[megoldva] no-IP + tűzfal

Hello,
Nálam ez van iptables-ben.

# Allow no-ip.org
iptables -A INPUT -p tcp -s 204.16.252.97 --sport 8245 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -d 204.16.252.97 --dport 8245 -m state --state NEW,ESTABLISHED -j ACCEPT

www.no-ip.com/support && search keyword: "firewall"

"1. I am behind a firewall can I use no-ip.com's service?
If you are behind a firewall adding a hostname will only make an alias to your firewall and not your individual machine. In order to direct the requests to a computer behind the firewall you must setup port forwarding on the firewall.

2. What port does the dynamic update client use?
The No-IP supported update clients communicate to our update server via TCP port 8245. If you are using a firewall you need to configure it to allow this port. Other update clients may use port 80."

Szervusz Arkhein!

Nálam megy FreeBSD alatt rendben, IPFW-t használok. Ez van a /etc/rc.firewall -ban:

[Cc][Ll][Ii][Ee][Nn][Tt])
        ############
        # This is a prototype setup that will protect your system somewhat
        # against people from outside your own network.
        ############

        # set these to your network and netmask and ip
        #net="192.168.*.0"
        #mask="255.255.255.0"
        ip="192.168.*.171"

        # Allow any traffic to or from my own net.
        #${fwcmd} add 1000 pass all from ${ip} to ${net}:${mask}
        #${fwcmd} add 1050 pass all from ${net}:${mask} to ${ip}
        ${fwcmd} add 1000 pass all from ${ip} to any
        ${fwcmd} add 1050 pass all from any to ${ip}

        # Allow TCP through if setup succeeded
        ${fwcmd} add 1100 pass tcp from any to any established
        ${fwcmd} add 1110 check-state
       
        # Allow IP fragments to pass through
        ${fwcmd} add 1200 pass all from any to any frag

        # Allow setup of incoming email --> SSH
        ${fwcmd} add 1300 pass tcp from any to ${ip} **** setup keep-state

        # Allow incoming & outgoing ftp
        ${fwcmd} add 1330 pass tcp from any to ${ip} **** setup keep-state
        ${fwcmd} add 1331 pass udp from any to ${ip} **** setup keep-state

        # Allow setup of outgoing TCP connections only
        ${fwcmd} add 1190 pass tcp from ${ip} to any setup

        # Disallow setup of all other TCP connections
        #${fwcmd} add 1400  deny tcp from any to any setup

        # Allow DNS queries out in the world
        ${fwcmd} add 1500 pass udp from ${ip} to any 53 keep-state

        # Allow NTP queries out in the world
        #${fwcmd} add pass udp from me to any 123 keep-state

        # Aloow to ping out the Internet
        ${fwcmd} add 1600 pass icmp from ${ip} to any

        # Allow RTorrent port 7070-7071
        ${fwcmd} add 1700 pass tcp from any to any 7070 keep-state
        ${fwcmd} add 1701 pass tcp from any to any 7071 keep-state

        # Allow FTP passive ports
        ${fwcmd} add 1800 pass tcp from any to any 49152-57344 setup
        #${fwcmd} add 1801 pass tcp from any to ${ip} 49152-57344 setup keep-state

        # Everything else is denied by default, unless the
        # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
        # config file.
        ;;

Ha esetleg segít. Úgy emlékszem, ha az 1200-as szabályt kikommenteltem, akkor nem ment a noip2 nekem se. Allow IP fragments to pass trough...

/mazursky

Love your job but never love your company!
Because you never know when your company stops loving you!