Firewall troubles

Haiyadragon · 07-21-2004, 11:49 AM

I just found out that Shorewall doesn't start. It used to but apparently it doesn't anymore. I have only used the gui to change the settings. It does display an error message on boot, but you need to have superman read speed to be able to see it. Shorewall doesn't start on boot and just leaves my cable connection naked. I found out by accident.

Anyway the output:

Code:

Loading /usr/share/shorewall/functions...
Processing /etc/shorewall/params ...
Processing /etc/shorewall/shorewall.conf...
Loading Modules...
Starting Shorewall...
Initializing...
Shorewall has detected the following iptables/netfilter capabilities:
   NAT: Available
   Packet Mangling: Available
   Multi-port Match: Available
   Connection Tracking Match: Available
Determining Zones...
   Zones: net
Validating interfaces file...
Validating hosts file...
Validating Policy file...
   Error: Undefined zone loc
Terminated

I have also tried Firestarter, installed using urpmi, but it gives me:

Code:

A proper configuration for Firestarter was not found. If you are running Firestarter from the directory you built it in, run 'make install-data-local' to install a configuration, or simply 'make install' to install the whole program.

Firestarter will now close.

I know software firewalls running on the same box are bullshit anyway, but I'd like it to run nonetheless.
Can anyone help me fire up one of these?

CleonII · 07-21-2004, 12:14 PM

Y recommend you to create a firewall file whit the firestarter program to suit your needs and the just copy it to the /etc directory and run it in the local.rc file.
add a line like this and it have to start the rules when the machine reboot.

sh /etc/rc.firewall

i hope this could help you.

Haiyadragon · 07-21-2004, 12:34 PM

I can't create anything using firestarter because it gives me that error when I try to run it.

CleonII · 07-21-2004, 12:39 PM

did you compile it? the error is telling you to compile firestarter before use it.

Haiyadragon · 07-21-2004, 12:49 PM

Yeah I used urpmi. So there's none of that.

otish1000c · 07-21-2004, 01:01 PM

you probably need to edit a few config files (or at least one) in /etc/shorewall/ to get shorewall set up properly. usually "interfaces" is all you'll have to edit. unfortunately, i'm at work so i can post any examples. if you could post your connection type & method (IE: dsl? adsl? ppp0e? dhcp? dial up? router? networked? etc...) & if you want to use shorewall, i can help you out later tonight when i'm released from hell........erm, i mean work.

what you can try in the interim, is in terminal as root, type service shorewall stop (just to make sure shorewall is shutdown). then, go to MCC->security->shorewall & check which protocal boxes you want to allow to connect, check the enable/use shorewall box, click apply. then go back to terminal as root & type service shorewall start & try to make a connection. if you can't connect due to the firewall, do service shorewall stop to stop it.

otis

CleonII · 07-21-2004, 01:01 PM

ok.
but try to do the 'make install-data-local' or the 'make install' commands and try again. im dont know how urpmi works because i use debian.

amosf · 07-21-2004, 08:46 PM

Your shorewall config just isn't set quite right. It's easy to fix but need to adjust the rules. Probably have to see your shorewall rules, like /etc/shorewall/rules /etc/shorewall/zones and such...

Do you have a loc zone? or are you using net and masq zones? looks like you only have net there???

I was using shorewall quite a bit, but moved to smoothwall - ie I got an old P166, installed smoothwall and use it as firewall router to my local little network. Much easier to set up and configure

Haiyadragon · 08-05-2004, 11:02 AM

Sorry for the late response.

My rules file only contains one line, that is to accept connections to port 6881 (guess why

).
My zones contains one line: 'net Net Internet zone'. When I add 'loc Loc Local zone' Shorewall will load but almost all ports are unprotected.
My interfaces, one line: 'net eth0 detect'.
My policy contains:

Code:

fw      net     ACCEPT
fw      loc     ACCEPT
net     all     DROP    info
all     all     REJECT  info

Skyline · 08-05-2004, 10:03 PM

Had ongoing problems with the Mandrake firewall myself - in the end decided to go with Guarddog - straightforward setup, had no problems with it.

http://www.simonzone.com/software/guarddog/

otish1000c · 08-06-2004, 04:12 AM

provided you are using MDK10.0 with an adsl connection (you didn't specify, so i'm not sure), try the following.........

first, stop shorewall by typing in a terminal as root..........

Code:

service shorewall stop

(hit enter)

then go to mcc->security->firewall & check/uncheck whichever protocals you want to allow/disallow. then edit the following files as such........

Quote:

My zones contains one line: 'net Net Internet zone'. When I add 'loc Loc Local zone' Shorewall will load but almost all ports are unprotected.

if that's exactly what your lines in "zones" look like, then you have one too many entries. here's what mine looks like. try changing that to this............

Code:

#ZONE	DISPLAY		COMMENTS
net	Net	Internet zone
loc	Local	Local

Quote:

My interfaces, one line: 'net eth0 detect'.

try making the "interfaces" look like this.........

Code:

#ZONE	INTERFACE	BROADCAST	OPTIONS
net	ppp+	detect
loc	eth0	detect

(note, in MDK9.2 the net->interface line would be ppp0 NOT ppp+)

Quote:

My policy contains:

fw net ACCEPT
fw loc ACCEPT
net all DROP info
all all REJECT info

try making "policy" look like this...........

Code:

#SOURCE		DEST		POLICY		LOG LEVEL	LIMIT:BURST
loc	net	ACCEPT
fw	net	ACCEPT
net	all	DROP	info
all	all	REJECT	info

then in terminal as root type..........

Code:

service shorewall start

(hit enter)

if you want to test the firewall, here are 2 very good resources for that. go to GRC.com & click on the "shields up" link half way down the page, follow the instructions. another good one is DSLReports.com, go to the "test & tools" link on the left, then "port scan" near the bottom.

let me know if that worked.

otis

Haiyadragon · 08-06-2004, 11:10 AM

Thanks for your help.

I edited them all, following your post, except for interfaces. It think ppp+ is for dial up. Anyway, it works now. It's blocking most ports now with some weird exceptions, according Shields Up, it's not blocking port 113.
Anyone know how I can make it stealth 113 also?