Guapo's questions

I was trying to measure how much memory an application is using in the current moment.

So here we go, free -k -t:

[user@server ~]$ free -k -t
             total       used       free     shared    buffers     cached
Mem:       1026076     581880     444196          0     158656     269704
-/+ buffers/cache:     153520     872556
Swap:            0          0          0
Total:     1026076     581880     444196

Then pmap -x PID wanted to verify:

[user@server ~]$ pmap -x 18503
18503:   /usr/bin/java -jar /home/user/app.jar mycfg.cfg
Address           Kbytes     RSS   Dirty Mode   Mapping
0000000040000000      36      36       0 r-x--  java
0000000040108000       8       8       8 rwx--  java
00000000403d9000       4       0       0 -----    [ anon ]
00000000403da000    1024      12      12 rwx--    [ anon ]
000000004055b000      12       0       0 -----    [ anon ]
000000004055e000    1016      72      72 rwx--    [ anon ]
000000004065c000      12       0       0 -----    [ anon ]
000000004065f000    1016      72      72 rwx--    [ anon ]
00000000407ad000      12       0       0 -----    [ anon ]
00000000407b0000    1016      32      32 rwx--    [ anon ]
00000000408ae000      12       0       0 -----    [ anon ]
00000000408b1000    1016      36      36 rwx--    [ anon ]
00000000409cc000      12       0       0 -----    [ anon ]
00000000409cf000    1016     100     100 rwx--    [ anon ]
0000000040acd000      12       0       0 -----    [ anon ]
0000000040ad0000    1016      72      72 rwx--    [ anon ]
0000000040bce000      12       0       0 -----    [ anon ]
0000000040bd1000    1016      40      40 rwx--    [ anon ]
0000000040ccf000      12       0       0 -----    [ anon ]
0000000040cd2000    1016      36      36 rwx--    [ anon ]
0000000040e8a000      12       0       0 -----    [ anon ]
0000000040e8d000    1016      68      68 rwx--    [ anon ]
0000000040f8b000      12       0       0 -----    [ anon ]
0000000040f8e000    1016      68      68 rwx--    [ anon ]
00000000410dd000      12       0       0 -----    [ anon ]
00000000410e0000    1016      68      68 rwx--    [ anon ]
00000000411de000      12       0       0 -----    [ anon ]
00000000411e1000    1016      36      36 rwx--    [ anon ]
00000000412df000      12       0       0 -----    [ anon ]
00000000412e2000    1016      40      40 rwx--    [ anon ]
000000004144a000      12       0       0 -----    [ anon ]
000000004144d000    1016       8       8 rwx--    [ anon ]
000000004154b000      12       0       0 -----    [ anon ]
000000004154e000    1016      48      48 rwx--    [ anon ]
00000000416a7000      12       0       0 -----    [ anon ]
00000000416aa000    1016      36      36 rwx--    [ anon ]
00000000417a8000      12       0       0 -----    [ anon ]
00000000417ab000    1016      40      40 rwx--    [ anon ]
00000000418ec000      12       0       0 -----    [ anon ]
00000000418ef000    1016      40      40 rwx--    [ anon ]
00000000419ed000      12       0       0 -----    [ anon ]
00000000419f0000    1016      36      36 rwx--    [ anon ]
0000000041aee000      12       0       0 -----    [ anon ]
0000000041af1000    1016      40      40 rwx--    [ anon ]
0000000041c54000      12       0       0 -----    [ anon ]
0000000041c57000    1016      36      36 rwx--    [ anon ]
0000000041d55000      12       0       0 -----    [ anon ]
0000000041d58000    1016       8       8 rwx--    [ anon ]
0000000041e56000       4       0       0 -----    [ anon ]
0000000041e57000    1024       8       8 rwx--    [ anon ]
0000000041f57000      12       0       0 -----    [ anon ]
0000000041f5a000    1016      44      44 rwx--    [ anon ]
0000000042058000      12       0       0 -----    [ anon ]
000000004205b000    1016      68      68 rwx--    [ anon ]
0000000042159000      12       0       0 -----    [ anon ]
000000004215c000    1016      32      32 rwx--    [ anon ]
000000005e532000   10308   10272   10272 rwx--    [ anon ]
00000000eb200000    5312    5312    5312 rwx--    [ anon ]
00000000eb730000   80704       0       0 rwx--    [ anon ]
00000000f0600000   10752    5856    5856 rwx--    [ anon ]
00000000f1080000  161280       0       0 rwx--    [ anon ]
00000000fae00000   21248   11144   11144 rwx--    [ anon ]
00000000fc2c0000   62720       0       0 rwx--    [ anon ]
0000003ac7e00000     112     104       0 r-x--  ld-2.5.so
0000003ac801c000       4       4       4 r-x--  ld-2.5.so
0000003ac801d000       4       4       4 rwx--  ld-2.5.so
0000003ac8200000    1336     540       0 r-x--  libc-2.5.so
0000003ac834e000    2048       0       0 -----  libc-2.5.so
0000003ac854e000      16      16       8 r-x--  libc-2.5.so
0000003ac8552000       4       4       4 rwx--  libc-2.5.so
0000003ac8553000      20      20      20 rwx--    [ anon ]
0000003ac8600000       8       8       0 r-x--  libdl-2.5.so
0000003ac8602000    2048       0       0 -----  libdl-2.5.so
0000003ac8802000       4       4       4 r-x--  libdl-2.5.so
0000003ac8803000       4       4       4 rwx--  libdl-2.5.so
0000003ac8a00000      88      64       0 r-x--  libpthread-2.5.so
0000003ac8a16000    2044       0       0 -----  libpthread-2.5.so
0000003ac8c15000       4       4       4 r-x--  libpthread-2.5.so
0000003ac8c16000       4       4       4 rwx--  libpthread-2.5.so
0000003ac8c17000      16       4       4 rwx--    [ anon ]
0000003ac8e00000     520      20       0 r-x--  libm-2.5.so
0000003ac8e82000    2044       0       0 -----  libm-2.5.so
0000003ac9081000       4       4       4 r-x--  libm-2.5.so
0000003ac9082000       4       4       4 rwx--  libm-2.5.so
0000003ac9e00000      28      20       0 r-x--  librt-2.5.so
0000003ac9e07000    2048       0       0 -----  librt-2.5.so
0000003aca007000       4       4       4 r-x--  librt-2.5.so
0000003aca008000       4       4       4 rwx--  librt-2.5.so
0000003acc600000      84      24       0 r-x--  libnsl-2.5.so
0000003acc615000    2044       0       0 -----  libnsl-2.5.so
0000003acc814000       4       4       4 r-x--  libnsl-2.5.so
0000003acc815000       4       4       4 rwx--  libnsl-2.5.so
0000003acc816000       8       0       0 rwx--    [ anon ]
0000003acce00000      68      52       0 r-x--  libresolv-2.5.so
0000003acce11000    2048       0       0 -----  libresolv-2.5.so
0000003acd011000       4       4       4 r-x--  libresolv-2.5.so
0000003acd012000       4       4       4 rwx--  libresolv-2.5.so
0000003acd013000       8       4       0 rwx--    [ anon ]
00002aaaaaaab000       8       8       0 r-xs-  gcb.jar
00002aaaaaaad000      32      32       0 r-xs-  resources.jar
00002aaaaaaba000      52      52       0 r-x--  libverify.so
00002aaaaaac7000    1020       0       0 -----  libverify.so
00002aaaaabc6000      12      12      12 rwx--  libverify.so
00002aaaaabc9000     164     132       0 r-x--  libjava.so
00002aaaaabf2000    1020       0       0 -----  libjava.so
00002aaaaacf1000      28      20      20 rwx--  libjava.so
00002aaaaacf8000       4       4       0 r-x--    [ anon ]
00002aaaaacf9000       4       4       4 rwx--    [ anon ]
00002aaaaacfa000      32      32      12 rwxs-  18503
00002aaaaad08000      40      24       0 r-x--  libnss_files-2.5.so
00002aaaaad12000    2044       0       0 -----  libnss_files-2.5.so
00002aaaaaf11000       4       4       4 r-x--  libnss_files-2.5.so
00002aaaaaf12000       4       4       4 rwx--  libnss_files-2.5.so
00002aaaaaf13000      56      56       0 r-x--  libzip.so
00002aaaaaf21000    1032       0       0 -----  libzip.so
00002aaaab023000      12      12      12 rwx--  libzip.so
00002aaaab026000    2500    1168    1168 rwx--    [ anon ]
00002aaaab297000   46656       0       0 rwx--    [ anon ]
00002aaaae027000      40      40      40 rwx--    [ anon ]
00002aaaae031000     728       0       0 rwx--    [ anon ]
00002aaaae0e7000      12      12      12 rwx--    [ anon ]
00002aaaae0ea000     156       0       0 rwx--    [ anon ]
00002aaaae111000      24      24      24 rwx--    [ anon ]
00002aaaae117000     312       0       0 rwx--    [ anon ]
00002aaaae165000      44      44      44 rwx--    [ anon ]
00002aaaae170000     120       0       0 rwx--    [ anon ]
00002aaaae18e000      28      16      16 rwx--    [ anon ]
00002aaaae195000     316       0       0 rwx--    [ anon ]
00002aaaae1e4000      44      24      24 rwx--    [ anon ]
00002aaaae1ef000     124       0       0 rwx--    [ anon ]
00002aaaae20e000    1632    1632       0 r-xs-  rt.jar
00002aaaae3a6000     208     208     208 rwx--    [ anon ]
00002aaaae3da000   55144      44       0 r-x--  locale-archive
00002aaab19b4000     160     160       0 r-xs-  bcprov-jdk15-146.jar
00002aaab19dc000      28      28       0 r-xs-  mysql-connector-java-5.1.13-bin.jar
00002aaab19e3000      24      24       0 r-xs-  commons-configuration-1.6.jar
00002aaab19e9000      20      20       0 r-xs-  commons-lang-2.5.jar
00002aaab19ee000       8       8       0 r-xs-  commons-logging-1.1.1.jar
00002aaab19f0000      56      56       0 r-xs-  commons-collections-3.2.1.jar
00002aaab19fe000      12      12       0 r-xs-  jce.jar
00002aaab1a01000      24      24       0 r-xs-  jsse.jar
00002aaab1a07000      12      12       0 r-xs-  sunjce_provider.jar
00002aaab1a0a000      76      72       0 r-x--  libnet.so
00002aaab1a1d000    1028       0       0 -----  libnet.so
00002aaab1b1e000      12      12      12 rwx--  libnet.so
00002aaab1b2f000      16      16       0 r-x--  libnss_dns-2.5.so
00002aaab1b33000    2044       0       0 -----  libnss_dns-2.5.so
00002aaab1d32000       4       4       4 r-x--  libnss_dns-2.5.so
00002aaab1d33000       4       4       4 rwx--  libnss_dns-2.5.so
00002aaab4000000   16432    3272    3272 rwx--    [ anon ]
00002aaab500c000   49104       0       0 -----    [ anon ]
00002b29fc3a7000       8       8       8 rwx--    [ anon ]
00002b29fc3b7000      28      16       0 r-x--  libjli.so
00002b29fc3be000    1028       0       0 -----  libjli.so
00002b29fc4bf000       8       8       8 rwx--  libjli.so
00002b29fc4c1000      12      12      12 rwx--    [ anon ]
00002b29fc4c4000    9320    6500       0 r-x--  libjvm.so
00002b29fcdde000    1032       0       0 -----  libjvm.so
00002b29fcee0000    1748     608     608 rwx--  libjvm.so
00002b29fd095000     232     164     164 rwx--    [ anon ]
00007fff13b03000      84      44      44 rwx--    [ stack ]
00007fff13b34000      16       4       0 r-x--    [ anon ]
ffffffffff600000    8192       0       0 -----    [ anon ]
----------------  ------  ------  ------
total kB          601248   49456   39620

Is the a good way to check it ?

Out of my 1026076 (1GB) memory available is that program really using 600K ?

Have I calculated it right ?

This is a VM server just in case the above matters if u need me to output any other commands let me know, appreciated.

I have changed the windows update option to notify on my win2003 datacenter edition as I don't want it downloading anything while the server is running but to notify me so I can schedule the best time for it to be downloaded and installed.

The problem now is that it won't show up or download anything.

• Is there a way to summon the update to make sure everything is up to date ?
• What should I verify in order to make sure it is working as I configured ?

This is all the rules I currently have on the server:

/usr/sbin/iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 6112 -j DNAT --to 10.0.0.3:6112
/usr/sbin/iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 1513 -j DNAT --to 10.0.0.3:1513

/usr/sbin/iptables -I FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
/usr/sbin/iptables -A FORWARD -i eth0 -j ACCEPT
/usr/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/iptables -A FORWARD -i eth1 -o eth0 -m state --state NEW,ESTABLISHED -j ACCEPT
/usr/sbin/iptables -A FORWARD -j LOG

/usr/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

I need some help with some really basic needs, all I need to allow in this server is people to be able to connect to it on ports 1513 and 6112 in and out as well as being able to ping the server nothing else is need on the firewall for external access.

eth0 is the local network interface and eth1 the external network interface, I use 10.0.0.0/255.255.255.0 as my local network.

Are these rules sufficient for my needs or am I missing anything ?

UPDATE:

root@server:~# iptables -L; iptables -t nat -L; iptables -t mangle -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state NEW,ESTABLISHED
LOG        all  --  anywhere             anywhere            LOG level warning

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere            tcp dpt:6112 to:10.0.0.3:6112
DNAT       tcp  --  anywhere             anywhere            tcp dpt:fujitsu-dtc to:10.0.0.3:1513

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

I have Slackware 13.1 and due to some bugs on the current version of the MySQL it comes with, I have to upgrade it. Since Slackware does not have 5.5 and I am upgrading I have decided to go with 5.5.x.

I have tried downloading the generic and non generic tarball but none have the ./configure; make; make install available.

Could some one explain to me what is the process to build the MySQL from tarball or if there is still a version with ./configure that I can use with SlackBuild script to build it ?

SlackBuild script:

http://www.gtlib.gatech.edu/pub/slackware/slackware64-13.37/source/ap/mysql/mysql.SlackBuild

It is a virtual machine with slackware

eth0 bridge receive internet from main switch (connected to the internet link) on network 10.0.0.0/24 where the gateway is 10.0.0.254 and the ip it receives is 10.0.0.19

eth1 is the internal network using 192.168.1.0/24 and the ip of eth1 is 192.168.1.254

Output of route -n:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.0.0        0.0.0.0         255.255.255.0   U     202    0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         10.0.0.254      0.0.0.0         UG    202    0        0 eth0

I have installed named(bind) and set a forward to 10.0.0.254 and made my server nameserver as 192.168.1.254 which seems to be working just fine no problems here.

I have installed squid 2.7 and 3.1 with --enable-linux-netfilter and the follow rules on the iptables (only posted the rules that were related but since it was working for browsing i dont belive the problem might be here):

# deny all traffic
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

# Use stateful inspection feature to only allow incoming connections
# related to connections I have already established myself
$IPT -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$IPT -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# allow all traffic on lo interface
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

# allow squid access
$IPT -A INPUT -i eth1 -p tcp --dport 3128 -m conntrack --ctstate NEW -j ACCEPT

# redirect requests to squid 
# both rules worked just fine
#$IPT -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.254:3128
$IPT -t nat -A PREROUTING -p tcp -i eth1 --dport 80 -j REDIRECT --to-port 3128

# share internet access
$IPT -t nat -A POSTROUTING -o eth0 -j MASQUERADE

This is the test configuration i am using for SQUID (very default rule just for testing the transparent proxy):

http_port 3128 transparent

hierarchy_stoplist cgi-bin ?

refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern -i (/cgi-bin/|\?) 0     0%      0
refresh_pattern .               0       20%     4320

acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl localnet src 192.168.1.0/24

acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT

http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost
http_access allow localnet
http_access deny all

always_direct allow all

With all the above, i can navigate just fine but transparent proxy was never there, i test by acessing this page http://stuff.dan.cx/php/testproxy.php, if i go to it direct from the server without using the proxy all goes well, if i go using the proxy it detects the proxy right away.

While i don't think the below is the best pratice i could hide the proxy on version 2.7 using the below config:

header_access Via deny all
header_access Forwarded-For deny all
header_access X-Forwarded-For deny all

Questions:

• Why the transparent proxy won't work on 3.1.8 ?
• What else could I verify to find the problem ?

I've been searching on the internet and here on the forums but found nothing that helped me out at all.

I've tried the squid page but didn't got any answer so far aswell.

On my other thread I was talking about some interesting things about the iptables policy and states, now I would like to understand more about how the DHCP works and how iptables understands it.

ETH0 is connected to my main switch that receives the dynamic ip from my router to gain not only internet access but aswell as access to my outer network.

ETH1 is the internal card that is connected to a internal switch where X clients receive their IPS from this server

ETH1 network is 192.168.1.0/255.255.255.0 where the server ip is 192.168.1.254.

From what I understood, dhcp is a bootp protocol so even if you have your firewall policies to DROP everything, your network would still receive the DHCP, which in the tests I made it seemed to be true.

From tcpdump:

root@test:~# tcpdump -i eth1 port 67 or 68
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
11:34:03.943928 IP 192.168.1.2.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0c:29:29:52:8b (oui Unknown), length 303
11:34:03.957647 IP 192.168.1.254.bootps > 192.168.1.2.bootpc: BOOTP/DHCP, Reply, length 300
11:34:06.492153 IP 192.168.1.2.bootpc > 192.168.1.254.bootps: BOOTP/DHCP, Request from 00:0c:29:29:52:8b (oui Unknown), length 303
11:34:06.506593 IP 192.168.1.254.bootps > 192.168.1.2.bootpc: BOOTP/DHCP, Reply, length 300

I made a simple log rule to see what iptables does:

root@test:~# tail -f /var/log/syslog
Oct 15 11:30:58 test kernel: IN=eth1 OUT= MAC=ff:ff:ff:ff:ff:ff:00:0c:29:29:52:8b:08:00 SRC=192.168.1.2 DST=255.255.255.255 LEN=331 TOS=0x00 PREC=0x00 TTL=128 ID=9527 PROTO=UDP SPT=68 DPT=67 LEN=311
Oct 15 11:31:43 test kernel: IN=eth1 OUT= MAC=ff:ff:ff:ff:ff:ff:00:0c:29:29:52:8b:08:00 SRC=192.168.1.2 DST=255.255.255.255 LEN=331 TOS=0x00 PREC=0x00 TTL=128 ID=9529 PROTO=UDP SPT=68 DPT=67 LEN=311
Oct 15 11:33:32 test kernel: IN=eth1 OUT= MAC=ff:ff:ff:ff:ff:ff:00:0c:29:29:52:8b:08:00 SRC=192.168.1.2 DST=255.255.255.255 LEN=331 TOS=0x00 PREC=0x00 TTL=128 ID=9531 PROTO=UDP SPT=68 DPT=67 LEN=311
Oct 15 11:34:03 test kernel: IN=eth1 OUT= MAC=ff:ff:ff:ff:ff:ff:00:0c:29:29:52:8b:08:00 SRC=192.168.1.2 DST=255.255.255.255 LEN=331 TOS=0x00 PREC=0x00 TTL=128 ID=9533 PROTO=UDP SPT=68 DPT=67 LEN=311

Here is my iptables rules at the momment:

# deny all traffic
$IPT -P INPUT DROP
$IPT -P FORWARD DROP
$IPT -P OUTPUT DROP

# Use stateful inspection feature to only allow incoming connections
# related to connections I have already established myself
$IPT -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# allow all traffic on lo interface
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

So even with the default POLICY to drop everything i still get the DHCP on my network while it does take a lot longer to renew an IP and such.

If I add the follow rule to my firewall:

$IPT -I OUTPUT -o $INTIF -p udp --dport 67:68 --sport 67:68 -j ACCEPT

It will take a LOT LESS TIME to update any client dhcp.

Considering the above:

1. why does it indeed take longer time to update it even tought it is not being blocked ?
2. is it possible to DROP the dhcp server at all without turning it off ?
3. is it possible to ACCEPT the dhcp server within iptables with the BOOTP ? how is that done ?

If you know good links I wouldn't mind taking a lot :)

I finally managed to install my VM host and now I am messing with iptables to create, test and learn.

1. Does it matter if i put the below rules at the begin or at the end of my rules ?

   $IPT -P INPUT DROP
   $IPT -P FORWARD DROP
   $IPT -P OUTPUT DROP
   

   i have tested and there was no difference but i would like to confirm.

   Answer I choose so far: It is a good idea to apply your policies as early as possible. Put them at the start. DROP rules on internal traffic can cause problems.

2. Having the below rule would be considered as a fault on the firewall ?

   $IPT -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
   

   Without this rule i would need to add for example an OUTPUT rule for my ssh connection, example:

   $IPT -A OUTPUT -p tcp --sport 2013 -j ACCEPT
   

   Answer: After more tests and talks with people on #iptables@freenode, i came to the conclusion that using -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT for INPUT and OUPUT is a fine approch and will help you deal with lots of things like for example the FTP and is a fine approch because unless you have that given port open and being accept there will be no malicious connection on it.

   Here is a normal example without using the above:

   $IPT -A INPUT -p tcp --dport 20:21 -j ACCEPT
   $IPT -A OUTPUT -p tcp --dport 20:21 -j ACCEPT
   

   Now here is how the rule looks like using the above:

   $IPT -A INPUT -p tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT
   

   That's all you need because once the connection is ESTABLISHED, the output will follow-up right away and you won't need to make rules for the ftp-data port.

3. What are bad things of having the below rule, could you give some example as to why not have it and instead just define anything you may need to use ?

   $IPT -P OUTPUT ACCEPT
   

   Answer I choose so far: This policy rule allows all outgoing traffic. As a policy, allowing everything is obviously less secure than allowing only explicit kinds of traffic. So if security is your utmost priority, you'll want to set a DROP policy on the output chain instead. Just be aware that you'll then have to include a number of rules to allow outgoing traffic to a possibly large number of mundane things, such as: DNS, SMTP, IMAP, POP3, HTTP, HTTPS, etc.

4. What is the difference between conntrack and state in the below context ?

   state example:

   $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
   

   conntrack example:

   $IPT -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
   

   Answer: After some research talks with people on #iptables@freenode i came to the conclusion i should be using conntrack from here on.

   Technically the conntrack match supersedes - and so obsoletes - the state match. But practically the state match is not obsoleted in any way.

I would aswell appreciate good online iptables reading materials.

Links recommended so far:

Perfect Ruleset

The Linux Documentation Project

Using VMWare Workstation 7.1, Client A is my Linux server with Slackware 13.1, I have set it up as bridge so i can access it from my external network, Client B will be a Windows XP and C will be a Vista Home.

• What setup do i need to do on the VMWare so Client B and C would look like into a switch where Client A is the one that tell them which network they will have ?

Normally if it was 3 computers on a switch this would be a simple:

Client A (server) on the wan port and the clients B and C on port 1 and 2 and my server would have a DHCP server on to provide it.

But on the VM it seems different so I am not sure on how do I link them. Initially i did not make the VM's inside a Team do I need to copy/move them as a Team as well ?

Appreciate any information that can help out on how it has to be setup, if i have to create a different network or w/e within the VMWare Workstation.

What i want is client B to be into a VLAN and C into another VLAN where both VLANs are handled by client A.

so VLAN 1 and VLAN 2 would not see each other but would both be handled by Client A dhcp server.

Client A has eth0 as internet, so eth1 would be the dhcp server.

And what i don't know is how do i setup that on the VMWare, if i have to create a new network device on Client A that will take with both VLANs or what...

If doing the 2 VLANs is not possible knowing how to acomplish 1 VLAN would be ok aswell.

I recently started playing with VM and saw that I have 2 options when creating a VM, I can use a Virtual Disk or a Physical Disk.

I belive using the physical disk would be faster and better and I would like to confirm if this is true ?

Another thing I was wondering is if I have to make the partitions myself of if the VMWare will do it for me ?

For example if I have a 500GB disk that has 400 being used by the host OS so I have 100 spare size would it let me repartition those 100 or it would either ask for the entire 100 or for me to point an already created partition to be used ?

How can I check on my MySQL server the follow:

1. what accounts have an open connection to the mysql-server ?

2. how often they request a new connection ?

3. how many requests they usually do per connection ?

It would be nice if I could aswell identify the codes that are making the calls aswell like, let's say:

/home/domainX/public_html/db.pl or /home/domainX/public_html/index.php

I guess this last part is only available if it is a socket call right ?