iptables

Hello,

I am more or less new to Linux and my problem is with iptables!

I wrote a file with the following iptables in it and linked it to
S03firewall.
There is running an apache 1.3 on the server!

iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP

iptables -A INPUT -p tcp --sport 80 --dport 1024: ! --syn -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024: --dport 80 -j ACCEPT

However, when I reboot the server it isn´t possible to start the firewall
and apache isn´t able to show me the homepage!

Can someone tell me what I am doing wrong here?
Or can he/she gives me an iptablesscript where the ports 80, 110, 25, 22 are
reachable but the syn scan is deactivated?

Thanks very much!

Bernd

On Tue, 04 Jan 2005 16:45:35 GMT, "Bernd Roth" <bernd@chello.at>
wrote:

>I wrote a file with the following iptables in it and linked it to
>S03firewall.
>There is running an apache 1.3 on the server!
>
>iptables -F
>iptables -P INPUT DROP
>iptables -P OUTPUT DROP
>
>iptables -A INPUT -p tcp --sport 80 --dport 1024: ! --syn -j ACCEPT
>iptables -A OUTPUT -p tcp --sport 1024: --dport 80 -j ACCEPT
You just swapped source and destination and I would leave out the syn
statement.

BTW: Even swapped I hope these are not the only rules. If so, your box
can do no networking part from answering http request. No DNS for
example.

>However, when I reboot the server it isn´t possible to start the firewall
Sure. Can you see the rules using iptables -L ?
>and apache isn´t able to show me the homepage!
Should be clear now.

>Or can he/she gives me an iptablesscript where the ports 80, 110, 25, 22 are
Dont innovate, imitate.

>reachable but the syn scan is deactivated?
Google around for rule sets concerning scanning and blocking. There
are many sohpisticated ones out there.

HTH,

Tobias

"Bernd Roth" <bernd@chello.at> wrote:

>Hello,
>
>I am more or less new to Linux and my problem is with iptables!
>
>I wrote a file with the following iptables in it and linked it to
>S03firewall.
>There is running an apache 1.3 on the server!
>
>iptables -F
>iptables -P INPUT DROP
>iptables -P OUTPUT DROP
>
>iptables -A INPUT -p tcp --sport 80 --dport 1024: ! --syn -j ACCEPT
>iptables -A OUTPUT -p tcp --sport 1024: --dport 80 -j ACCEPT
>
>However, when I reboot the server it isn´t possible to start the firewall
>and apache isn´t able to show me the homepage!
>
>Can someone tell me what I am doing wrong here?
>Or can he/she gives me an iptablesscript where the ports 80, 110, 25, 22 are
>reachable but the syn scan is deactivated?
>
>Thanks very much!
>
>Bernd

I've been using a (somewhat modified) script from the Sept, 2001 (Iss
89) Pages 64-72 Listing 2 downloadable from
ftp://ftp.ssc.com/pub/lj/listings/issue89/4815.tgz

It is fairly basic BUT easily updated and is quite understandable.

--
------------------------------------------------
http://www3.sympatico.ca/dmitton
SPAM Reduction: Remove "x." from my domain.
------------------------------------------------

Sorry,

but I don´t know what to do with the iptables -L command?

Where do I have to put it exactly?

Sorry, but I am not very good in the iptables, though I try to learn!

Thx,

Bernd


"Tobias Schenk" <schenk_remove_this_@physik.tu-berlin.de> schrieb im
Newsbeitrag news:nrtlt0djjtp3724dhodgqjbj9lum6c6do2@4ax.com...
> On Tue, 04 Jan 2005 16:45:35 GMT, "Bernd Roth" <bernd@chello.at>
> wrote:
>
>>I wrote a file with the following iptables in it and linked it to
>>S03firewall.
>>There is running an apache 1.3 on the server!
>>
>>iptables -F
>>iptables -P INPUT DROP
>>iptables -P OUTPUT DROP
>>
>>iptables -A INPUT -p tcp --sport 80 --dport 1024: ! --syn -j ACCEPT
>>iptables -A OUTPUT -p tcp --sport 1024: --dport 80 -j ACCEPT
> You just swapped source and destination and I would leave out the syn
> statement.
>
> BTW: Even swapped I hope these are not the only rules. If so, your box
> can do no networking part from answering http request. No DNS for
> example.
>
>>However, when I reboot the server it isn´t possible to start the firewall
> Sure. Can you see the rules using iptables -L ?
>>and apache isn´t able to show me the homepage!
> Should be clear now.
>
>>Or can he/she gives me an iptablesscript where the ports 80, 110, 25, 22
>>are
> Dont innovate, imitate.
>
>>reachable but the syn scan is deactivated?
> Google around for rule sets concerning scanning and blocking. There
> are many sohpisticated ones out there.
>
> HTH,
>
> Tobias
>

Apparently, _Bernd Roth_, on 05/01/05 10:03,typed:
> Sorry,
>
> but I don´t know what to do with the iptables -L command?
>
> Where do I have to put it exactly?


1. Open a terminal (xterm, gnome-terminal, etc.)
2. Become root.
3. Give the command("#>" means root prompt here):
#> iptables -nvL

This will list your iptables rules currently in place. Do:
#> man iptables

for meaning of the options.



->HS

--
Please remove the underscores ( the '_' symbols) from my email address
to obtain the correct one. Apologies, but the fudging is to remove spam.

Bernd Roth wrote:
> Hello,
>
> I am more or less new to Linux and my problem is with iptables!
>
> I wrote a file with the following iptables in it and linked it to
> S03firewall.
> There is running an apache 1.3 on the server!
>
> iptables -F
> iptables -P INPUT DROP
> iptables -P OUTPUT DROP
>
> iptables -A INPUT -p tcp --sport 80 --dport 1024: ! --syn -j ACCEPT
> iptables -A OUTPUT -p tcp --sport 1024: --dport 80 -j ACCEPT
>
> However, when I reboot the server it isn´t possible to start the firewall
> and apache isn´t able to show me the homepage!
>
> Can someone tell me what I am doing wrong here?
> Or can he/she gives me an iptablesscript where the ports 80, 110, 25, 22 are
> reachable but the syn scan is deactivated?
>
> Thanks very much!
>
> Bernd

You can try, if you want, our bastion-firewall GPL firewall, it's very
easy to configure it with config files and it does all you want and
more. It generates scripts that you can edit.

You can also build your own script using fwbuilder (a very powerful
program) or use firestarter or another of the usual firewalls.

--

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"