>[оверквотинг удален] >> >>tcp multiport dports ftp-data,ftp,smtp,ni-ftp, domain >> ,http,pop3,ident,imap,https,pptp >> >>а разве слово domain неразришает в этом правеле? > >Протокол должен быть udp. > >angra правельно сказал. Правила не красивые, но с ними DNS должен работать. >Покажите вывод iptables-save. Добавил UDP 53 порт и все заработало! Спасибо! komplexb:~ # iptables-save # Generated by iptables-save v1.3.5 on Tue May 20 15:29:08 2008 *filter :INPUT DROP [8:1081] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [10110:13973110] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT -A INPUT -p tcp -m tcp -m multiport --dports 20,21,25,47,53,80,110,113,143,443,1723 -j ACCEPT -A INPUT -s 213.221.6.0/255.255.255.0 -p tcp -m tcp -m multiport --dports 22,44337,10000,3306 -j ACCEPT -A INPUT -s 10.111.0.0/255.255.0.0 -p tcp -m tcp -m multiport --dports 22,44337,10000,3306 -j ACCEPT -A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -j ACCEPT -A INPUT -p udp -m udp --dport 53 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 4 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m tcp --dport 1024:1030 -j ACCEPT -A OUTPUT -d ! 10.111.0.0/255.255.0.0 -p tcp -m tcp --dport 21 -j DROP -A OUTPUT -d 62.117.107.40 -p tcp -m tcp --dport 80 -j ACCEPT -A OUTPUT -d 10.111.2.100 -p tcp -m tcp --dport 80 -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 80 -j DROP -A OUTPUT -p tcp -m tcp --dport 30375 -j DROP COMMIT # Completed on Tue May 20 15:29:08 2008 # Generated by iptables-save v1.3.5 on Tue May 20 15:29:08 2008 *nat :PREROUTING ACCEPT [526:31806] :POSTROUTING ACCEPT [2:1582] :OUTPUT ACCEPT [2:1582] COMMIT # Completed on Tue May 20 15:29:08 2008 # Generated by iptables-save v1.3.5 on Tue May 20 15:29:08 2008 *mangle :PREROUTING ACCEPT [6486:415963] :INPUT ACCEPT [6186:398451] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [10110:13973110] :POSTROUTING ACCEPT [10110:13973110] COMMIT # Completed on Tue May 20 15:29:08 2008
|