Next Previous Contents

## 5. Rusty's Really Quick Guide To Packet Filtering

Most people just have a single PPP connection to the Internet, and don't want anyone coming back into their network, or the firewall:

> `

>     ## Insert connection-tracking modules (not needed if built into kernel).
>     # insmod ip_conntrack
>     # insmod ip_conntrack_ftp

>     ## Create chain which blocks new connections, except if coming from inside.
>     # iptables -N block
>     # iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
>     # iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT
>     # iptables -A block -j DROP

>     ## Jump to that chain from INPUT and FORWARD chains.
>     # iptables -A INPUT -j block
>     # iptables -A FORWARD -j block

> `

Next Previous Contents