LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 12-02-2003, 02:35 PM   #1
facefullofsnow
LQ Newbie
 
Registered: Jul 2003
Posts: 10

Rep: Reputation: 0
How to get 'connection refused'


Hey all

I have set up a redhat firewall using iptables protecting a redhat 8 server running services. It works fine and the only allows to the ports I wish, however when trying to gain access to a proted port eg ftp the connection just hangs. Is it possible to get a 'connection refused' message back instead?

Also, I have had to set the 2 NICs on the firewall to different subnets, otherwise they don't forward. Is this the only was to set them up? And I can only access the server by using SNAT or MASQ. Is there any way I can just forward the packets through so they keep their original source address?

Thanks in advance
 
Old 12-02-2003, 02:48 PM   #2
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
The connection hangs because packets are silently being dropped, this is a result of DROP action in iptables. Usually this is preferred (at least, to outside connections) but in some cases you want to refuse the connection and let the client know you're not going to take it. I think iptables has something like a REJECT which would cause "connection refused" instead of a time-out.

Next, yes you have to put each NIC on it's own subnet. You cause all kinds of routing "Badness(TM)" if you attempt to put two NICs from one machine on the same network. That especially won't work well for a firewall since you're accepting packets off the wire and putting them back on the same network, you won't be able to do a lot of spoofing detection, etc.
 
Old 12-02-2003, 03:06 PM   #3
facefullofsnow
LQ Newbie
 
Registered: Jul 2003
Posts: 10

Original Poster
Rep: Reputation: 0
That's great chort thanks man. Cheers for the quick reply too!!!

One last thing, if I want to refer to an entire subnet, would I be right in using 192.168.0.0 or 192.168.1.0 etc?
 
Old 12-02-2003, 04:04 PM   #4
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
Well generally IPs that end in 0 are network numbers, but there's no way of telling what size the network is from just the IP, that's why people use subnet notation. Dotted decimal is very commonly recognized (192.168.0.0/255.255.0.0) but CIDR is preferred because it's more compact (192.168.0.0/16).

If you mean in an iptables rule, I *think* iptables recognizes CIDR notation, but I'm not certain (since I don't have any Linux boxes any more).
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Socket Connection Failed: 111 Connection Refused degraffenried13 Linux - General 3 05-31-2009 01:17 AM
ircd.conf: "Connection failed. Error: Connection refused" hamish Linux - Software 3 03-10-2005 07:23 AM
connection refused Alvaro Linux - Networking 2 03-08-2005 03:26 AM
lp filename yields "cannot open connection to localhost - Connection refused" jjge Linux - General 3 12-28-2003 11:02 PM
Connection Refused vhandrade Linux - Networking 2 03-15-2001 10:19 AM


All times are GMT -5. The time now is 11:40 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration