The OpenNET Project / Index page

[ новости /+++ | форум | теги | ]




Версия для распечатки Пред. тема | След. тема
Новые ответы [ Отслеживать ]
#2 перенос правил iptables на другой линух, !*! 100matolog, 21-Окт-08, 15:42  [смотреть все]
При переносе правил с fedora 8 на fedora 9 (версии iptables совпадают)
iptables-restore < iptables
ругаетца на
[root@shata-new sysconfig]# iptables-restore < iptables
iptables-restore: line 271 failed

а 271 строка это COMMIT

вот собственно код

# Generated by iptables-save v1.3.8 on Fri Nov 16 09:09:07 2007
*nat
:PREROUTING ACCEPT [16952:1498121]
:POSTROUTING ACCEPT [8150:470210]
:OUTPUT ACCEPT [1717:132048]
-A PREROUTING -d 217.20.182.* -p tcp -m tcp --dport 143 -j DNAT --to-destination 10.0.3.1
-A PREROUTING -d 217.20.182.* -p tcp -m tcp --dport 3389 -j DNAT --to-destination 10.0.1.5
-A PREROUTING -d 217.20.182.* -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.0.0.20
-A PREROUTING -d 217.20.182.* -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.3.1
-A PREROUTING -d 217.20.182.* -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.0.3.1
-A PREROUTING -d 217.20.182.* -p tcp -m tcp --dport 110 -j DNAT --to-destination 10.0.3.1
#-A POSTROUTING -s 10.0.1.39 -d 212.66.32.18 -p tcp -m tcp --dport 119 -j SNAT --to-source 217.20.182.*
#-A POSTROUTING -s 10.0.1.39 -d 195.184.207.* -p tcp -m tcp --dport 119 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.135.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1024

-A POSTROUTING -s 10.0.1.54 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.2.60 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.2.48 -j SNAT --to-source 217.20.182.*
#-A POSTROUTING -s 10.0.2.57 -j SNAT --to-source 217.20.182.*
#-A POSTROUTING -s 10.0.2.10 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.39 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.29 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.2.10 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.139 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.254 -j SNAT --to-source 217.20.182.*
#-A POSTROUTING -s 10.0.1.122 -j SNAT --to-source 217.20.182.*
#-A POSTROUTING -s 10.0.1.31 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.2.12 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.0.20 -j SNAT --to-source 217.20.182.*
#-A POSTROUTING -s 10.0.0.120 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.3.1 -j SNAT --to-source 217.20.182.*

-A POSTROUTING -s 10.0.0.8 -d 80.91.161.93 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.2.11 -d 80.91.161.93 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.119 -d 160.254.119.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.119 -d 160.254.119.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.108 -d 193.111.173.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.108 -d 193.111.173.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.2.47 -d 206.201.228.* -p tcp -m tcp -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.2.47 -d 206.201.227.* -p tcp -m tcp -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.138 -d 80.91.160.90 -p tcp -m tcp --dport 2303 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.0.149 -d 80.91.160.90 -p tcp -m tcp --dport 2303 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.0.3 -d 213.179.244.52 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.132 -d 213.179.244.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.37 -d 213.179.244.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.66 -d 213.179.244.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.129 -d 213.179.244.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.65 -d 160.254.119.37 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.77 -d 194.44.66.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.65 -d 213.61.246.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.119 -d 213.61.246.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.123 -d 213.61.246.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.119 -d 160.254.119.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.65 -d 160.254.119.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.119 -d 160.254.119.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.12.0/255.255.255.0 -d 206.201.227.* -p tcp -m tcp --dport 3579 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.15.0/255.255.255.0 -d 206.201.227.* -p tcp -m tcp --dport 3579 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.15.0/255.255.255.0 -d 206.201.227.* -p tcp -m tcp --dport 3580 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.12.0/255.255.255.0 -d 206.201.227.* -p tcp -m tcp --dport 3580 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.12.0/255.255.255.0 -d 206.201.228.* -p tcp -m tcp --dport 3580 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.15.0/255.255.255.0 -d 206.201.228.* -p tcp -m tcp --dport 3580 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.12.0/255.255.255.0 -d 206.201.228.* -p tcp -m tcp --dport 3579 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.15.0/255.255.255.0 -d 206.201.228.* -p tcp -m tcp --dport 3579 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.14.0/255.255.255.0 -d 206.201.227.* -p tcp -m tcp --dport 3579 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.14.0/255.255.255.0 -d 206.201.227.* -p tcp -m tcp --dport 3580 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.14.0/255.255.255.0 -d 206.201.228.* -p tcp -m tcp --dport 3579 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.14.0/255.255.255.0 -d 206.201.228.* -p tcp -m tcp --dport 3580 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.14.0/255.255.255.0 -d 195.248.166.* -p tcp -m tcp --dport 18443 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.25 -d 195.248.166.* -p tcp -m tcp --dport 18443 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.11.0/255.255.255.0 -d 206.201.227.* -p tcp -m tcp --dport 3579 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.11.0/255.255.255.0 -d 206.201.227.* -p tcp -m tcp --dport 3580 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.11.0/255.255.255.0 -d 206.201.228.* -p tcp -m tcp --dport 3579 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.11.0/255.255.255.0 -d 206.201.228.* -p tcp -m tcp --dport 3580 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.10.0/255.255.255.0 -d 206.201.227.* -p tcp -m tcp --dport 3579 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.10.0/255.255.255.0 -d 206.201.227.* -p tcp -m tcp --dport 3580 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.10.0/255.255.255.0 -d 206.201.228.* -p tcp -m tcp --dport 3579 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 192.168.10.0/255.255.255.0 -d 206.201.228.* -p tcp -m tcp --dport 3580 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.164 -d 193.111.173.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.41 -d 193.125.78.* -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.83 -d 193.125.78.*-j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.76 -d 193.111.173.* -p tcp -m tcp --dport 8080 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.0.214 -d 80.91.160.* -p tcp -m tcp --dport 2303 -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.30 -d 212.90.167.* -p tcp -m tcp -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.77 -d 217.20.184.* -p tcp -m tcp -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.2.12 -d 194.44.66.* -p tcp -m tcp -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.193 -d 206.201.227.* -p tcp -m tcp -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.193 -d 206.201.228.* -p tcp -m tcp -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.47 -d 213.133.160.* -p tcp -m tcp -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.51 -d 213.133.160.* -p tcp -m tcp -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.95 -d 213.133.160.* -p tcp -m tcp -j SNAT --to-source 217.20.182.*
-A POSTROUTING -s 10.0.1.95 -d 213.133.160.* -p tcp -m tcp -j SNAT --to-source 217.20.182.*
COMMIT
# Completed on Fri Nov 16 09:09:07 2007
# Generated by iptables-save v1.3.8 on Fri Nov 16 09:09:07 2007
*mangle
:PREROUTING ACCEPT [503765:176310631]
:INPUT ACCEPT [19897:3160529]
:FORWARD ACCEPT [482524:172751281]
:OUTPUT ACCEPT [19668:*9093]
:POSTROUTING ACCEPT [502129:174727332]
-A PREROUTING -j MARK --set-mark 0x32
COMMIT
# Completed on Fri Nov 16 09:09:07 2007
# Generated by iptables-save v1.3.8 on Fri Nov 16 09:09:07 2007
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [19668:*9093]
:PORT01_IN - [0:0]
:PORT01_OUT - [0:0]
:PORT02_IN - [0:0]
:PORT02_OUT - [0:0]
:PORT03_IN - [0:0]
:PORT03_OUT - [0:0]
:PORT04_IN - [0:0]
:PORT04_OUT - [0:0]
:PORT05_IN - [0:0]
:PORT05_OUT - [0:0]
:PORT06_IN - [0:0]
:PORT06_OUT - [0:0]
:PORT07_IN - [0:0]
:PORT07_OUT - [0:0]
:PORT08_IN - [0:0]
:PORT08_OUT - [0:0]
:PORT09_IN - [0:0]
:PORT09_OUT - [0:0]
:PORT10_IN - [0:0]
:PORT10_OUT - [0:0]
:PORT11_IN - [0:0]
:PORT11_OUT - [0:0]
:PORT12_IN - [0:0]
:PORT12_OUT - [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -s 192.168.135.0/255.255.255.0 -j ACCEPT
-A INPUT -s 194.90.34.6 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -s 192.168.135.222 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3389 -j ACCEPT
-A INPUT -s 10.0.3.1 -d 10.0.2.250 -j ACCEPT
-A INPUT -m iprange --src-range 10.0.2.200-10.0.2.249 -j ACCEPT
-A INPUT -s 195.140.178.653 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -s 193.47.137.641 -p icmp -j ACCEPT
-A INPUT -s 217.20.191.600/255.255.255.192 -p icmp -j ACCEPT
-A INPUT -s 193.125.78.617 -p icmp -j ACCEPT
-A INPUT -s 217.10.38.609 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3389 -j ACCEPT
#-A INPUT -s 10.0.1.83 -j ACCEPT
#-A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.0.1.61 -j DROP
-A INPUT -s 10.0.1.80 -j DROP
-A INPUT -s 212.82.216.* -p icmp -j ACCEPT
-A INPUT -s 193.201.116.2 -p icmp -j ACCEPT
-A INPUT -s 195.149.112.1 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -j RH-Firewall-1-INPUT
-A INPUT -s 193.219.194.9 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -s 193.219.194.7 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -s 194.67.57.50 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 25 -j PORT01_IN
-A INPUT -p tcp -m tcp --dport 21 -j PORT02_IN
-A INPUT -p tcp -m tcp --dport 80 -j PORT03_IN
-A INPUT -p tcp -m tcp --dport 8088 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j PORT04_IN
-A INPUT -p tcp -m tcp --dport 110 -j PORT06_IN
-A INPUT -p tcp -m tcp --dport 139 -j PORT07_IN
-A INPUT -p tcp -m tcp --dport 3306 -j PORT08_IN
-A INPUT -p tcp -m tcp --dport 4559 -j PORT09_IN
-A INPUT -p tcp -m tcp --dport 8080 -j PORT10_IN
-A INPUT -p tcp -m tcp --dport 53 -j PORT11_IN
-A INPUT -p tcp -m tcp --dport 5900 -j PORT12_IN
-A FORWARD -s 192.168.135.0/255.255.255.0 -j ACCEPT
-A FORWARD -s 192.168.135.222 -j ACCEPT
-A FORWARD -p udp -m udp --dport 4500 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 143 -j ACCEPT
-A FORWARD -p udp -m udp --dport 4500 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 3389 -j ACCEPT
#-A FORWARD -p tcp -m tcp --dport 5280 -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -i ppp+ -o eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1024
-A FORWARD -s 10.0.1.61 -j DROP
-A FORWARD -s 10.0.1.80 -j DROP
-A FORWARD -i eth1 -o eth0 -p gre -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j RH-Firewall-1-INPUT
-A OUTPUT -p tcp -m tcp --sport 25 -j PORT01_OUT
-A OUTPUT -p tcp -m tcp --sport 21 -j PORT02_OUT
-A OUTPUT -p tcp -m tcp --sport 80 -j PORT03_OUT
-A OUTPUT -p tcp -m tcp --sport 22 -j PORT04_OUT
-A OUTPUT -p tcp -m tcp --sport 110 -j PORT06_OUT
-A OUTPUT -p tcp -m tcp --sport 139 -j PORT07_OUT
-A OUTPUT -p tcp -m tcp --sport 3306 -j PORT08_OUT
-A OUTPUT -p tcp -m tcp --sport 4559 -j PORT09_OUT
-A OUTPUT -p tcp -m tcp --sport 8080 -j PORT10_OUT
-A OUTPUT -p tcp -m tcp --sport 53 -j PORT11_OUT
-A OUTPUT -p tcp -m tcp --sport 5900 -j PORT12_OUT
-A RH-Firewall-1-INPUT -m iprange --src-range 10.0.2.200-10.0.2.249 -j ACCEPT
-A RH-Firewall-1-INPUT -s 81.23.22.1 -p tcp -m tcp --dport 23 -m state --state NEW -j ACCEPT
#-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 5223 -m state --state NEW -j ACCEPT
#-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 5222 -m state --state NEW -j ACCEPT
#-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 6222 -m state --state NEW -j ACCEPT
#-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 6223 -m state --state NEW -j ACCEPT
#-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 5269 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -s 212.40.34.149 -j REJECT --reject-with icmp-port-unreachable
-A RH-Firewall-1-INPUT -s 209.249.64.204 -j REJECT --reject-with icmp-port-unreachable
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 8080 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.0/255.0.0.0 -i eth1 -j DROP
-A RH-Firewall-1-INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP
-A RH-Firewall-1-INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j ULOG --ulog-prefix "New not syn:"
-A RH-Firewall-1-INPUT -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -p gre -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 8088 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 143 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 110 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 995 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 993 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 2401 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 21 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 25 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 1723 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 500 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 2000 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 2727 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 4520 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 4569 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 5060 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
#-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 4406 -m state --state NEW -j ACCEPT
#-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 3128 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.156 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.0.20 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.0.21 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.0.120 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.0.121 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.121 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.122 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.31 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.103 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.54 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.39 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.2.251 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.59 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.2.10 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.2.12 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.65 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.119 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.0.23 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.21 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.221 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.139 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.254 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.0.22 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.0.11 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.0.111 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.0.211 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.0.214 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.0.1.40 -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -i eth1 -j ULOG --ulog-prefix "DROPPED"
#-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Fri Nov 16 09:09:07 2007

  • #2 перенос правил iptables на другой линух, !*! wertik, 15:56 , 21-Окт-08 (1)
    • #2 перенос правил iptables на другой линух, !*! 100matolog, 16:04 , 21-Окт-08 (2)
      >а руками 221 строчку ввести  и показать ошибку?

      простите - но, что сделать?

      • #2 перенос правил iptables на другой линух, !*! wertik, 16:18 , 21-Окт-08 (3)
        • #2 перенос правил iptables на другой линух, !*! 100matolog, 16:30 , 21-Окт-08 (4)
          >>>а руками 221 строчку ввести  и показать ошибку?
          >>
          >>простите - но, что сделать?
          >
          >правило руками забить

          какое правило?

          • #2 перенос правил iptables на другой линух, !*! wertik, 16:35 , 21-Окт-08 (5)
            • #2 перенос правил iptables на другой линух, !*! 100matolog, 16:36 , 21-Окт-08 (6)
              >>>>>а руками 221 строчку ввести  и показать ошибку?
              >>>>
              >>>>простите - но, что сделать?
              >>>
              >>>правило руками забить
              >>
              >>какое правило?
              >
              >почему именно iptables-restore < iptables
              >попробуйте iptables-restore iptables

              пробывал - тот же результат

              • #2 перенос правил iptables на другой линух, !*! wertik, 16:39 , 21-Окт-08 (7)
                • #2 перенос правил iptables на другой линух, !*! 100matolog, 16:42 , 21-Окт-08 (8)
                  >[оверквотинг удален]
                  >>>>>правило руками забить
                  >>>>
                  >>>>какое правило?
                  >>>
                  >>>почему именно iptables-restore < iptables
                  >>>попробуйте iptables-restore iptables
                  >>
                  >>пробывал - тот же результат
                  >
                  >я бы тогда strace юзал.

                  Если можно - поподробнее об strace

                  • #2 перенос правил iptables на другой линух, !*! wertik, 16:43 , 21-Окт-08 (9)
                    • #2 перенос правил iptables на другой линух, !*! wertik, 16:44 , 21-Окт-08 (10)
                    • #2 перенос правил iptables на другой линух, !*! 100matolog, 16:46 , 21-Окт-08 (11)
                      >[оверквотинг удален]
                      >>>>>почему именно iptables-restore < iptables
                      >>>>>попробуйте iptables-restore iptables
                      >>>>
                      >>>>пробывал - тот же результат
                      >>>
                      >>>я бы тогда strace юзал.
                      >>
                      >>Если можно - поподробнее об strace
                      >
                      >strace iptables-restore iptables

                      Ммм...а что должно получится после strace iptables. Он мне вывел на екран кучу текста - н е более

                      • #2 перенос правил iptables на другой линух, !*! wertik, 16:49 , 21-Окт-08 (12)
                        • #2 перенос правил iptables на другой линух, !*! 100matolog, 17:17 , 21-Окт-08 (13)
                          >[оверквотинг удален]
                          >>>>
                          >>>>Если можно - поподробнее об strace
                          >>>
                          >>>strace iptables-restore iptables
                          >>
                          >>Ммм...а что должно получится после strace iptables. Он мне вывел на екран
                          >>кучу текста - н е более
                          >
                          >man strace
                          >если как ты говоришь ошибка , то ищи в выдове strace.

                          вот такое я получилexecve("/sbin/iptables", ["iptables"], [/* 25 vars */]) = 0
                          brk(0)                                  = 0x913c000
                          access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
                          open("/etc/ld.so.cache", O_RDONLY)      = 3
                          fstat64(3, {st_mode=S_IFREG|0644, st_size=49131, ...}) = 0
                          mmap2(NULL, 49131, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f85000
                          close(3)                                = 0
                          open("/lib/libdl.so.2", O_RDONLY)       = 3
                          read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`\n\0\0004\0\0\0"..., 512) = 512
                          fstat64(3, {st_mode=S_IFREG|0755, st_size=18568, ...}) = 0
                          mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f84000
                          mmap2(NULL, 16500, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x12f000
                          mmap2(0x132000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2) = 0x132000
                          close(3)                                = 0
                          open("/lib/libm.so.6", O_RDONLY)        = 3
                          read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0 4\0\0004\0\0\0"..., 512) = 512
                          fstat64(3, {st_mode=S_IFREG|0755, st_size=208196, ...}) = 0
                          mmap2(NULL, 163952, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x134000
                          mmap2(0x15b000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x26) = 0x15b000
                          close(3)                                = 0
                          open("/lib/libc.so.6", O_RDONLY)        = 3
                          read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@g\1\0004\0\0\0"..., 512) = 512
                          fstat64(3, {st_mode=S_IFREG|0755, st_size=1755032, ...}) = 0
                          mmap2(NULL, 1476176, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x15d000
                          mmap2(0x2c0000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x163) = 0x2c0000
                          mmap2(0x2c3000, 9808, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2c3000
                          close(3)                                = 0
                          mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f83000
                          set_thread_area({entry_number:-1 -> 6, base_addr:0xb7f836c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
                          mprotect(0x2c0000, 8192, PROT_READ)     = 0
                          mprotect(0x15b000, 4096, PROT_READ)     = 0
                          mprotect(0x132000, 4096, PROT_READ)     = 0
                          mprotect(0x12c000, 4096, PROT_READ)     = 0
                          munmap(0xb7f85000, 49131)               = 0
                          write(2, "iptables v1.4.1.1: ", 19iptables v1.4.1.1: )     = 19
                          write(2, "no command specified", 20no command specified)    = 20
                          write(2, "\n", 1
                          )                       = 1
                          write(2, "Try `iptables -h\' or \'iptables -"..., 61Try `iptables -h' or 'iptables --help' for more information.
                          ) = 61
                          exit_group(2)                           = ?




Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру