Page 1 of 1
Firewall build on ports to give a specific service
Posted: Thu Apr 20, 2006 10:51 am
by ramona
hi
i have a problem and i need help guys to solve it
i have already a pppoe server running and all good except i want my users
to take only this ports : 80 , 1863 , 6667-7000
i tried to configure it in firewall but i dont success
if any one can help plz and thanks
Posted: Thu Apr 20, 2006 11:58 am
by Gotmoh
hi there.
Im not sure. Youre wanna permitt only for those ports and drop everything other? Whase problem? I have similary configuration at my company. Users can only using on selected ports and all other are dropped. I using rules in firewall forward. Have few rules. Just all packets from specific valid ip (takes from ip address lists) accept to destination on selected protocol to destination port. Im leasy and returns packet are permitted on all ports to valid ip. Sorry for bad language but english isnt my native.
D.
Posted: Thu Apr 20, 2006 12:47 pm
by ramona
Gotmoh can u provide with your configuration and a backup plz for it
plz send it to my mail
lookinsideme@gmail.com and i will be appreciate .
Posted: Thu Apr 20, 2006 2:09 pm
by savage
It's really simple... Don't see what you could be battling with.
/ip firewall filter chain=forward src-address=x.x.x.x/x dst-port=80 action=accept
A basic rule like that to allow all your clients to each outbound port you want to allow, then
/ip firewall filter chain=forward action=reject
To reject any data being forwarded that is not explicitly allowed by your forwarding rules...
Nothing hard about it
--
C
Posted: Thu Apr 20, 2006 3:17 pm
by Gotmoh
Email sent to you Ramona.
Posted: Thu Apr 20, 2006 3:18 pm
by normis
better `drop` not `reject`.
Posted: Thu Apr 20, 2006 7:49 pm
by ramona
Posted: Thu Apr 20, 2006 8:18 pm
by savage
better `drop` not `reject`.
That's really a matter of personal opinion. Drop will cause delays on clients as clients will wait for a timeout. Reject will inform the client the connection is rejected, and a immediate error is given - in exchange for a ICMP message -g-
Router wise yes, Drop is less work and quicker, but to be user friendly, a reject is much more informative.
