Administrace komentářů

Ahoj, mam Firehol na routeru. Je tam nainstalovane serverove ubuntu, drive jsem pouzival CentOs a firewall s pravidly nastavoval primo v iptables. Ve fireholu ale nejsem schopen nastavit presmerovani ssh na nestandardnim portu na pocitac ve vnitrni siti a manual me nepomaha :(

Nadefinuju novou sluzbu ssht:

server_ssht_ports="tcp/2222"
client_ssht_ports="default"

Pak natuju dovnitr site

nat to-destination 192.168.0.158 inface eth1 proto "tcp" dport 22

a naseledne route

route   ssht    accept  dst 192.168.0.158

Bude to tak, ze jsem neco nejspis nepochopil. Kdyz presmerovavam nejaky port na ten stejny port na danem pocitaci, tak to jede. viz oc4j.

Diky za kazdou radu

(Pro kverulanty, duvodem prechodu bylo sjednocovani domaci site na pouhe 2 distribuce XXXubuntu a Fedora. I pres vetsi vhodnost jinych pripadnych distribuci chci pouzivat prave tuto).

# $Id: client-all.conf,v 1.2 2002/12/31 15:44:34 ktsaou Exp $
#
# This configuration file will allow all requests originating from the
# local machine to be send through all network interfaces.
#
# No requests are allowed to come from the network. The host will be
# completely stealthed! It will not respond to anything, and it will
# not be pingable, although it will be able to originate anything
# (even pings to other hosts).
#

version 5

# Accept all client traffic on any interface
# interface any world
# client all accept

DEFAULT_CLIENT_PORTS="1024:65535"

server_icq_ports="tcp/5190"
client_icq_ports="default"

server_dcpp_ports="tcp/1412"
server_dcpp_ports="udp/1413"
client_dcpp_ports="default"

server_oc4j_ports="tcp/8888"
client_oc4j_ports="default"

server_ssht_ports="tcp/2222"
client_ssht_ports="default"

nat to-destination 192.168.0.158 inface eth1 proto "tcp" dport 22

interface eth0 internal
        protection      strong  10/sec  10
        policy          drop
        server  ssh     accept # povolime ssh pripojeni k serveru z vnitrni site
        server  all     accept
        client  all     accept

interface eth1 external src not "192.168.0.254"
        protection      strong  10/sec  10
        policy  drop
        server  ssh     accept # povolime ssh pripojeni k serveru z vnejsi site
        server  mysql   accept
        server  http    accept
        server  dcpp    accept
#       server  oc4j    accept
        server  ssht    accept
        client  dcpp    accept
        client  all     accept

router  incoming inface eth1 outface eth0 # ktere sluzby uvnitr site budou pristupne zvenku, viz.
        masquerade      reverse
        client  all     accept
        server  oc4j    accept
        server  ssht    accept  dst 192.168.0.158
#        route  oc4j    accept  dst 192.168.0.3
        route   ssht    accept  dst 192.168.0.158

router  outgoing inface eth0 outface eth1 # ktere sluzby v internetu budou pristupne zevnitr site
        masquerade # chceme provadet preklad adres
        route   dns     accept
        route   smtp    accept
        route   pop3    accept
        route   pop3s   accept
        route   imap    accept
        route   imaps   accept
        route   http    accept
        route   https   accept
        route   ftp     accept
        route   rdp     accept
        route   icq     accept
        route   jabber  accept
        route   rsync   accept
        route   dcpp    accept
#       route   oc4j    accept
        route   ssht    accept
        route   all     accept