<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.6.1">
</HEAD>
<BODY>
On Fri, 2005-06-03 at 11:43 +1200, Christoph Georgi wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
<FONT COLOR="#000000">Default Policy: DROP</FONT>
<FONT COLOR="#000000">Allow only ESTABLISHED and RELATED for incoming traffic</FONT>
<FONT COLOR="#000000">Allow outgoing connections only to port http, https, smtp, pop3, ...</FONT>
</PRE>
</BLOCKQUOTE>
I wouldn't restrict outgoing connections, since that wuold lead to way to many dumb-user problems like <BR>
"I cannot use AIM!" "Why cannot I connect to IRC?" etc.
<BLOCKQUOTE TYPE=CITE>
<PRE>
<FONT COLOR="#000000">Additionally you might want to specify the processes that are allowed to </FONT>
<FONT COLOR="#000000">connect to services.</FONT>
</PRE>
</BLOCKQUOTE>
What do you mean by this? If you mean something like "Only mozilla-firefox can connect to port 80" it is rather difficult. The only way I see to do something like this transparently is to use netlink interface of netfilter. Unfortunately it is a bit under-documented and I am not sure how well it is supported.<BR>
<BR>
</BODY>
</HTML>