posted 06 July 2001 01:17 AM
--------------------------------------------------------------------------------
When i installed redhat 7.1, i used the firewall tool it had to add some ports that i needed to open. I now have these in my ipchains file and need help with what im suposed to do now. I basicaly need to open a bunch for a game server and forward them to a local machine with an ip of 192.168.0.**
This game server is windows 2000 pro and will (once i figure it out) be on the network. I now have 2 windows ME system running thru the redhat server and on the net without using DHCP.
This is what i have in there for each port ive opened:
-A input -s 0/0 -d 0/0 ***** -p udp -j ACCEPT
Where ***** is the port number.


To run from a machine with a private IP address behind a Linux firewall, you need to use a combination of IP masquerading and IP autoforwarding. The following rules for the default ** client port range can be used:

ipfwadm -F -a accept -m -S a.a.a.a/m.m.m.m -D 0.0.0.0/0
ipautofw -A -r udp 32766 32809 -h a.a.a.a -v -u

Where a.a.a.a is the address of the machine behind the firewall, and m.m.m.m is the netmask. If you run a server behind the firewall, clients should connect to the IP address of the firewall.


Can you open 40 ports in one line?
#-A input -s 0/0 -d 0/0 32766 -p udp -j ACCEPT
#-A input -s 0/0 -d 0/0 32767 -p udp -j ACCEPT

Like this?
#-A input -s 0/0 -d 0/0 32766 32809 -p udp -j ACCEPT

This what i realy need to do according to the game server details! Have no idea where or how to open and forward them though.

#ipfwadm -F -a accept -m -S 192.168.0.4/255.255.255.0 -D 0.0.0.0/0
#ipautofw -A -r udp 32766 32809 -h 192.168.0.4 -v -u

I can turn on iptables if need be too, but would need to know which one (ipchians/tables) to boot first.


Here are my current ipchains:
# Firewall configuration written by lokkit
# Manual customization of this file is not recommended.
# Note: ifup-post will punch the current nameservers through the
# firewall; such entries will *not* be listed here.
#ipfwadm -F -a accept -m -S 192.168.0.4/255.255.255.0 -D 0.0.0.0/0
#ipautofw -A -r udp 32766 32809 -h 192.168.0.4 -v -u
#-A input -s 0/0 -d 0/0 32766 -p udp -j ACCEPT
#-A input -s 0/0 -d 0/0 32767 -p udp -j ACCEPT
:input ACCEPT
:forward ACCEPT
-P forward DENY
-A forward -i eth0 -s 192.168.0.0/255.255.255.0 -j MASQ
:output ACCEPT
-A input -s 0/0 -d 0/0 25 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 21 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 22 -p tcp -y -j ACCEPT
-A input -s 0/0 67:68 -d 0/0 67:68 -p udp -i eth0 -j ACCEPT
-A input -s 0/0 67:68 -d 0/0 67:68 -p udp -i eth1 -j ACCEPT
-A input -s 0/0 -d 0/0 -i lo -j ACCEPT
-A input -s 0/0 -d 0/0 -i eth0 -j ACCEPT
-A input -s 0/0 -d 0/0 -i eth1 -j ACCEPT
-A input -p tcp -s 0/0 -d 0/0 0:1023 -y -j REJECT
-A input -p tcp -s 0/0 -d 0/0 2049 -y -j REJECT
-A input -p udp -s 0/0 -d 0/0 0:1023 -j REJECT
-A input -p udp -s 0/0 -d 0/0 2049 -j REJECT
-A input -p tcp -s 0/0 -d 0/0 6000:6009 -y -j REJECT
-A input -p tcp -s 0/0 -d 0/0 7100 -y -j REJECT

I also have webmin installed and the ipchains module, but using it (ipchains webmin module) is beyond me.

Interesting. Thanx, ill see if that works

Interesting. Thanx, ill see if that works

yogee,

Supply this info and you might have more luck in getting an answer.

What kind of Game server your trying to Run ?
What's the internal IP address of the game server
What's the internal IP address of the Linux firewall
Make up an address of the Linux's external ISP's.

Then I'll show you how to make it work.

Also use one or the other. "ipchains or iptables" not both.

Also I wouldn't call it a firewall as your allowing everything.
-A input -s 0/0 -d 0/0 -i eth0 -j ACCEPT
-A input -s 0/0 -d 0/0 -i eth1 -j ACCEPT

/Raz

The game is nascar racing 4 by papyrus. This what the readme file says to do.

MULTIPLAYER BEHIND A FIREWALL OR ROUTER

By default the following UDP ports will be used by NASCAR® Racing 4: 32766 for the net_server_port, 32767 for ping port, and then sequentially numbered ports for each allowed client connection (max of 42) starting at 32768.

To run from a machine with a private IP address behind a Linux firewall, you need to use a combination of IP masquerading and IP autoforwarding. The following rules for the default 42 client port range can be used:

ipfwadm -F -a accept -m -S a.a.a.a/m.m.m.m -D 0.0.0.0/0
ipautofw -A -r udp 32766 32809 -h a.a.a.a -v -u

Where a.a.a.a is the address of the machine behind the firewall, and m.m.m.m is the netmask. If you run a server behind the firewall, clients should connect to the IP address of the firewall.


The machine is now added to the network.
Im running a class C network of 192.168.0.0 and asigned the game server 192.168.0.4.
Eth0 is my external cable connection and eth1 is the internal network.
Eth1 has an ip of 192.168.0.1. The made up external ip of eth0 is 55.65.228.185

bump

Thanks for bumping me.

ok so I think this is what you need.

On your Linux box you'll need to have a simple script run to switch on the NAT. "This is not going to firewall off anything but it will help hide your internal addresses"

So create a script in the directory /etc/rc.d called nat.sh.
put this in the script:
-----------------------
# start Natwall
ipchains -F

# Accept all access.
ipchains -P input ACCEPT
ipchains -P output ACCEPT
ipchains -P forward ACCEPT

# sets timeout values for FIN flags etc..
ipchains -M -S 7200 10 60

# magic NAT setting for MASQing
ipchains -A forward -s 192.168.0.0/24 -j MASQ

# eof
-----------------------

Now go and install some software called "ipmasqadm" from
ftp://ftp.redhat.com/pub/contrib/lib....4.2-3.src.rpm

Once you have installed this active it in the /etc/rc.d/rc.local file with the following lines at the end of the file.


-----------------------
/etc/rc.d/nat.sh
modprobe ip_masq_portfw
ipmasqadm portfw -a -P udp -L 55.65.228.185 32766 -R 192.168.0.4 32766
# add more lines with all the ports you need until it's correct.

------------------------
now run the rc.local file.

Note: Netfilter has this feature added as standard so if you find you can't get this working, use iptables.

/raz

"-A input -s 0/0 -d 0/0 -i eth0 -j ACCEPT
-A input -s 0/0 -d 0/0 -i eth1 -j ACCEPT"

I tried removing this from ipchains and the locals couldnt get to the net anymore. This was installed with redhats ipchians config upon installing. I chose medium and opened all the ports available except telnet.




"Now go and install some software called "ipmasqadm" from
ftp://ftp.redhat.com/pub/contrib/li...0.4.2-3.src.rpm"

This will not install, period! I am trying to install it via a VncServer as root. I see a little hard drive activity on the box but thats it. I have installed rpm's before and usualy see a window open and show what its doing. Nothing seen here upon this rpm install though. If i right click on it and hit "upgrade" i get nothing also.