TomatoUSB

Hello all,

I m trying to configure the iptables in tomato in order to setup a dmz. I m really stuck on this because i can`t even pass a script in tomato. When I put a rule or a policy in the firewall window should after "save" change the iptables, right?

After entering a command and clicking "save" or even rebooting nothing has changed (checking with telnet to my router (wrt54gs) and giving "iptables —list"). Everything is like before. I even tried with WinSCP to edit the iptables directly in /etc but nothing happens. I` ve tried shibby and toastman mods without success. Am I doing something wrong or am I missing something?

Thanks in advance!

Tomato has a gui way of configuring dmz- use "iptables -nvL -t nat" to see where it happens

Hi

I want to use my own rules on iptables.
I tried to change a rule in iptables and after "service firewall restart" the change don't happened.
The most important goal at an router is the firewall. Exactly this thing I can't change.
Does anyone know how to do ?

I had some atacks such as: port scan for many days from the same address, blocking my site with flood query on http and other.

Thank you in advance

You have to save them in the firewall scripts. Tomato already has a set of its own firewall, so you can't and shouldn't included your own full set of iptables in the firewall scripts. Instead you should examine closely what tomato already has (iptables -vnL), then decide the best way to enhance it with your own rules.

Thank you for your answer

I put a new rule in ->Scripts-> like as "iptables -A INPUT -s 74.86.158.106 -j DROP" and nothing.
I assume there is a other rule that overwrite or is executed after.

But there isn't another method to have all control ?
As cisco routers.

-A just adds the rule below existing rules so it may not hit your's if traffic is allowed by something above. You may want to drop that on the nat table instead:

iptables -t nat -I PREROUTING -s 74.86.158.106 -j DROP

Thank you again Kees

I'm sorry I don't want to profit by your amability.
Can you give me some indications?
Now I have an Asus rt66u on that is functional a server web (lighttpd), server ns (named), server vpn, server ftp and other.
Other attacks come now, from other ip's and I can't add every time a new rule in firewall.
So
I read about stophummer that is available for ddwrt.
I have the script and I want to apply on tomatousb but it request "logtail". I saw that isn't into optware.
Have you any ideea if is posible to apply on tomato ? Or if exist anything similar for tomatousb.

And more I want to stop the attacks that come to my site and it block all the request from serv.http

Have a nice day
Adrian

Sorry I can't help you with that. Only IPS and IDS have dynamic IP blocking. What you have is a router and if you're running sites in there that are attracting attacks, then you should have them hosted on proper infrastructure, not on a puny consumer plastic box router.

Thank you

Hi

I want to limit the number of request from firewall on http (80) and I put into -> Scripts next line:

iptables -t nat -I PREROUTING -p tcp —dport 80 -m state —state NEW -m limit —limit 20/s —limit-burst 30 -j ACCEPT

(or: iptables -p tcp —syn —dport 80 -m connlimit —connlimit-above 16 —connlimit-mask 24 -j REJECT
is not supproted by my iptables v1.3.8 version)

but it is work with: iptables -A INPUT -p tcp —syn —dport 80 -m connlimit —connlimit-above 16 -j REJECT

Can anyone help me?