LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 10-08-2007, 01:06 PM   #1
Doug Vitale
Member
 
Registered: Feb 2007
Distribution: Fedora 10/Mint 5 KDE
Posts: 69

Rep: Reputation: 16
How to Open a Port in IPtables


I am running Kubuntu 7.04. The Firestarter program tells me that the firewall is active (I assume it is referring to iptables).

I'd like to open the ports necessary to fully utilize P2P file sharing applications like Limewire and Azureus. I want others to download from my share.

So how would I permanently open a certain port in iptables? I don't see an option in Firestarter to do this. I also have Guarddog installed as well (though it tells me "Guarddog was unable to find a Guarddog firewall at /etc/rc.firewall").

Thanks.
 
Old 10-08-2007, 02:05 PM   #2
b0uncer
Guru
 
Registered: Aug 2003
Distribution: CentOS, OS X
Posts: 5,131

Rep: Reputation: Disabled
Not sure what Guarddog does, if it's a front-end for iptables like Firestarter is, but anyway. An empty iptables ruleset (both policies and rules) is like not using iptables at all. To have a port closed at all, you either need to specify a policy that drops every connection that matches the chain you wanted, or a special rule to do that. So, if you feel the port(s) are closed, you either need to remove the rule that closes the port(s), create a new rule to allow using those ports (or modify an existing rule, so you don't have overlapping rules) or change policy. To make a decicion, you need to know the current configuration: as root, run
Code:
/sbin/iptables -L
and it's shown to you.

So if you use firestarter, add a new rule that ACCEPTs incoming traffic to the port(s) you want, or use iptables (read 'man iptables' for that; it's really easy once you get it).
 
Old 10-08-2007, 08:51 PM   #3
Doug Vitale
Member
 
Registered: Feb 2007
Distribution: Fedora 10/Mint 5 KDE
Posts: 69

Original Poster
Rep: Reputation: 16
Quote:
Originally Posted by b0uncer View Post
To make a decicion, you need to know the current configuration: as root, run
Code:
/sbin/iptables -L
and it's shown to you.
I ran that command and this is the output; do you have any idea what it means?

Code:
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Quote:
So if you use firestarter, add a new rule that ACCEPTs incoming traffic to the port(s) you want, or use iptables (read 'man iptables' for that; it's really easy once you get it).
In Firestarter, under Policy I go to "Add Rule" and it tells me to fill in a field that's labeled "IP address, host, or network". Do you know how I can just specify traffic to be permitted (from any source address) using a certain port number? For instance, Limewire has port 42042. Thanks a lot!
 
Old 10-09-2007, 04:28 AM   #4
salasi
Senior Member
 
Registered: Jul 2007
Location: Directly above centre of the earth, UK
Distribution: SuSE, plus some hopping
Posts: 3,885

Rep: Reputation: 774Reputation: 774Reputation: 774Reputation: 774Reputation: 774Reputation: 774Reputation: 774
Quote:
Originally Posted by Go2doug View Post
I ran that command and this is the output; do you have any idea what it means?

Code:
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination


In Firestarter, under Policy I go to "Add Rule" and it tells me to fill in a field that's labeled "IP address, host, or network". Do you know how I can just specify traffic to be permitted (from any source address) using a certain port number? For instance, Limewire has port 42042. Thanks a lot!
Errm, what it means is that, although you nominally have the firewall active, it is permitting everything.

In other words, you are getting the same protection from the firewall as if you had no firewall running. That is none.

What you ought to have (ideally) are chains which have a policy (default set of actions) of drop and a list of specific things that you allow. You could proceed by trying to create default policies of 'accept' and denying specific things, but that's more difficult to make secure (particularly as new threats arise).

Any of the 'Linux Firewalls' programs aren't really that at all; they are simplified interfaces to the underlying Iptables/Netfilter system. What this means is that you should only use one. Having another on your disk isn't bad, but be careful to only try to use one at once, otherwise the situation could get confused.

There are iptables tutorials on the web (...google! the one on frozentux is very complete, but you probably want something simpler like the one on yolinux), but if you have decided to use firestarter have a look to see if there are any examples using it, say, on its website or elsewhere. (I'd be very surprised if an 'easy' Iptables interface didn't provide some examples or a tutorial somewhere as part of the support that is provided.)
 
Old 10-14-2007, 09:14 PM   #5
Doug Vitale
Member
 
Registered: Feb 2007
Distribution: Fedora 10/Mint 5 KDE
Posts: 69

Original Poster
Rep: Reputation: 16
Okay, so if I use Firestarter to configure iptables, what are some general policies or rules I can enable for basic protection?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
i need open samba port by iptables lion_heart_300 Suse/Novell 2 01-05-2007 01:23 PM
Iptables - Port Won't Open stascrash Linux - Security 11 11-09-2006 10:39 AM
iptables won't allow ftp even with port 21 open. keithxl Linux - Security 12 05-22-2006 11:36 PM
Open/Closing port without iptables? hottdogg Slackware 8 12-27-2005 03:55 PM
open port 10000 by iptables vijaysh Linux - Security 2 12-24-2004 12:55 PM


All times are GMT -5. The time now is 10:56 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration