Remote Desktop Access Firewall Problem

avonsydow · 11-13-2006, 09:25 PM

Hi
I am running Suse 10 in two PCs. I tried to remote access one of them using the other and it does not work unless I stop the firewall. I already set up the firewall when I enabled the Remote Administration (YaST2, Remote Administration). On Firewall settings I opened eth-id-00:08:02:3b::35:ab (DHCP) (the only option available) but it makes not difference.
I would appreciate any help.
Cheers,
Adriano

sal_paradise42 · 11-13-2006, 11:12 PM

never used SuSe, but the lower level program that runs a firewall in Linux is iptables. Can you post the following from the command line "iptables -nL -t filter" ?

avonsydow · 11-14-2006, 01:59 AM

Here you have it, I hope it makes sense to you.

------
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
input_ext all -- 0.0.0.0/0 0.0.0.0/0
input_ext all -- 0.0.0.0/0 0.0.0.0/0
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 6 level 4 prefix `SFW2-IN-ILL-TARGET '
DROP all -- 0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy DROP)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 6 level 4 prefix `SFW2-FWD-ILL-ROUTING '

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 6 level 4 prefix `SFW2-OUT-ERROR '

Chain forward_ext (0 references)
target prot opt source destination

Chain input_ext (2 references)
target prot opt source destination
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 PKTTYPE = broadcast udp dpt:137
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 PKTTYPE = broadcast udp dpt:138
DROP all -- 0.0.0.0/0 0.0.0.0/0 PKTTYPE = broadcast
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 4
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 3
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 11
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 12
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 14
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 18
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 3 code 2
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 5
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:5801 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP '
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:5801
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:5901 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP '
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:5901
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:445 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP '
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:445
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:138 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP '
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:138
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:137 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP '
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:137
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:139 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP '
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:139
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:138
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:137
reject_func tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 state NEW
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp spt:445 dpts:1024:65535 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-HIGH '
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:445 dpts:1024:65535
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp spt:137 dpts:1024:65535 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-HIGH '
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:137 dpts:1024:65535
LOG udp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 state NEW udp spt:445 dpts:1024:65535 LOG flags 6 level 4 prefix `SFW2-INext-ACC-HiUDP '
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp spt:445 dpts:1024:65535
LOG udp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 state NEW udp spt:137 dpts:1024:65535 LOG flags 6 level 4 prefix `SFW2-INext-ACC-HiUDP '
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp spt:137 dpts:1024:65535
LOG tcp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT '
LOG icmp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT '
LOG udp -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT '
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 state INVALID LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT-INV '
DROP all -- 0.0.0.0/0 0.0.0.0/0

Chain reject_func (1 references)
target prot opt source destination
REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset
REJECT udp -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-proto-unreachable

sal_paradise42 · 11-14-2006, 10:29 AM

hmmm, it seems that the firewall is only accepting certain ports and dropping the rest. Seems that you need this fixed, but not sure what front end software you are using for your firewall. I take it that you want a firewall?

avonsydow · 11-14-2006, 01:01 PM

Hi Sal,
Yes, I want to keep the firewall up. I had this problem before when I was set in up Samba. While I "opened" the firewall using the front end but it did not work. I managed to find some instruction to change the firewall manually to make it work, I suspect this is going to be the same.