LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 07-08-2005, 02:14 PM   #1
Bill Johns
Member
 
Registered: Mar 2005
Distribution: Zenwalk for now
Posts: 82

Rep: Reputation: 15
Need quick port closing lesson


Could anyone give some quick lessons? I don't want anyone accessing my pc from the net. But still allow cookies etc. Need some good suggestions.

Thanks
 
Old 07-08-2005, 03:03 PM   #2
fouldsy
Senior Member
 
Registered: Jan 2002
Location: St Louis, MO
Distribution: Ubuntu
Posts: 1,284

Rep: Reputation: 47
something like:

Code:
iptables -a INPUT -i eth0 -j DROP
will simply drop everything coming in. Cookies and such are stored locally and run through your browser so will be fine anyway. Have a read through "man iptables" which lists much more options, as you may want to allow specific traffic from a certain location if you wish to be able to ssh into your machine from another box a home network, for example.
 
Old 07-08-2005, 03:06 PM   #3
aaa
Guru
 
Registered: Jul 2003
Location: VA
Distribution: Slack 10.1
Posts: 2,194

Rep: Reputation: 46
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED, RELATED -j ACCEPT

That should block all outside connections.
 
Old 07-09-2005, 03:24 AM   #4
Bill Johns
Member
 
Registered: Mar 2005
Distribution: Zenwalk for now
Posts: 82

Original Poster
Rep: Reputation: 15
So to run this at start up do you put it in a script some place? Or are the changes permenant at the command line?
If so how do you return everything to the way it was before the changes?
Don't like to change things with out knowning a recovery from the changes.
 
Old 07-09-2005, 03:36 AM   #5
/bin/bash
Senior Member
 
Registered: Jul 2003
Location: Indiana
Distribution: Mandrake Slackware-current QNX4.25
Posts: 1,802

Rep: Reputation: 46
You may already have a firewall script running, to find out type this as root:
iptables -L

Usually you will have a script e.g. /etc/rc.d/init.d/rc.firewall which is started each time you boot. I don't know if Caldera uses the SysV init scripts or not, but if so then there will be run-level directories which have symlinks to the startup scripts e.g.
/etc/rc.d/rc5.d/S99firewall -> /etc/rc.d/init.d/rc.firewall
 
Old 07-09-2005, 02:49 PM   #6
Krugger
Member
 
Registered: Oct 2004
Posts: 229

Rep: Reputation: 30
If you want to close the ports by not running the default servers you should do:

netstat -ap | more

See what are the names of the processes that are using the ports and then remove the services from you inicialization.

or

you can use the above tips on reconfiguring your firewall.
 
Old 07-09-2005, 03:08 PM   #7
fouldsy
Senior Member
 
Registered: Jan 2002
Location: St Louis, MO
Distribution: Ubuntu
Posts: 1,284

Rep: Reputation: 47
Bill - the changes to iptables will be lost when you reboot. To save them, use
Code:
iptables-save > /etc/myfirewall
then create a little bootscript that issues
Code:
iptables-restore < /etc/myfirewall
.

If you want to remove your changes whilst the system is running,
Code:
iptables -F
flushes all iptable rules. Check out "man iptables" for full info on saving, restoring and flushing iptables.
 
Old 07-11-2005, 12:21 AM   #8
Bill Johns
Member
 
Registered: Mar 2005
Distribution: Zenwalk for now
Posts: 82

Original Poster
Rep: Reputation: 15
Well I did as you said.

iptables -a INPUT -i eth0 -j DROP

It didn't like the small -a so I made it a -A

It would not browse in Konqueror.


I want to be able to do the browser deal. But don't want some one or ? invading my PC.

It looks like all the samples given here block everything.
 
Old 07-11-2005, 12:47 AM   #9
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
If you drop all incoming packets, then you won't be able to receive any replies to your outgoing traffic. You need something more like this as a start:

Quote:
Originally posted by aaa
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED, RELATED -j ACCEPT

That should block all outside connections.
Note that one of those rules is setting the default policy using -P (in red) and not an actual rule in the chain (-A), so make sure to enter those exactly as listed in aaa's post. Also take a look at the following guide as it will give you some basics on iptables and the various options:

http://iptables-tutorial.frozentux.n...-tutorial.html
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Closing port 4000. gbowden Linux - Security 3 10-10-2005 11:04 AM
Advanced port closing azi Linux - Security 1 06-02-2004 03:53 PM
closing rpc3 port flubber Slackware 1 05-10-2004 01:55 PM
closing port 68/udp? antik Linux - Security 1 09-26-2003 12:26 PM
Closing port 111 psyklops Linux - General 3 05-01-2002 12:53 AM


All times are GMT -5. The time now is 07:21 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration