Changeset 787 for server/fedora/config/etc/sysconfig

Timestamp:

Aug 3, 2008, 12:53:23 PM (16 years ago)

Author:

geofft

Message:

Fix some stuff about our iptables rules, including:
- Remove ACCEPT rules where the default is ACCEPT.
- We don't run NFS anymore; punt those rules.
- hodge-podge doesn't exist anymore; punt those rules.
- Blocking MIT Google wholesale is probably a bad idea.

File:

• server/fedora/config/etc/sysconfig/iptables (modified) (1 diff)

server/fedora/config/etc/sysconfig/iptables

@@ -20 +20 @@
 *filter
 :INPUT ACCEPT [292118:164733476]
--A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
--A INPUT -p tcp -m tcp --dport 5666 -s 18.181.0.65/255.255.255.255 -j ACCEPT
--A INPUT -p tcp -m tcp --dport 5666 -s ! 18.187.1.128/255.255.255.255 -j REJECT
--A INPUT -p tcp -m tcp --dport 199 -s ! 18.187.1.128/255.255.255.255 -j REJECT
 -A INPUT -p udp -m udp --dport 161 -s ! 18.0.0.0/8 -j REJECT
--A INPUT -p tcp -m tcp -m state --state NEW -m multiport --dports 111,2049 -s 127.0.0.1/255.0.0.0 -j ACCEPT
--A INPUT -p tcp -m tcp -m state --state NEW -m multiport --dports 111,2049 -s 18.181.0.53/255.255.255.255 -j ACCEPT
--A INPUT -p tcp -m tcp -m state --state NEW -m multiport --dports 111,2049 -s 18.181.0.57/255.255.255.255 -j ACCEPT
--A INPUT -p tcp -m tcp -m state --state NEW -m multiport --dports 111,2049 -j REJECT
--A INPUT -p udp -m udp -m state --state NEW -m multiport --dports 111,2049 -s 127.0.0.1/255.0.0.0 -j ACCEPT
--A INPUT -p udp -m udp -m state --state NEW -m multiport --dports 111,2049 -s 18.181.0.53/255.255.255.255 -j ACCEPT
--A INPUT -p udp -m udp -m state --state NEW -m multiport --dports 111,2049 -s 18.181.0.57/255.255.255.255 -j ACCEPT
--A INPUT -p udp -m udp -m state --state NEW -m multiport --dports 111,2049 -j REJECT
--A INPUT -s 18.7.7.102/255.255.255.255 -j REJECT
 :FORWARD ACCEPT [0:0]
 :OUTPUT ACCEPT [500523:537785790]