hello!

I tried to configure my firewall (under RH 9.0) to allow secure access only from one computer and also to permit ping from that machine, but didn't work! :-(

here is the example:
...
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp -s 192.168.1.1/32 --dport 22 --syn -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 --syn -j REJECT
...
-A RH-Lokkit-0-50-INPUT -p icmp -s 192.168.1.1/32 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p icmp -j REJECT
...

what's wrong here? there is a syntax problem? have somebody any sugestion? do you know some usefull links with some RH-Lokkit-0-50 firewall examples?

thanks a lot!

florin

RH-Lokkit, or Gnome-Lokkit is only used if you have really simple needs. It is just a script generator for iptables. The way you would write that first rule would be
From the command line enter the following

iptables -A INPUT -p tcp -s ! 192.168.1.1 --destination-port 22 -j DROP
(This will accept port 22 connections only from that ip address).

And the second rule
iptables -A INPUT -p icmp -s ! 192.168.1.1 -j DROP

Give that a shot..

hey!

thanks for your reply!

I used those roules, but ... any changes. Then, I wrote a firewall script, like following:

#!/bin/bash

/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT

/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -F FORWARD

/sbin/iptables -F ping
/sbin/iptables -X ping
/sbin/iptables -N ping

/sbin/iptables -F ssh
/sbin/iptables -X ssh
/sbin/iptables -N ssh

/sbin/iptables -F ftp
/sbin/iptables -X ftp
/sbin/iptables -N ftp

/sbin/iptables -A INPUT -p icmp -j ping

/sbin/iptables -A INPUT -p tcp --dport 21 -j ftp
/sbin/iptables -A INPUT -p udp --dport 21 -j ftp


#/sbin/iptables -A INPUT -p tcp -s ! 192.168.3.1/32 --dport 22 -j DROP
#/sbin/iptables -A INPUT -p udp -s ! 192.168.3.1/32 --dport 22 -j DROP

/sbin/iptables -A INPUT -p tcp --dport 22 -j ssh
/sbin/iptables -A INPUT -p udp --dport 22 -j ssh

/sbin/iptables -A ping -s 192.168.1.1/32 -j ACCEPT
/sbin/iptables -A ping -s 192.168.1.110/32 -j ACCEPT
/sbin/iptables -A ping -j DROP

/sbin/iptables -A ftp -s 192.168.1.0/24 -j ACCEPT
/sbin/iptables -A ftp -s 192.168.3.0/24 -j ACCEPT
/sbin/iptables -A ftp -j DROP

/sbin/iptables -A ssh -s 192.168.1.1/32 -j ACCEPT
/sbin/iptables -A ssh -s 192.168.1.110/32 -j ACCEPT
/sbin/iptables -A ssh -j DROP

but also ... didn't work :-( The hosts.allow file is well configured, and can't ping or have ssh connection from the other machine ...

what could be wrong? any suggestion?

greets!

florin

Don't use the path /sbin/ in your script. If Iptable is running it is not needed and clutters up the script.

Using custom tables (like ssh above) can make iptables more confusing than it needs to be. Are you using this firewall to protect against machines on your internal network? I see the rule

/sbin/iptables -A ftp -s 192.168.1.0/24 -j ACCEPT

and I wonder why not just say

iptables -A INPUT -i $INTINT -s 192.168.1.0/24 -j ACCEPT

which would accept ALL connections on the internal interface from the ip range 192.168.1.0/24

I try to stick with just the following tables
INPUT
OUTPUT
FORWARD
PREROUTING
POSTROUTING

Tends to make things easier and cleaner in the scripting.
I would check out "Red Hat Linux Firewalls" from your local library if they have it. It's the greatest book ever on iptables.

I hope this helps. Describe exactly what connections you want to allow from the Internet and from the local network and we'll take another stab at this.. :-)