Thanks! I think that made it pretty clear for me.
Can't "block" the telnet as The server I need to telnet into
is at my ISP and therefore allowing me to type this message :-)
Really appreciate the time you took explaining: Now I can apply
it to the rest of my rules.
Mike
>
> Am 31. Aug, 2000 schwäzte Mike Starke so:
>
> > Would someone be willing to explain the -y flag in ipchains for me?
>
> Y, because we love you. M-O-U-... :)
>
> [!] -y, --syn
> Only match TCP packets with the SYN bit set and the
> ACK and FIN bits cleared. Such packets are used to
> request TCP connection initiation; for example,
> blocking such packets coming in an interface will
> prevent incoming TCP connections, but outgoing TCP
> connections will be unaffected. This option is
> only meaningful when the protocol type is set to
> TCP. If the "!" flag precedes the "-y", the sense
> of the option is inverted.
>
> What that means is the -y flags match packets initiating a tcp
> connection. The initiation has to be accepted for any other packets to be
> able to do something. By blocking the initiation packets, you're
> preventing tcp connections from being established, e.g. if you block them
> from port 80 nobody can connect to your web server.
>
> This does not affect udp connections. Look in /etc/services to find out
> what type of service and what port something should be on.
>
> > Maybe an example of when/why it would be used?
> >
> > I want to allow telnet to a outside (internet) server only
> > when the connection is initiated by a certain internal (192.168.2.x)
> > ip.
>
> ipchains -A int-in -j ACCEPT -p TCP -y -s 192.168.2.x/32 23
> ipchains -A int-in -j DENY -p TCP -y -s 0/0 23
>
> int-in is what I call the chain for incoming connections on the internal
> (to my network) card.
>
> Now if you don't do anything else to port 23 telnet connections from
> 192.168.2.x will work, but not from anywhere else.
>
> Better off removing telnetd altogether and setting up ssh :).
>
> ciao,
>
> der.hans
> --
> # der.hans@LuftHans.com home.pages.de/~lufthans/ www.Opnix.com
> # I'm not anti-social, I'm pro-individual. - der.hans
>
>
> ________________________________________________
> See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't post to the list quickly and you use Netscape to write mail.
>
> Plug-discuss mailing list - Plug-discuss@lists.PLUG.phoenix.az.us
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
(text/plain)