LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 12-18-2004, 02:49 AM   #1
ayiiq180
Member
 
Registered: Sep 2004
Posts: 39

Rep: Reputation: 15
what's problem in my iptables rules?


#!/bin/sh
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD DROP

/sbin/iptables -F

#oprn22úČ445 ports
/sbin/iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -p tcp --dport 445 -j ACCEPT

#Drop others
/sbin/iptables -A INPUT -p tcp --syn -j DROP

#avert Ping of death
/sbin/iptables -A INPUT -p icmp --icmp-type echo-request -i eth0 -j DROP 19
#avert SYN Flood
/sbin/iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT

when I accept this rules on iptables ,the Gnome can't work but KDE find.when I stop it,the gnome workd fine.
I cant find what problems in my rules.
Does anybody know this why?
thx!
 
Old 12-18-2004, 08:22 AM   #2
ayiiq180
Member
 
Registered: Sep 2004
Posts: 39

Original Poster
Rep: Reputation: 15
somebody know this?
plz help me!
 
Old 12-18-2004, 08:34 AM   #3
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,780
Blog Entries: 1

Rep: Reputation: 412Reputation: 412Reputation: 412Reputation: 412Reputation: 412
Quote:
/sbin/iptables -P INPUT ACCEPT
Well for starters, with this default rule, you really don't have a firewall. Usually the best thing to do is set all your defaults to DROP and then start accepting packets you want. One of the better ways you can do this on the INPUT chain is to use state matching

iptables -A INPUT -i eth0 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

That will allow packets that are sent in response to requests from within your machine. On the output side you should have something like

iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

That will allow your programs to send packets.

You also need to allow access to the loopback device

iptables -A INPUT -i lo -j ACCEPT


By the way, I know you are anxious for an answer, but it is accepted practice here to wait 24 hours before bumping your post.

Last edited by Hangdog42; 12-18-2004 at 08:35 AM.
 
Old 12-18-2004, 11:34 PM   #4
ayiiq180
Member
 
Registered: Sep 2004
Posts: 39

Original Poster
Rep: Reputation: 15
thx a lot!
But I dont know why the firewall rules cause the GNOME cant work yet.
 
Old 12-19-2004, 08:23 AM   #5
Hangdog42
LQ Veteran
 
Registered: Feb 2003
Location: Maryland
Distribution: Slackware
Posts: 7,780
Blog Entries: 1

Rep: Reputation: 412Reputation: 412Reputation: 412Reputation: 412Reputation: 412
I'm betting the lack of the loopback is causing Gnome problems. A number of programs don't work correctly if you don't allow loopback on your firewall.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
IPTABLES - rules in /etc/sysconfig/iptables The_JinJ Linux - Newbie 6 11-20-2004 01:40 AM
Problem Iptables, Firewall rules. Can anybody help ? ZliTroX Linux - Networking 9 09-06-2004 04:48 PM
iptables rules Hegemon Linux - Networking 0 01-28-2004 02:20 AM
iptables rules Darin Linux - Security 1 01-23-2003 04:32 PM
Firewall Rules Problem with Iptables JereBear Linux - Networking 1 06-16-2002 04:28 PM


All times are GMT -5. The time now is 10:40 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration