How to block webinterface of my asus with iptables

Printable View

31-08-2009, 23:44
wmzyk

How to block webinterface of my asus with iptables

Hi
My post-firewall file is simple so far

Code:

#!/bin/sh iptables -D INPUT -j DROP iptables -A INPUT -p udp --dport 21 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 81 -j ACCEPT iptables -A INPUT -p tcp --dport 12000 -j ACCEPT iptables -A INPUT -p tcp --dport 6112 -j ACCEPT iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 6112 -j DNAT --to-destinati iptables -A INPUT -j DROP

could anyone help me add a line which blocks webinterface from wireless clinets and only webinterface
01-09-2009, 09:12
wpte

You used the command already once: "DROP"
usually port 80 is the webinterface... not sure what you have

anyway, just put "DROP" instead of "ACCEPT" and you have the code:

Quote:

iptables -A INPUT -p tcp --dport 80 -j DROP

easy:)

your iptables look good btw;)
however, these portforwards:

Quote:

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 6112 -j DNAT --to-destinati

are usually not needed when the service already runs on the ip-adress needed
01-09-2009, 14:33
wmzyk

You missunderstood me :)

Code:

iptables -A INPUT -p tcp --dport 12000 -j ACCEPT

ssh dropbear

Code:

iptables -A INPUT -p tcp --dport 81 -j ACCEPT iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.1:81

this should allow access from wan to my webserwer placed on asus apache

Code:

iptables -A INPUT -p tcp --dport 6112 -j ACCEPT iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 6112 -j DNAT --to-destination 192.168.1.2:6112

Warcraft part :)

Now i need to drop connections made from WLAN to webinterface of asus (still on port 80) but ofc i want to allow surfing web on those ones

Putting

iptables -A INPUT -p tcp -i eth2 --doprt 80 -d 192.168.1.1 -j DROP

doesnt change anything
03-09-2009, 13:34
wmzyk

Really no one can help me ? :confused:
05-09-2009, 00:07
wpte

Quote:

Originally Posted by wmzyk

Really no one can help me ? :confused:

Basicly what you want is that people on the wireless lan can't connect to the webinterface?
I'm still a bit unsure if that's possible, I need to overthink this:p