I meant in this section --> http://wiki.ipfire.org/de/optimization/vlan/start#iptables_uebersicht are only spts: to be seen, but no dpts: in the rules you define "--dports 993,995,110,587,465" but they are listed as "spts:" (source ports) for example i have in the iptables -L listing for Mail something like this RETURN tcp -- 192.168.7.0/24 anywhere multiport dports imaps,urd,submission,pop3s,smtp TIME from 00:00:00 to 00:00:00 UTC so the dports are specified. I can´t find something like that in your iptables -L listing.
Ah. I'm using dport for single port (dpts:52 for DNS) an multiport dports for more destination ports, is this not okay?
So you have allowed only unprivileged ports as a source port, but isn´t it that the case per default anyway ? Or do you regard a security method with this ? So i´am also not sure with this, but if you define only --dports isn´t it the same behavior anyway with the source port then you defined it ?
is this a default? Sorry, i don't now. Is that so wrong?
What rules do you use in Mode 1 ?
A lot of rules ;) I can't post it here... one snipp: DNS, Mail, Game-Ports, Whois, FTP, NTP and ssh for green, red and all interfaces.
But these rules are all double in my tables after the restart. Another problem is when I usually re-upload my FW mode 0 although the WUI shows me mode 1.
I have all my ports manually specified are no longer seen in the tables, only when I reboot the FW.
Ahh O.K. but is it possible to arrange rules for the VLAN interfaces over the WUI (e.g. DMZ pinnholes, etc...) ? So maybe it is less complicated (especially for the explanations in the wiki) if all the rules which can be arranged over the WUI will be set in that way ? MIght be nice if you can go for a try . So also if the outgoing FW will be configured, i think the CUSTOMFORWARD rules are defined then in the FORWARD and OUTPUT chains.
I just tested it on wui and FW mode 1 do not apply the rules. It seems as if for wireless (blue) and the rule come from a different direction no matter what is stored in the WUI.