Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: GlitchFreak on November 08, 2007, 11:30:19 AM

Title: Adding IPTables rules
Post by: GlitchFreak on November 08, 2007, 11:30:19 AM: Morning

How do I add a custom IPTables rule to block external pop3 access? I want to prevent anyone in the company from popping external email.

Thanks!
Title: Re: Adding IPTables rules
Post by: byte on November 08, 2007, 12:28:56 PM: Quote from: GlitchFreak on November 08, 2007, 11:30:19 AM
How do I add a custom IPTables rule to block external pop3 access? I want to prevent anyone in the company from popping external email.

Enjoy ;)

http://wiki.contribs.org/Firewall#Block_outgoing_ports
Title: Re: Adding IPTables rules
Post by: mmccarn on November 08, 2007, 12:37:05 PM: After downloading the stuff referenced above, issue these commands:
Code: [Select]
config setprop masq TCPBlocks 0.0.0.0:110 signal-event remoteaccess-update /etc/init.d/masq restart
Title: Re: Adding IPTables rules
Post by: GlitchFreak on November 13, 2007, 12:22:56 PM: Thanks, I've enabled the changes.

Is there a log I can tail to see the blocks in effect? Perhaps /var/log/iptables?
Title: Re: Adding IPTables rules
Post by: byte on November 13, 2007, 12:40:32 PM: Quote from: GlitchFreak on November 13, 2007, 12:22:56 PM
Is there a log I can tail to see the blocks in effect?

/var/log/messages
Title: Re: Adding IPTables rules
Post by: mmccarn on November 13, 2007, 01:44:37 PM: As currently written the 'PortBlocks' code does not log anything.
Title: Re: Adding IPTables rules
Post by: GlitchFreak on November 13, 2007, 02:24:29 PM: I thought so... Didn't see anything logging...
Title: Re: Adding IPTables rules
Post by: byte on November 13, 2007, 02:50:32 PM: Quote from: mmccarn on November 13, 2007, 01:44:37 PM
As currently written the 'PortBlocks' code does not log anything.

Ah I didn't realize your new code didn't include "--log-prefix" that's why I do see the blocks in /var/log/messages
Title: Re: Adding IPTables rules
Post by: GlitchFreak on November 13, 2007, 02:53:13 PM: Is there a hard code method to enable logging port blocks?
Title: Re: Adding IPTables rules
Post by: CharlieBrady on November 13, 2007, 03:37:40 PM: Quote from: byte on November 13, 2007, 12:40:32 PM
/var/log/messages

No, any iptables logging is in /var/log/iptables/current.
Title: Re: Adding IPTables rules
Post by: byte on November 13, 2007, 03:52:04 PM: Quote from: CharlieBrady on November 13, 2007, 03:37:40 PM
No, any iptables logging is in /var/log/iptables/current.

Thats correct for "any" but if you have parameter "--log-prefix" inserted in to your iptable line then it will show any blocks in the /var/log/messages and via dmesg.
Title: Re: Adding IPTables rules
Post by: CharlieBrady on November 13, 2007, 04:05:41 PM: Quote from: byte on November 13, 2007, 03:52:04 PM
Thats correct for "any" but if you have parameter "--log-prefix" inserted in to your iptable line then it will show any blocks in the /var/log/messages and via dmesg.

The standard 'denylog' rule uses --log-prefix, and standard logs don't go to syslog. Something else is going on here - perhaps ulogd is not running.