Hello, everyone. This is actually a renewal of an older thread (http://www.linuxquestions.org/questi...5&pagenumber=1)

I'm posting it again here in hopes that someone might see it and be able to help me.

Here's the story so far: I am trying to run a streaming server called Shoutcast. This streaming server requires that ports 8000 and 8001 be open for my relay. 8001 listens for the incoming source, from the studio, as it were, while 8000 streams the source material out to listeners.

However, everytime I try to stream, the server sends me a message saying I am behind a firewall.

I have tried everything to try to disable this firewall, or to open the ports. You can see what I've done in the original thread.

Finally, chort, a moderator for this forum, has suggested that the culprit is the Lokkit configuration, which is keeping me from controlling my firewall.

Here's my Lokkit file, followed by chort's comments:

ERROR - You must be root to run lokkit.
ERROR - only one of 'high', 'medium', and 'disabled' may be specified.
/sbin/iptables -D INPUT -j RH-Lokkit-0-50-INPUT 2>/dev/null /sbin/iptables -D FORWARD -j RH-Lokkit-0-50-INPUT 2>/dev/null /sbin/iptables -F RH-Lokkit-0-50-INPUT 2>/dev/null /sbin/iptables -X RH-Lokkit-0-50-INPUT 2>/dev/null /etc/resolv.conf nameserver w #!/bin/sh
PATH=/sbin:$PATH
iptables /bin/sh %s COMMIT
--syn *filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
iptables -N RH-Lokkit-0-50-INPUT
iptables -F RH-Lokkit-0-50-INPUT
%s-A RH-Lokkit-0-50-INPUT -p %s -m %s --dport %d %s -j ACCEPT
%s-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68 -i eth0 -j ACCEPT
%s-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 67:68 -d 0/0 --dport 67:68 -i eth1 -j ACCEPT
%s-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
%s-A RH-Lokkit-0-50-INPUT -i %s -j ACCEPT
%s-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT
%s-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT
%s-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT
%s-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT
%s-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT
%s-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT
/sbin/modprobe iptables >/dev/null 2>&1 /sbin/service iptables start >/dev/null 2>&1 %s-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --syn -j REJECT
%s-A RH-Lokkit-0-50-INPUT -p udp -m udp -j REJECT
%s-A RH-Lokkit-0-50-INPUT -p udp -m udp -s %s --sport 53 -d 0/0 -j ACCEPT
# Firewall configuration written by lokkit
# Manual customization of this file is not recommended.
# Note: ifup-post will punch the current nameservers through the
# firewall; such entries will *not* be listed here.
:RH-Lokkit-0-50-INPUT - [0:0]
-A INPUT -j RH-Lokkit-0-50-INPUT
-A FORWARD -j RH-Lokkit-0-50-INPUT
/sbin/iptables -F RH-Lokkit-0-50-INPUT

And chort's reaction:

I need a firewall as chort described, with the following ports open for eventual streaming: 8000, 8001, but also 7995, 7996, 7998, and 7999 open for incoming, plus ssh inbound/outbound and FTP inbound/outbound.

Does anyone think this Lokkit file is NOT the culprit, or that this rewrite is not necessary? Please let me know. Please see the original thread for more information.

Thank you in advance.

One fellow at SHOUTcast suggested I trash Lokkit and feed another script that he provided straight into iptables. I presume the settings in Lokkit are also in iptables, and I intend to look when I have time. If I find them, could I just delete them?

Could it be that iptables has lots of conflicting filters, such as those provided in the Lokkit config, and could those conflicts be causing my problems?

Any thoughts?

Here's the latest:

I am now wondering if this is a hardware/driver problem. Here's why:

I have looked at my IP tables. They are not the problem. The "bad" Lokkit config is not in the IP tables, and so I am sure it is having no effect. I don't even know WHY it's in the Lokkit app... I deleted all iptable scripts from the Lokkit app, so it is now empty except for some non-iptable code. I don't plan on using Lokkit again.

Here's what my original IP tables look like. Apparently, the Lokkit commands I WANTED went in. Does this look like a reasonable firewall?:

# Firewall configuration written by lokkit
# Manual customization of this file is not recommended.
# Note: ifup-post will punch the current nameservers through the
# firewall; such entries will *not* be listed here.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Lokkit-0-50-INPUT - [0:0]
-A INPUT -j RH-Lokkit-0-50-INPUT
-A FORWARD -j RH-Lokkit-0-50-INPUT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7998 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7999 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 8000 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 8001 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 23 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 25 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 21 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 0:1023 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 2049 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT
-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 2049 -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 6000:6009 --syn -j REJECT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 7100 --syn -j REJECT
COMMIT

Now, I just added a script given to me by a fellow broadcaster at SHOUTcast. This script loaded just fine, but still I get the same firewall message from my sc_serv (Shoutcast server). Here's the script I inserted. It now follows the original config in iptables:

*filter
:INPUT DROP [16986:724916]
:FORWARD DROP [0:0]
:OUTPUT DROP [409:31084]
:SERVICES - [0:0]
-A INPUT -d my.linux.ip -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j SERVICES
-A OUTPUT -s my.linux.ip -o eth0 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j LOG --log-prefix "[FILTER/OUTPUT] "
-A SERVICES -d my.linux.ip -i eth0 -p tcp --dport 8000 -j ACCEPT
-A SERVICES -d my.linux.ip -i eth0 -p tcp --dport 8001 -j ACCEPT
-A SERVICES -d my.linux.ip -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT

Does that look reasonable, too? Is it ok to follow one filter with another, or do I need to modify something?

If not, then I need to begin looking at other causes, like the LAN driver. I am running an Asus P4P800 motherboard with 3com gigabit lan card, driver 3c2000. I have read that other Linux users have reported problems with this driver.

Any ideas? I could submit my driver config if anyone thinks that will help.

Linux has taught me how to be patient!