Greetings, one last thing to fix and I'll have a fully working and lovely new kernel.

I have this feeling that I did something wrong when it came to iptables in the kernel! I use a pretty generic set of rules as I'm behind a hardware firewall/router and the firewall on this machine just provides a bit of final tweaking:

#!/bin/sh

$IPTABLES=/usr/sbin/iptables

$IPTABLES -F INPUT

$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p icmp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p tcp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p udp

#ssh

$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT

#nessus

$IPTABLES -A INPUT -p tcp --dport 1241 -j ACCEPT

#cups (from g4 and ext) else deny

$IPTABLES -A INPUT -s 100.0.0.5 -p udp --dport 631 -j ACCEPT
$IPTABLES -A INPUT -s 100.0.0.2 -p udp --dport 631 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 631 -j DROP

$IPTABLES -A INPUT -m limit --limit 3/second --limit-burst 5 -i ! lo -j LOG
$IPTABLES -A INPUT -i ! lo -j DROP
------------------------------------------------------------------------------------------

The thing is, since compiling the 2.6.1 kernel...

$ iptables -L

now lists nothing at all. I believe I've narrowed it down to the fact that iptables no longer seems to understand the state feature. Is this something that has to be enabled at compile-time with the kernel? It worked fine on the generic slackware kernel.

cheers
mark

That is very similar to my rc.firewall file and I'm using kernel 2.6.1. state is still working on iptables for me...perhaps you didn't enable something in the kernel that you should have? I believe you have to enable netfilter and all of the suboptions.

Jeff

For my rc.firewall to work I had to enable everything as a module (M) except the last two (who work for 2.2.x and 2.0.x kernels) in the ipfiltering section of the 2.6.x kernel

Are the other modules working? If not you need to install module-init-tools...

Morning!

I only enabled two options in the ipfiltering section. Wasn't really concentrating

That's almost certainly the problem.

cheers
mark