---

Hej gruppe.

Mit iptables er pludselig begyndt at smide loggen til skærmen. Jeg har
prøvet at ændre på --log-level, men så logger den ikke engang i syslog
eller messages.

Hvordan kan jeg afhjælpe dette?


Mit script bliver automatisk genereret af mit eget program og ser
således ud lige pt:
#!/bin/sh

# Disable forwarding.
echo 0 > /proc/sys/net/ipv4/ip_forward

LAN_IP_NET='192.168.0.254/24'
LAN_NIC='eth1'

# Reading modules.
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp

#Flush rules.
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -t nat -F OUTPUT
iptables -F

#Drop all packets.
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

#Accept all packets on local interface and from localhost.
iptables -A INPUT -j ACCEPT -s $LAN_IP_NET
iptables -A INPUT -j ACCEPT -s 127.0.0.1
iptables -A INPUT -j ACCEPT -s localhost

#Blocks.
#Enables nat masquerade and forwarding.
iptables -t nat -A POSTROUTING -s $LAN_IP_NET -j MASQUERADE
iptables -t nat -A POSTROUTING -s $LAN_IP_NET -j LOG --log-level 3
--log-prefix "[ipt_for] "

iptables -A FORWARD -j ACCEPT -s $LAN_IP_NET
iptables -A FORWARD -j LOG --log-level 3 --log-prefix "[ipt_for] "

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j LOG
--log-level 3 --log-prefix "[ipt_for] "

#Open ports.
iptables -A INPUT -j ACCEPT -p tcp --dport 80
iptables -A INPUT -j ACCEPT -p udp --dport 80
iptables -A INPUT -j ACCEPT -p tcp --dport 21
iptables -A INPUT -j ACCEPT -p udp --dport 21
iptables -A INPUT -j ACCEPT -p tcp --dport 22
iptables -A INPUT -j ACCEPT -p udp --dport 22
iptables -A INPUT -j ACCEPT -p tcp --dport 5901
iptables -A INPUT -j ACCEPT -p udp --dport 5901
iptables -A INPUT -j ACCEPT -p tcp --dport 5900
iptables -A INPUT -j ACCEPT -p udp --dport 5900
iptables -A INPUT -j ACCEPT -p tcp --dport 49160:49300
iptables -A INPUT -j ACCEPT -p udp --dport 49160:49300
iptables -A INPUT -j ACCEPT -p tcp --dport 6112
iptables -A INPUT -j ACCEPT -p udp --dport 6112
iptables -A INPUT -j ACCEPT -p tcp --dport 8180
iptables -A INPUT -j ACCEPT -p udp --dport 8180
iptables -A INPUT -j ACCEPT -p tcp --dport 6113
iptables -A INPUT -j ACCEPT -p udp --dport 6113
iptables -A INPUT -j ACCEPT -p tcp --dport 3306
iptables -A INPUT -j ACCEPT -p udp --dport 3306
iptables -A INPUT -j ACCEPT -p tcp --dport 18308
iptables -A INPUT -j ACCEPT -p udp --dport 18308
iptables -A INPUT -j ACCEPT -p tcp --dport 8080
iptables -A INPUT -j ACCEPT -p udp --dport 8080
iptables -A INPUT -j ACCEPT -p tcp --dport 6881:6889
iptables -A INPUT -j ACCEPT -p udp --dport 6881:6889
iptables -A INPUT -j ACCEPT -p tcp --dport 4444
iptables -A INPUT -j ACCEPT -p udp --dport 4444
iptables -A INPUT -j ACCEPT -p tcp --dport 23
iptables -A INPUT -j ACCEPT -p udp --dport 23

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Port-forwarding to other computers than the server.
iptables -t nat -A PREROUTING -p tcp --dport 5901 -j DNAT --to
192.168.0.11:5901
iptables -t nat -A PREROUTING -p udp --dport 5901 -j DNAT --to
192.168.0.11:5901
iptables -t nat -A PREROUTING -p tcp --dport 5900 -j DNAT --to
192.168.0.11:5900
iptables -t nat -A PREROUTING -p udp --dport 5900 -j DNAT --to
192.168.0.11:5900
iptables -t nat -A PREROUTING -p tcp --dport 6112 -j DNAT --to
192.168.0.11:6112
iptables -t nat -A PREROUTING -p udp --dport 6112 -j DNAT --to
192.168.0.11:6112
iptables -t nat -A PREROUTING -p tcp --dport 6113 -j DNAT --to
192.168.0.113:6113
iptables -t nat -A PREROUTING -p udp --dport 6113 -j DNAT --to
192.168.0.113:6113
iptables -t nat -A PREROUTING -p tcp --dport 18308 -j DNAT --to
192.168.0.11:18308
iptables -t nat -A PREROUTING -p udp --dport 18308 -j DNAT --to
192.168.0.11:18308
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to
192.168.0.11:8080
iptables -t nat -A PREROUTING -p udp --dport 8080 -j DNAT --to
192.168.0.11:8080
iptables -t nat -A PREROUTING -p tcp --dport 6881:6889 -j DNAT --to
192.168.0.11
iptables -t nat -A PREROUTING -p udp --dport 6881:6889 -j DNAT --to
192.168.0.11
iptables -t nat -A PREROUTING -p tcp --dport 4444 -j DNAT --to
192.168.0.11:4444
iptables -t nat -A PREROUTING -p udp --dport 4444 -j DNAT --to
192.168.0.11:4444
iptables -t nat -A PREROUTING -p tcp --dport 23 -j DNAT --to 192.168.0.11:23
iptables -t nat -A PREROUTING -p udp --dport 23 -j DNAT --to 192.168.0.11:23

#Enables port-forwarding.
echo 1 > /proc/sys/net/ipv4/ip_forward

echo IPTables reloaded.


--
Med venlig hilsen
Kasper Johansen