Hi.
I decided that I'd better get a firewall up and running. Since I'm on Fedora I started system-config-securitylevel, left all settings at default values and clicked ok. This generated the following /etc/sysconfig/iptables file:

# Firewall configuration written by redhat-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

Problem is when I try to start iptables, iptables-restore chokes up the following error message:

iptables-restore: line 16 failed

where line 16 simply is the COMMIT line. Anyone knows what could be wrong?

/Daniel

Always happens to me when I do a new kernel.
Iptables needs to match the current kernel, so either reinstall the rpm to replace all the files and links or build one from scratch..

And a 2nd comment...

Those rules don't actually do anything...
They allow certain things in, when the default is ACCEPT anyway.
If nothing matches the rules, it is still going to be allowed in...

Ok. Tried to rebuild iptables. No difference.

If the rules doesn't do something, I guess system-config-securitylevel is quite flaud then huh?

/Daniel

Now that I have my reading glasses on, I can see the last rule, REJECTing everything...

Another thought tho'...
to get around the loading error, do service iptables stop then enter them manually, in that sequence, put 'iptables' before the -A..
then do service iptables save to rewrite them.
Then they should load properly!

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -N RH-Firewall-1-INPUT
iptables -A INPUT -j RH-Firewall-1-INPUT
iptables -A FORWARD -j RH-Firewall-1-INPUT
iptables -A RH-Firewall-1-INPUT -i lo -j ACCEPT
iptables -A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
iptables -A RH-Firewall-1-INPUT -p 50 -j ACCEPT
iptables -A RH-Firewall-1-INPUT -p 51 -j ACCEPT
iptables -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

I've fixed it now. It was a couple of things I'd missed in my kernel config...

/Daniel