I need advice for firewall rule?

[bayern1975]

hello, i am trying to create firewall rule but can`t get to work. my router lan IP address is 192.168.15.1, IPTV is set on PC with IP 192.168.15.100. so this rule is working if IPTV set on router and not working when is IPTV set on PC....

iptables -I INPUT -p tcp -s 213.229.192.0/18 --dport 81 -j DROP

how to make a working rule for my case?

 

[RMerlin]

Rules intended for a device on your LAN must go in the FORWARD chain. The INPUT chain is only for traffic aimed at the router itself.

 

[bayern1975]

Rules intended for a device on your LAN must go in the FORWARD chain. The INPUT chain is only for traffic aimed at the router itself.

do you have an example of rule or someone else?

sent from Kodi 17 Krypton

 

[bayern1975]

is this working rule?

iptables -t nat -I VSERVER 3 -p tcp -m tcp -s
213.229.192.0/18 --dport 81 -j DNAT --to 192.168.15.1

 

[RMerlin]

What are you trying to do exactly? Your first rule was about dropping traffic, and now you posted a rule that's about NATing. That's two totally different things.

 

[bayern1975]

What are you trying to do exactly? Your first rule was about dropping traffic, and now you posted a rule that's about NATing. That's two totally different things.

I know, second rule found on internet and ask here if is good or no....so i need rule to drop some IP from outside to my IPTV on PC....PC have 192.168.15.100 and router have 192.168.15.1....

sent from Kodi 17 Krypton

 

[john9527]

I think you may be better served by first stepping back and describing what problem you are trying to solve without assuming the form of the solution.

I have IPTV service and I need to......

without using any ip addresses or potential iptables rules.

 

[bayern1975]

I think you may be better served by first stepping back and describing what problem you are trying to solve without assuming the form of the solution.

I have IPTV service and I need to......

without using any ip addresses or potential iptables rules.

i have IPTV set on PC but now all IP from outside my network may access to it but i would like to access just three different IP from outside....all others have to drop or reject....IPTV runing on PC with LAN 192.168.15.100, routers LAN is 192.168.15.1......so i have no idea what rule should be used....

 

[john9527]

I'm surprised that it's accessible from outside of your LAN by default. Are you sure that the router firewall is enabled?

 

[bayern1975]

yes, firewall is enabled....

sent from Kodi 17 Krypton

 

[ColinTaylor]

yes, firewall is enabled....

Then your PC should not be accessible from the internet unless you have some sort of port forwarding happening.

 

[bayern1975]

Then your PC should not be accessible from the internet unless you have some sort of port forwarding happening.

i have PC lan address insert in DMZ....so all network have access to my IPTV but i need just three address to access my PC lan address....

 

[octopus]

If you use DMZ to your PC then firewalls rule never works. Must is to have firewall turned on (no DMZ) to get it to work.

DMZ = Initialize all the chains by removing all the rules tied to them

 

[bayern1975]

If you use DMZ to your PC then firewalls rule never works. Must is to have firewall turned on (no DMZ) to get it to work.

DMZ = Initialize all the chains by removing all the rules tied to them

if i remove my IP for PC from DMZ, is there any other method to create firewall rule for my case?

 

[ColinTaylor]

if i remove my IP for PC from DMZ, is there any other method to create firewall rule for my case?

http://www.snbforums.com/threads/idiots-guide-needed.20782/#post-151796

 

[octopus]

If you remove DMZ from your PC you don't need any block rule firewall take care of it then.

 

[octopus]

This would block 213.229.192.0/18 (213.229.192.1 to 213.229.255.254) with DMZ off!!!

iptables -I FORWARD -s 213.229.192.0/18 -j REJECT

 

[bayern1975]

i tested all this yours suggestions but not working.....problem is probably different LAN addresses, router IP is 192.168.15.1 and PC IP (IPTV) 192.168.15.100....i have no idea....

 

[ColinTaylor]

This would block 213.229.192.0/18 (213.229.192.1 to 213.229.255.254) with DMZ off!!!

iptables -I FORWARD -s 213.229.192.0/18 -j REJECT

I think you meant to say "firewall off"?

(But turning the firewall off is a really bad idea.)

 

[john9527]

What port forwards do you have set up?