So... been the noob I am, I readed some of the iptables documentations and I got kinda overwhelmed... so I descided to first use a front-end as guardog for now untill I learn enough to do my own iptables script.

Unfortunately, none of them work.

GuardDog
The script generated produce a bunch of errors. Network trafic = partial.
-------------------------------------------
Using iptables.
Resetting firewall rules.
Loading kernel modules.
Setting kernel parameters.
Configuring firewall rules.
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
Finished.
---------------------------------------------
For each rule I set in guarddog, one error line is added.


FireStarter
Network trafic = partial
No errors are shown by this one.

With partial trafic I mean; the web browser would find the URL, then will time out. (same results regardless configuration.)


--------- Question. ------------

Could this be related to my kernel configuration ???
Am I going to be forced to learn iptables ???

Note: Kernel includes iptables. (NO ipchains)

[edit] typo...
[edit] Kernel version 2.6.5 (custom)

Could this be related to my kernel configuration ???
Possibly. How do you include support for iptables, as modules or built into the kernel (monolithic)?

Couple of other questions:

What versions of guarddog and firestarter are you using?(2.6 support is relatively recent)

Can you also give us the output of iptables -L ? Make sure to remove/change any identifiable IP addresses

Can you ping by ip address? by hostname (ping www.yahoo.com)?

Iptables are compiled as modules.

Output from lsmod:
---------------------------------
Module Size Used by
nvidia 2074792 -
ipv6 246240 -
binfmt_misc 10216 -
ipt_ttl 1600 -
ipt_limit 2176 -
iptable_filter 2496 -
ipt_LOG 5344 -
ipt_REJECT 6560 -
ip_tables 16384 -
af_packet 21256 -
8250_pci 16672 -
8250 22032 -
serial_core 22880 -
mtdcore 6468 -
chipreg 2852 -
hw_random 5108 -
intel_agp 17692 -
agpgart 32904 -
hid 32448 -
usblp 12768 -
eepro100 29772 -
mii 4768 -
uhci_hcd 31696 -
usbcore 102140 -
snd_ens1371 22372 -
snd_rawmidi 23424 -
snd_pcm 94948 -
snd_page_alloc 10852 -
snd_timer 24804 -
snd_ac97_codec 62756 -
snd 52132 -
soundcore 9056 -
isofs 34200 -
nls_cp437 5440 -
vfat 15232 -
fat 45248 -
ide_cd 40484 -
cdrom 39840 -
rtc 12248 -
unix 27632 -
------------------------

Guarddog Ver 2.3.0-2
Firestarter Ver 0.9.2-4
Debian 'Sarge'
----------------------
~$ ping www.yahoo.com
PING www.yahoo.akadns.net (66.94.230.37) 56(84) bytes of data.
64 bytes from p6.www.scd.yahoo.com (66.94.230.37): icmp_seq=1 ttl=52 time=35.1 ms

~$ ping 66.94.230.45
PING 66.94.230.45 (66.94.230.45) 56(84) bytes of data.
64 bytes from 66.94.230.45: icmp_seq=1 ttl=52 time=36.9 ms
----------------------
And my borwser will only say...
"Resolving host www.yahoo.com ..."
"Connecting to www.yahoo.com ..."
And thats it... no juice... no page.. it will wait there forever (until timeout) trying to load the page....

output of 'iptables -L'
-----------------------------
# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp spt:bootps dpt:bootpc
ACCEPT all -- MY.IP-ADDRESS.net 255.255.255.255
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
nicfilt all -- anywhere anywhere
srcfilt all -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
srcfilt all -- anywhere anywhere

Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp spt:bootpc dpt:bootps
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
s1 all -- anywhere anywhere

Chain f0to1 (3 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpts:7937:9936
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpts:10001:30000
ACCEPT udp -- anywhere anywhere udp dpt:ntp
ACCEPT udp -- anywhere anywhere udp dpt:isakmp
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:4665
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:4666
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpts:411:415
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpts:1411:1415
ACCEPT udp -- anywhere anywhere udp spts:1411:1415
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:kerberos
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:4444
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:464
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp spt:6257 dpts:1024:65535
ACCEPT udp -- anywhere anywhere udp dpt:113
ACCEPT udp -- anywhere anywhere udp dpt:43
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT udp -- anywhere anywhere udp dpt:socks
ACCEPT gre -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:524
ACCEPT udp -- anywhere anywhere udp spt:427 dpt:427
ACCEPT udp -- anywhere anywhere udp spt:2645 dpt:2645
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:kazaa
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc
ACCEPT udp -- anywhere anywhere udp
ACCEPT udp -- anywhere anywhere udp dpt:2049
ACCEPT udp -- anywhere anywhere udp dpt:syslog
ACCEPT esp -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:netbios-ssn
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:41170
ACCEPT udp -- anywhere anywhere udp dpts:33434:33600
ACCEPT udp -- anywhere anywhere udp dpt:79
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:time
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc
ACCEPT udp -- anywhere anywhere udp dpts:1024:5999
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:icpv2
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:4666
ACCEPT udp -- anywhere anywhere udp dpts:1411:1415
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:6257
ACCEPT icmp -- anywhere anywhere icmp redirect
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpts:1024:5999
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:41170
ACCEPT udp -- anywhere anywhere udp spt:5050 dpt:5050
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:icpv2
logdrop all -- anywhere anywhere

Chain f1to0 (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:4666
ACCEPT udp -- anywhere anywhere udp dpts:1411:1415
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:6257
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp redirect
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpts:1024:65535
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:41170
ACCEPT udp -- anywhere anywhere udp spt:5050 dpt:5050
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:icpv2
ACCEPT udp -- anywhere anywhere udp dpt:ntp
ACCEPT udp -- anywhere anywhere udp dpt:isakmp
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpts:7937:9936
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpts:10001:30000
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:4665
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:4666
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpts:411:415
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpts:1411:1415
ACCEPT udp -- anywhere anywhere udp spts:1411:1415
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:kerberos
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:4444
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:464
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt:43
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT udp -- anywhere anywhere udp dpt:113
ACCEPT udp -- anywhere anywhere udp spt:6257 dpts:1024:65535
ACCEPT udp -- anywhere anywhere udp dpt:socks
ACCEPT gre -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:524
ACCEPT udp -- anywhere anywhere udp spt:427 dpt:427
ACCEPT udp -- anywhere anywhere udp spt:2645 dpt:2645
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:kazaa
ACCEPT udp -- anywhere anywhere udp dpt:syslog
ACCEPT esp -- anywhere anywhere
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc
ACCEPT udp -- anywhere anywhere udp
ACCEPT udp -- anywhere anywhere udp dpt:2049
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp spt:netbios-dgm dpt:netbios-dgm
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:netbios-ssn
ACCEPT udp -- anywhere anywhere udp dpts:33434:33600
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:41170
ACCEPT udp -- anywhere anywhere udp dpt:79
ACCEPT udp -- anywhere anywhere udp spts:1024:5999 dpt:time
ACCEPT udp -- anywhere anywhere udp dpt:sunrpc
ACCEPT udp -- anywhere anywhere udp dpts:1024:65535
ACCEPT udp -- anywhere anywhere udp spts:1024:65535 dpt:icpv2
ACCEPT udp -- anywhere anywhere udp dpt:domain
logdrop all -- anywhere anywhere

Chain logaborted (0 references)
target prot opt source destination
logaborted2 all -- anywhere anywhere limit: avg 1/sec burst 10
LOG all -- anywhere anywhere limit: avg 2/min burst 1 LOG level warning prefix `LIMITED '

Chain logaborted2 (1 references)
target prot opt source destination
LOG all -- anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `ABORTED '

Chain logdrop (4 references)
target prot opt source destination
logdrop2 all -- anywhere anywhere limit: avg 1/sec burst 10
LOG all -- anywhere anywhere limit: avg 2/min burst 1 LOG level warning prefix `LIMITED '
DROP all -- anywhere anywhere

Chain logdrop2 (1 references)
target prot opt source destination
LOG all -- anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `DROPPED '
DROP all -- anywhere anywhere

Chain logreject (0 references)
target prot opt source destination
logreject2 all -- anywhere anywhere limit: avg 1/sec burst 10
LOG all -- anywhere anywhere limit: avg 2/min burst 1 LOG level warning prefix `LIMITED '
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
DROP all -- anywhere anywhere

Chain logreject2 (1 references)
target prot opt source destination
LOG all -- anywhere anywhere LOG level warning tcp-sequence tcp-options ip-options prefix `REJECTED '
REJECT tcp -- anywhere anywhere reject-with tcp-reset
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
DROP all -- anywhere anywhere

Chain nicfilt (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
RETURN all -- anywhere anywhere
logdrop all -- anywhere anywhere

Chain s0 (1 references)
target prot opt source destination
f0to1 all -- anywhere MY_IP_ADDRESS.net
f0to1 all -- anywhere 255.255.255.255
f0to1 all -- anywhere noisybox
logdrop all -- anywhere anywhere

Chain s1 (1 references)
target prot opt source destination
f1to0 all -- anywhere anywhere

Chain srcfilt (2 references)
target prot opt source destination
s0 all -- anywhere anywhere

Ugg, I hate these Guarddog scripts. They might actually be easier to debug if they were in hex or Aramaic. /***FIGHTING URGE TO RANT ABOUT STUPIDITY OF NAMING CHAINS f1to3 ****/ Sorry :-]

Just looking at the script, there are some weird things going on. First there are a million udp ports opened, but no tcp ports. I'm not sure if that is an option that may have been disabled or something, but you will certainly need them open. That might also explain why ping works (there are rules that allow icmp, but no tcp). Does it work if the firewalll is off?

Yes it works with firewall off. No problems there.
And yes, those naming are not easy to debug.. I tried !!! I swear !! But my noobiness would not let me go to far when I was trying to decyphere the darn script.

So, to not waste your time. I gonna put the efort to make my own ipchains, and just get over these firewall front ends.

Just give me some pice of mind and tell me I dont need a new kernel !!! ;P

Ok, here is what was going on.

Was the darn kernel. While I had all the iptables modules, I was missing one more module that seems to be crucial with these filtering thingy.

Module IP_NF_CONTRACK neds to be in the kernel. After analizing some log files, and digging in the kernel configuration, is how I got some clues.

Then a tutorial in iptables confirmed the need for such module.

I use 'make xconfig' to configure my kernels (32 so far since 02/22/04), and the description fo this one got me confused since I am not doing NAT (or at least I thought so, LOL). This is my only PC, so I thought NAT was not necesary.

But then again, What there is for a noob to know such dark matters ?

I noticed the missing modules, but it didn't click. That's why there are no tcp rules, because they all are loaded with the state match "NEW". You're actually short a couple of modules:

ipt_state
ip_conntrack


You're not such a noob after all, huh? Nice job.

Thank you Captain,
I will make sure I got ipt_state also.

Your help and time is greatly appreciated. =)