Koozali.org: home of the SME Server

Legacy Forums => Experienced User Forum => Topic started by: Franco on February 22, 2005, 09:13:10 PM

Title: Rules for controlling access on a specific port
Post by: Franco on February 22, 2005, 09:13:10 PM

I need to use M$ RDC to access a remote system behind SME. I have forwarded the TCP/UDP 3389 ports to the system and now anyone who scans the network can see the open ports and try entering.
How can I creat a set of rules so only an specified IP can access these ports?

Thanks in advance,

Title: Rules for controlling access on a specific port
Post by: smeghead on February 23, 2005, 06:39:13 AM

I do this courtesy of a good hardware router in front of the SME box (thats in server/gateway mode so network is double NAT'd), my preference is a Netgear FR328.

Certainly not the cheapest option but dead easy to use and support.

HTH

Title: Rules for controlling access on a specific port
Post by: Franco on February 23, 2005, 01:32:02 PM

...and forward all the necesseray ports?
Is the Netgear possible of doing the Access Control?

Thanks,

Title: Rules for controlling access on a specific port
Post by: mdo on February 24, 2005, 06:43:23 PM

Hi,

I would like to raise stuntshell's original question again to see whether it's possible with iptables? (to allow access to the portforwarded terminalserver port 3389 only for specific, pre-defined source IP adresses)

If iptables allows for this, I am happy to modify a custom template, don't need a panel for that.

Regards,
Michael

Title: Rules for controlling access on a specific port
Post by: Franco on February 25, 2005, 02:03:09 AM

Michael,
I'm still on a search for the answer, as the Netgear is not on my list, if everything else fails I'd go with Monowall on a cheap hardware providing the extra layer.
Another question I have, if I can't make an iptables rule:
Can I use a TCP wrapper such as the hosts.allow for the same purpose, and is it secure?
Thanks,

Title: Rules for controlling access on a specific port
Post by: Franco on February 25, 2005, 04:54:43 PM

Answering my own question:
-No ,as hosts.allow can only control daemons active on the server!  :-(