Hi.
I have trouble with ipchains on my server.
I can use ftp, ssh and more on my client but i'cant use DC, very strange :-(

What could the correct chain look like to put DC on the internet ?

Thanks

//Fredrik

Hi ,

It would help if you could specify what is DC ?

Regards ,
Xanthium .

DC = Direct Connect

Direct Connect

From FAQ of DC:
----------
By default, Direct Connect Uses port 412 for TCP and UDP data. This can be changed in the Direct Connect settings.
To make Direct Connect work properly with your NATing router, you must enter your routers WAN IP address in Direct Connects "Force Direct Connect to report this IP address" text box, and check associated check box.
-----------

So you'll need to add some rules to ipchains to allow port 412 to go out or inbound it doesn't say.

What you need to do is install DC and make sure nothing else is running, then fire it up and ask it to connect. 1 second after that, you type this on the Linux box.

ipchains -L -M -n

That will show you what connection it's requesting.
If unsure of what's happening post it here along with your other rules for ipchains and I'll show you the correct line to enable it.

/Raz

Thanks.
I typed ipchains -L -M -n and the output was this:

IP masquerading entries
prot expire source destination ports
UDP 02:07.32 192.168.0.2 212.181.52.2 1026 (61020) -> 53
UDP 02:07.32 192.168.0.2 212.181.52.2 1026 (61020) -> 53

212.181.52.2 is my gateway and 192.168.0.2 is my client with DC.
I tried several times to connect with DC but the output was the same all times.

Strange ?..........

ok that's showing you that your client has asked the DNS server to resolve a domain to an IP address.
Nothing to indicate that the DC software is getting out.

What are your rules for the firewall as it could deny the port even from your internal client.

type

ipchains -L -n

/Raz

Hi.

Check this file out, it is the one I'm using.



My firewall

Thanks again 4 your help

//FredrikN

ok I've got the file.
You can remove the link now.

I'll have a read and get back to you.

/Raz

Hi again , did you figure it out yet ?

Maybe it will be easier to just allow and accept everything while I'm using Direct connet.

Do you know how that chain will look like that accepts anything -> anywhere on my 192.168.0.1 -> 192.168.0.2 network ??

Thanks //FredrikN

Hi Fred ,

Sorry for responding late .
UC iam not in US so dont know what DC is ? Some sort of ISP ?

Anyway it is not a good idea to let every thing IN into ur network .
What u can do is allow data related to specific services offeres by ur Linux machine.

What are the services offeres by ur linux box ? will tell u the chains that u need tp put for these specific services .

Please accpet my apologies for having kept u waiting .
Temporarily i dont have a Interne connection hence am irregular with checking my mails but will try best to respond as early as possible.

Regards.

Hi.
DC = Direct Connect and it's a filesharing program, peer 2 peer.

The problem is that I'm new to ipchains and I want to write some chains that allow DC out on the internet from my int network

//FredrikN

Right that's the most difficult to read rules file I've ever looked at.
It's got loads of "!" that put the rules in reverse. "very confusing when your trying to follow them"

Anyway there are a few incorrect ICMP rules that also need to be fixed.
Put this at the very end of the firewall script.

ipchains -A output -p icmp -s 0/0 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 0 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 3 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 4 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 9 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 12 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 14 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 18 -d 0/0 -j ACCEPT
ipchains -A input -p icmp -s 0/0 --icmp-type 8 -d 0/0 -j DENY -l
ipchains -A input -p icmp -s 0/0 --icmp-type 11 -d 0/0 -j DENY -l
ipchains -A input -p icmp -s 0/0 --icmp-type 10 -d 0/0 -j DENY -l

Ok to get DC to work try typing this as root or adding it to the firewall file.

ipchains -A input -p tcp ! -y -s 0/0 --sport 412 -d 194.236.131.110 1023:65535 -j ACCEPT
ipchains -A output -p tcp -s 0/0 1023:65535 --dport 412 -t 0x01 0x10 -j ACCEPT

I think 194.236.131.110 is your eth1 ip address if not replace it with the correct one.
I've also changed the TOS flag so the priority is higher for increased speed.

If this still doesn't wotk it might be that DC uses UDP, the FAQ doesn't say anything very helpful so we will just keep trying till it works.

/Raz