AW: [suse-security] ipchains with dynamic IP
You could apply your rule just to the incomming interface (e.g. "ipchains -A input -i eth1 -s 0/0 -p tcp -y -l -j DENY") Or, more elegantly, you could apply your rules from your ip-up script and fetch the ip address from ifconfig or dns or whatever: ip_addr=`ifconfig eth0 | grep "inet addr" | awk '{ print $2}' | awk -F : '{print $2}'` ... ipchains -A -s 0/0 -d $ip_addr 22 -p tcp -y -l -j ACCEPT ... regards, Stefan -----Ursprüngliche Nachricht----- Von: Eduard Meiler [mailto:edik@meiler.org] Gesendet: Mittwoch, 31. Oktober 2001 16:48 An: suse-security@suse.com Betreff: [suse-security] ipchains with dynamic IP Hallo, a simple question. I'm running Suse Linux 7.2 with DSL ans I use damon dsl, which is starting pppd with pppoe. Now the connection is fine. I would like to put in the dsl script the Ipchains rules. How I tell this rules the IP for eth1, which is a dynamic IP from the Provider ? regards eduard
On Wed, Oct 31, 2001 at 17:06 +0100, Peer Stefan wrote:
Or, more elegantly, you could apply your rules from your ip-up script and fetch the ip address from ifconfig or dns or whatever: ip_addr=`ifconfig eth0 | grep "inet addr" | awk '{ print $2}' | awk -F : '{print $2}'` ... ipchains -A -s 0/0 -d $ip_addr 22 -p tcp -y -l -j ACCEPT ...
Why would you do that? The (i)pppd hooks ip-up and ip-down already provide the IP (and some more things of interest) in their parameter list. "man pppd" usually holds the necessary information. Another point: Running grep(1) on ifconfig(8) output - and surely others - does not always work. Some braindea^H^H^W misguided programmer thought it would be a bright idea to put NLS support in these system query tools and now annoys users and administrators with "friendly" output while breaking those recipients who aren't programmed by fuzzy logic means. :[ I guess that's why SuSE nowadays has different locales for administrative and "real person" accounts? (sic) virtually yours 82D1 9B9C 01DC 4FB4 D7B4 61BE 3F49 4F77 72DE DA76 Gerhard Sittig true | mail -s "get gpg key" Gerhard.Sittig@gmx.net -- If you don't understand or are scared by any of the above ask your parents or an adult to help you.
Silly me. And here I thought a machine with basically one ip per interface you could just specify the interface in your rules and ignore destination IP essentially, so with intelligent firewall rules why do you need to know your dialup ip or whatever? Aaaaanyways. Kurt Seifried, kurt@seifried.org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.seifried.org/security/
participants (3)
-
Gerhard Sittig -
Kurt Seifried -
Peer Stefan