf.cfg
#######################################################################
# Feel free to edit this file. However, be aware that debconf writes #
# to (and reads from) this file too. In case of doubt, only use #
# 'dpkg-reconfigure -plow arno-iptables-firewall' to edit this file. #
# If you really don't want to use debconf, or if you have specific #
# needs, you're likely better off using #
# /etc/arno-iptables-firewall/custom-rules. Also see README.Debian. #
#######################################################################
DC_EXT_IF="ppp+ eth0"
DC_EXT_IF_DHCP_IP=1
DC_OPEN_TCP=""
DC_OPEN_UDP=""
DC_INT_IF="eth1"
DC_NAT=1
DC_INTERNAL_NET="192.168.0.0/24"
DC_NAT_INTERNAL_NET="192.168.0.0/24"
DC_OPEN_ICMP=1[/console]
[console]alex-desktop:/home/alex # ping -f youtube.com
PING youtube.com (74.125.95.93) 56(84) bytes of data.
......................^C
--- youtube.com ping statistics ---
48075 packets transmitted, 48053 received, 0% packet loss, time 693882ms
rtt min/avg/max/mdev = 180.663/184.137/508.148/12.717 ms, pipe 37, ipg/ewma 14.433/183.277 ms
[/console]
Конфиг firewall.conf очень здоровый (не влазит в сообщение), в нём я ничего не менял кроме проброски портов для торрент-клиента, а всё остальное в основном коментарии и шаблоны для разных настроек. Скидываю только главные настройки:
Показать
###############################################################################
# General settings #
###############################################################################
# Most people don't want to get any firewall logs being spit to the console.
# This option makes the kernel ring buffer only log messages with level
# "panic".
# -----------------------------------------------------------------------------
DMESG_PANIC_ONLY=1
# Enable this if you want TOS mangling (RFC) (recommended).
# -----------------------------------------------------------------------------
MANGLE_TOS=1
# Enable this if you want to set the maximum packet size via the
# Maximum Segment Size(through MSS field) (recommended).
# -----------------------------------------------------------------------------
SET_MSS=1
# Enable this if you want to increase the TTL value by one in the prerouting
# chain. This hides the firewall when performing eg. traceroutes to internal
# hosts.
# -----------------------------------------------------------------------------
TTL_INC=0
# (EXPERT SETTING!) Enable this if you want to set the TTL value for packets in
# the OUTPUT & FORWARD chain. Note that this only works with newer 2.6 kernels
# (2.6.14 or better) or patched 2.4 kernels, which have netfilter TTL target
# support. Don't mess with this unless you really know what you are doing!
# -----------------------------------------------------------------------------
#PACKET_TTL="64"
# Enable this to resolve names of DNS IP's etc.
# -----------------------------------------------------------------------------
RESOLV_IPS=0
# Enable this to support the IRC-protocol.
# -----------------------------------------------------------------------------
USE_IRC=0
# (EXPERT SETTING!). Loosen the forward chain for the external interface(s).
# Enable it to allow the use of protocols like UPnP. Note that it *could* be
# less secure.
# -----------------------------------------------------------------------------
LOOSE_FORWARD=0
# (EXPERT SETTING!). Enable this if you want to drop packets originating from a
# private address.
# -----------------------------------------------------------------------------
DROP_PRIVATE_ADDRESSES=0
# (EXPERT SETTING!). Protect this machine from being abused for a DRDOS-attack
# ("Distributed Reflection Denial Of Service"-attack). (STILL EXPERIMENTAL!)
# -----------------------------------------------------------------------------
DRDOS_PROTECT=0
# Enable this if you want to allow/enable IPv6 traffic. Note that my firewall
# does NOT filter IPv6 traffic (yet), and thus NO checking is performed on it!
# -----------------------------------------------------------------------------
IPV6_OVER_IPV4=0
# This option fixes problems with SMB broadcasts when using nmblookup
# -----------------------------------------------------------------------------
NMB_BROADCAST_FIX=0
# Set this to 0 to suppress "assuming module is compiled in kernel" messages
# -----------------------------------------------------------------------------
COMPILED_IN_KERNEL_MESSAGES=1
# (EXPERT SETTING!). Iptables default policy is DROP. This means that when there
# are no rule(s) available (yet), the packet will be DROPPED. In practice this
# rule only does something while the firewall is starting. Once it's started
# and all rules are in place, the default policy doesn't do anything anymore.
# People that use ie. NFS and let their clients boot from NFS (diskless client
# systems) probably want to disable this option to fix
# "NFS server not responding" etc. errors on their clients.
# -----------------------------------------------------------------------------
DEFAULT_POLICY_DROP=1
# (EXPERT SETTING!). (Other) trusted network interfaces for which ALL IP
# traffic should be ACCEPTED. (multiple(!) interfaces should be space
# separated). Be warned that anything TO and FROM these interfaces is allowed
# (ACCEPTED) so make sure it's NOT routable(accessible) from the outside world
# (internet)!
# -----------------------------------------------------------------------------
TRUSTED_IF=""
# (EXPERT SETTING!). Put here the (internal) interfaces that should trust
# (accept forward traffic) each other.
# -----------------------------------------------------------------------------
INT_IF_TRUST=""
# Location of the custom iptables rules file (if any).
# -----------------------------------------------------------------------------
CUSTOM_RULES="/etc/arno-iptables-firewall/custom-rules"
# General settings #
###############################################################################
# Most people don't want to get any firewall logs being spit to the console.
# This option makes the kernel ring buffer only log messages with level
# "panic".
# -----------------------------------------------------------------------------
DMESG_PANIC_ONLY=1
# Enable this if you want TOS mangling (RFC) (recommended).
# -----------------------------------------------------------------------------
MANGLE_TOS=1
# Enable this if you want to set the maximum packet size via the
# Maximum Segment Size(through MSS field) (recommended).
# -----------------------------------------------------------------------------
SET_MSS=1
# Enable this if you want to increase the TTL value by one in the prerouting
# chain. This hides the firewall when performing eg. traceroutes to internal
# hosts.
# -----------------------------------------------------------------------------
TTL_INC=0
# (EXPERT SETTING!) Enable this if you want to set the TTL value for packets in
# the OUTPUT & FORWARD chain. Note that this only works with newer 2.6 kernels
# (2.6.14 or better) or patched 2.4 kernels, which have netfilter TTL target
# support. Don't mess with this unless you really know what you are doing!
# -----------------------------------------------------------------------------
#PACKET_TTL="64"
# Enable this to resolve names of DNS IP's etc.
# -----------------------------------------------------------------------------
RESOLV_IPS=0
# Enable this to support the IRC-protocol.
# -----------------------------------------------------------------------------
USE_IRC=0
# (EXPERT SETTING!). Loosen the forward chain for the external interface(s).
# Enable it to allow the use of protocols like UPnP. Note that it *could* be
# less secure.
# -----------------------------------------------------------------------------
LOOSE_FORWARD=0
# (EXPERT SETTING!). Enable this if you want to drop packets originating from a
# private address.
# -----------------------------------------------------------------------------
DROP_PRIVATE_ADDRESSES=0
# (EXPERT SETTING!). Protect this machine from being abused for a DRDOS-attack
# ("Distributed Reflection Denial Of Service"-attack). (STILL EXPERIMENTAL!)
# -----------------------------------------------------------------------------
DRDOS_PROTECT=0
# Enable this if you want to allow/enable IPv6 traffic. Note that my firewall
# does NOT filter IPv6 traffic (yet), and thus NO checking is performed on it!
# -----------------------------------------------------------------------------
IPV6_OVER_IPV4=0
# This option fixes problems with SMB broadcasts when using nmblookup
# -----------------------------------------------------------------------------
NMB_BROADCAST_FIX=0
# Set this to 0 to suppress "assuming module is compiled in kernel" messages
# -----------------------------------------------------------------------------
COMPILED_IN_KERNEL_MESSAGES=1
# (EXPERT SETTING!). Iptables default policy is DROP. This means that when there
# are no rule(s) available (yet), the packet will be DROPPED. In practice this
# rule only does something while the firewall is starting. Once it's started
# and all rules are in place, the default policy doesn't do anything anymore.
# People that use ie. NFS and let their clients boot from NFS (diskless client
# systems) probably want to disable this option to fix
# "NFS server not responding" etc. errors on their clients.
# -----------------------------------------------------------------------------
DEFAULT_POLICY_DROP=1
# (EXPERT SETTING!). (Other) trusted network interfaces for which ALL IP
# traffic should be ACCEPTED. (multiple(!) interfaces should be space
# separated). Be warned that anything TO and FROM these interfaces is allowed
# (ACCEPTED) so make sure it's NOT routable(accessible) from the outside world
# (internet)!
# -----------------------------------------------------------------------------
TRUSTED_IF=""
# (EXPERT SETTING!). Put here the (internal) interfaces that should trust
# (accept forward traffic) each other.
# -----------------------------------------------------------------------------
INT_IF_TRUST=""
# Location of the custom iptables rules file (if any).
# -----------------------------------------------------------------------------
CUSTOM_RULES="/etc/arno-iptables-firewall/custom-rules"
Причина редактирования: Пользуйтесь тэгом spoiler.
iptables -P FORWARD ACCEPT
и пробни качнуть.
Прописал, ничего не изменилось
iptables -F -t FORWARD
iptables -P FORWARD ACCEPT
А если так (не проверял)
[console]servant:~# iptables -F -t FORWARD
iptables v1.4.2: can't initialize iptables table `FORWARD': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.[/console]
Пожалуйста, помогите! Я не знаю что делать!
Проблему решил сам. Спасибо всем кто пытался помочь.
Проблему решил сам.
а как?
Войдите или зарегистрируйтесь, чтобы ответить.
