Firewall Blocking More Websites

Hi All,

I am running Mandrake 9.1 with Firestarter 0.9.1. This box connects to a
router out to the rest of the world. I have noticed that over the last ~4
months that more webites will not load with Mozila because they are
getting block by firewall. They are trying to connect on various ports
(55643, 55642, 5373, etc.). It used to be that only "bad" sites (take a
guess) would try these ports, but it seems that many, including legit
commerical sites like Nikon and Opensource sites are also getting blocked.
It is getting to be a PITA. I can allow access per site w/ Firestarter
(which just creates rules for iptables) but that is a messy solution.
Anyone elese notice the increase lately? Any thoughts or ideas?

Thanks,

Chris

"Chris McHugh" <cmchugh_2000@yahoo.nospam.comm> wrote in message
news:pan.2004.01.29.02.32.07.895045@yahoo.nospam.c omm

> I am running Mandrake 9.1 with Firestarter 0.9.1. This box connects
> to a router out to the rest of the world. I have noticed that over
> the last ~4 months that more webites will not load with Mozila
> because they are getting block by firewall. They are trying to
> connect on various ports (55643, 55642, 5373, etc.). It used to be
> that only "bad" sites (take a guess) would try these ports, but it
> seems that many, including legit commerical sites like Nikon and
> Opensource sites are also getting blocked. It is getting to be a
> PITA. I can allow access per site w/ Firestarter (which just creates
> rules for iptables) but that is a messy solution. Anyone elese notice
> the increase lately? Any thoughts or ideas?

Do you have a rule to allow related connections? e.g.:

/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


tony

--
use hotmail for any email replies


-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 100,000 Newsgroups - 19 Different Servers! =-----

ynotssor wrote:
> "Chris McHugh" <cmchugh_2000@yahoo.nospam.comm> wrote in message
> news:pan.2004.01.29.02.32.07.895045@yahoo.nospam.c omm
>
>
>>I am running Mandrake 9.1 with Firestarter 0.9.1. This box connects
>>to a router out to the rest of the world. I have noticed that over
>>the last ~4 months that more webites will not load with Mozila
>>because they are getting block by firewall. They are trying to
>>connect on various ports (55643, 55642, 5373, etc.). It used to be
>>that only "bad" sites (take a guess) would try these ports, but it
>>seems that many, including legit commerical sites like Nikon and
>>Opensource sites are also getting blocked. It is getting to be a
>>PITA. I can allow access per site w/ Firestarter (which just creates
>>rules for iptables) but that is a messy solution. Anyone elese notice
>>the increase lately? Any thoughts or ideas?
>
>
> Do you have a rule to allow related connections? e.g.:
>
> /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>

I think the question is "Do you want to?"

Have you checked with the site admins to see what they might
be using the ports for?

jmh

"jmh" <j_m_h@cox.net> wrote in message
news:ZBcSb.2569$CJ1.2329@lakeread01

>> Do you have a rule to allow related connections? e.g.:
>>
>> /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j
>> ACCEPT
>
> I think the question is "Do you want to?"
>
> Have you checked with the site admins to see what they might
> be using the ports for?

Initial http connections with a site occur on (default) port 80. The return
data stream(s) can occur on any number of local ephemeral ports for text,
images, shockwave flash animations, and the like.

Nikon opened about a half dozen ports for data transfers of various kinds,
as seen by iftop.


tony

--
use hotmail for any email replies



-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 100,000 Newsgroups - 19 Different Servers! =-----

On Thu, 29 Jan 2004 13:51:59 -0500, jmh wrote:



>>
>> Do you have a rule to allow related connections? e.g.:
>>
>> /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>>
>>
> I think the question is "Do you want to?"
>
> Have you checked with the site admins to see what they might be using
> the ports for?
>
> jmh

I haven't checked and I'm not sure if I want all sites to be able to use
any port. Is there any security issue with that rule? I guess it's OK with
an up-to date version of mozilla on linux? Here is one example of what I'm
seeing:

When I go to nikonusa.com, Firestarter blocks ns62.nikonusa.com from port
565540 and 56535 (tcp) and the page does not load.

I looked for some more but of course now that I'm looking I can't find any
others.

"Chris McHugh" <cmchugh_2000@yahoo.nospam.comm> wrote in message
news:pan.2004.01.29.22.57.25.247917@yahoo.nospam.c omm

>>> Do you have a rule to allow related connections? e.g.:
>>>
>>> /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j
>>> ACCEPT
>>>
>> I think the question is "Do you want to?"
>> Have you checked with the site admins to see what they might be using
>> the ports for?
>
> I haven't checked and I'm not sure if I want all sites to be able to
> use any port. Is there any security issue with that rule? I guess
> it's OK with an up-to date version of mozilla on linux? Here is one
> example of what I'm seeing:
>
> When I go to nikonusa.com, Firestarter blocks ns62.nikonusa.com from
> port 565540 and 56535 (tcp) and the page does not load.

(typo above recognized; there is no port 565540)

Of course it doesn't. You're blocking a port receiving page source and a
port receiving images.

--
use hotmail for any email replies



-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 100,000 Newsgroups - 19 Different Servers! =-----

Chris McHugh wrote:
> Hi All,
>
> I am running Mandrake 9.1 with Firestarter 0.9.1. This box connects to a
> router out to the rest of the world. I have noticed that over the last ~4
> months that more webites will not load with Mozila because they are
> getting block by firewall. They are trying to connect on various ports
> (55643, 55642, 5373, etc.). It used to be that only "bad" sites (take a
> guess) would try these ports, but it seems that many, including legit
> commerical sites like Nikon and Opensource sites are also getting blocked.
> It is getting to be a PITA. I can allow access per site w/ Firestarter
> (which just creates rules for iptables) but that is a messy solution.
> Anyone elese notice the increase lately? Any thoughts or ideas?
>
> Thanks,
>
> Chris

> It used to be that only "bad" sites (take a guess) would try these
> ports

I would like to see your source for that information. It seems highly
suspicious to me (FUD).

> it seems that many, including legit commerical sites like Nikon and
> Opensource sites are also getting blocked.

According to internet specs, ports 10000+ are client ports. Http
specification describes the client requesting information from http
server at port 80, and then the http server sending the information to
the client on any of the client ports (ie ports > 10000).

If you block client ports then some (http) responses won't get back to
you (usually random).

Or as nikkon said,
> Initial http connections with a site occur on (default) port 80. The return
> data stream(s) can occur on any number of local ephemeral ports for text,
> images, shockwave flash animations, and the like.
>
> Nikon opened about a half dozen ports for data transfers of various kinds,
> as seen by iftop.
>
>
> tony

--
Ben M.

----------------
What are Software Patents for?
To protect the small enterprise from bigger companies.

What do Software Patents do?
In its current form, they protect only companies with
big legal departments as they:
a.) Patent everything no matter how general
b.) Sue everybody. Even if the patent can be argued
invalid, small companies can ill-afford the
typical $500k cost of a law-suit (not to mention
years of harassment).

Don't let them take away your right to program
whatever you like. Make a stand on Software Patents
before its too late.

Read about the ongoing battle at http://swpat.ffii.org/
----------------

On Thu, 29 Jan 2004 18:37:11 -0800, ynotssor wrote:


>>
>> When I go to nikonusa.com, Firestarter blocks ns62.nikonusa.com from
>> port 565540 and 56535 (tcp) and the page does not load.
>
> (typo above recognized; there is no port 565540)
>
> Of course it doesn't. You're blocking a port receiving page source and a
> port receiving images.
>
> --
OK--So I'm still wondering why this (and other sites) is blocked
when the majority of other sites, many with images, multimedia, and other
stuff, display with no problem. I am not explicitly blocking these ports.
Thanks for your help,

Chris

Chris McHugh wrote:
> On Thu, 29 Jan 2004 18:37:11 -0800, ynotssor wrote:
>
>
>
>>>When I go to nikonusa.com, Firestarter blocks ns62.nikonusa.com from
>>>port 565540 and 56535 (tcp) and the page does not load.
>>
>>(typo above recognized; there is no port 565540)
>>
>>Of course it doesn't. You're blocking a port receiving page source and a
>>port receiving images.
>>
>>--
>
> OK--So I'm still wondering why this (and other sites) is blocked
> when the majority of other sites, many with images, multimedia, and other
> stuff, display with no problem. I am not explicitly blocking these ports.
> Thanks for your help,
>
> Chris

Its random (ish, depending on your webcache and their servers). See my
other post for details.

--
Ben M.

----------------
What are Software Patents for?
To protect the small enterprise from bigger companies.

What do Software Patents do?
In its current form, they protect only companies with
big legal departments as they:
a.) Patent everything no matter how general
b.) Sue everybody. Even if the patent can be argued
invalid, small companies can ill-afford the
typical $500k cost of a law-suit (not to mention
years of harassment).

Don't let them take away your right to program
whatever you like. Make a stand on Software Patents
before its too late.

Read about the ongoing battle at http://swpat.ffii.org/
----------------

"Chris McHugh" <cmchugh_2000@yahoo.nospam.comm> wrote in message
news:pan.2004.01.30.03.57.37.974864@yahoo.nospam.c omm

>>> When I go to nikonusa.com, Firestarter blocks ns62.nikonusa.com from
>>> port 565540 and 56535 (tcp) and the page does not load.
>>
>> (typo above recognized; there is no port 565540)
>>
>> Of course it doesn't. You're blocking a port receiving page source
>> and a port receiving images.
>
> I am not explicitly blocking these ports. Thanks for your help,

One of the shortcomings of colloquial language, I suppose. When I say "you",
I assume "you" are responsible for the Firestarter administration and
configuration which is blocking the ports. Apparently I'm wrong about that,
sorry.

It must be someone else who is administering the machine you're on and who
chooses to block the ports, and who doesn't use the simple iptables
ESTABLISHED,RELATED mechanism to protect access to the higher port numbers.


tony

--
use hotmail for any email replies



-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 100,000 Newsgroups - 19 Different Servers! =-----