Dotaz: Zabranenie pristupu odkazanim na stranku

[jurating]

Zdravim
Mam slack 10, kde bezi apache, a robi pripojenie do netu pre ostatne PC. Mam nastavene filtrovanie paketov pre postrouting pre dane ip adresy. chcel by som docielit, aby uzivatelom, ktori nemaju tieto dane ip nali na browseri zobrazene iba web stranku na pc s IP 10.1.3.2 ps. linux je 10.1.3.1 / ak treba/

Odpovědi

[Hynek "rADOn" Fabian]

# man iptables
[...]

REDIRECT

This target is only valid in the nat table, in the PREROUTING and OUTPUT chains, and user-defined chains which are only called from those chains. It alters the destination IP address to send the packet to the machine itself (locally-generated packets are mapped to the 127.0.0.1 address). It takes one option:

--to-ports port[-port] This specifies a destination port or range of ports to use: without this, the destination port is never altered. This is only valid if the rule also specifies -p tcp or -p udp.

[...]

[jurating]

to je pekne ale funguje to na porty ne na ip.....

[Martin H.]

to je pekne ale funguje to na porty ne na ip.....

Tomu nerozumím ... pokud bude pravidlo v pořadí: povolené adresy mohou přes port80 a zbytek je REDIRECT na IP 10.x.x.x --dport 80, tak proč by to nemělo chodit?

V opačném případě by byla ještě asi možnost použít SQUIDa, všechny požadavky na portu 80 směrovat na něj a tam rozhodnout, co dál ...

[jurating]

default je drop
povolene adresy maju povoleny postrouting... -j ACCEPT
ale co ostatne????

[jurating]

uvediem priklad....
jedna sa o postrouting
Accept If input interface is eth0 and output interface is eth1 and state of connection is ESTABLISHED,RELATED
Accept If source is 10.1.3.50 and input interface is eth1 and ethernet address is 00:0d:87:5a:55:28
a default je drop