Helllo all,

I'm trying to get my SuSE firewall configured....to do so I began using this HOW-To from SuSE:

http://sdb.suse.de/sdb/en/html/pohle...hfirewall.html

But I have run into some discrepancies with the article....

#1) The first thing I'm asked to do is to add this line to the /etc/sysconfig/personal-firewall:

REJECT_ALL_INCOMING_CONNECTIONS="pppX"

Here pppX (the right one for DSL) should be the device number, but I have no device number for ppp....(I'm assuming you check that with an ifconfig -a).....????

The only devices I get are: eth0, lo, and sit0.

Hmmmmm....and now what????

#2) Second, I have an adsl ehternet modem (up and running) and the article says that for that set-up, I should have an entry like this:

"...In case you use DSL, the name of the file for the first DSL device is ifcfg-dsl0...."

What I have in that directory is:

localhost:/etc/sysconfig/network # ls -la
total 38
drwxr-xr-x 6 root root 320 Apr 9 02:02 .
drwxr-xr-x 5 root root 1224 May 15 10:49 ..
-rw-r--r-- 1 root root 4464 Sep 10 2002 config
-rw-r--r-- 1 root root 5152 May 15 10:48 dhcp
drwxr-xr-x 2 root root 48 Sep 10 2002 if-down.d
drwxr-xr-x 2 root root 48 Sep 10 2002 if-up.d
-rw-r--r-- 1 root root 93 Mar 13 17:03 ifcfg-eth0
-rw-r--r-- 1 root root 96 Sep 10 2002 ifcfg-lo
-rw-r--r-- 1 root root 3970 Sep 10 2002 ifcfg.template
drwx------ 2 root root 48 Sep 10 2002 providers
drwxr-xr-x 2 root root 856 May 15 10:48 scripts
-rw-r--r-- 1 root root 4819 May 15 10:48 wireless

Thus the only entry I have (as far as I get it) is:

ifcfg-eth0

Should I then configure this one?


Any thoughts?

Do a 'route | grep 'default' ' command. Whatever Interface is listed (last coulmn) is will be the one you're going to use in your firewall rules. I'm guessing that the ethernet (*hint hint*) adsl modem is going to be using the first ethernet network device, eth0.

And so it was!

OK, so I proceeded to set up my firewall, and as far as I can see...it's up and running!! Cheers bentz!

But, how can I be sure of these two points:

1) How do I know I have set it up correctly and that it is giving me the degree of protection I'd need?

2) How can I verify that it is NOT blocking traffic that I need to have flowing as prior to the firewall setup?

Personally, the way I solve these two problems is by the following:
1. nmap your machine from the outside. If you get dropped all over the place, you are safe. Basically, just try to crack yourself, before others try the same.
2. Test outgoing connections to ensure that everything is working the way it should. What I typically do is a 'iptables -L -v' to view the connection count statistics. Then I attempt a connection and watch each target's statistic increase as I am testing services and making connections. The same is true for the above; if you port scan yourself and see that your DROP policy count statistic is going up like crazy as the port scanner makes attempts on your machine, you know it is working for you.

Okeee...

What is nmap? Is it a port scanner?

How could I simultate a machine trying to connect from the outside to my ports so I can check them?

i alwasy suggest learning iptables to setup a firewall. Many GUI apps are front-ends to iptables. Also, iptables gives you more flexibility (I use it to route traffic as well as drop what doesn't need to be sent or recieved or forwarded from one network to the other) and you can use it if you ever do an installation without X.

Okaaay.....

guess where I found out what Nmap was......


http://news.bbc.co.uk/2/hi/technology/3039329.stm



Robert0380: Yup, I am going to follow up on iptables; let you know how it went.

**** How could I simultate a machine trying to connect from the outside to my ports so I can check them?

Don't simulate it, get someone to do it!

Try ShieldsUp at http://www.grc.com

ignore the bit about downloading their IP Agent - this is Windows-only software. The site will detect your computer's internet IP address nonetheless. Do the 'Probe My Ports' as well, for a full confidence check. Be careful here; reading this site can be addictive, especially if you have a touch of paranoia.

Geoff.

Pretty cool site!!!

OK, so here it is....

I did the Ports and Shields Scan, and came through quite well!!!

All ports were blocked with the exception of the ones I selected to only be closed which appear in fact "closed"....

So, now what?

Is closed good enough for port 80 for example?

What should I do with those ports?

That's good news, isn't it? This means that your firewall is behaving exactly the way you have set it up to do.

'Closed' means that a probe from outside the firewall will not get through, so your security is not at risk. But the prober will get notification that the port was closed, which will confirm that a computer exists at that port. This may give a determined hacker cause to hang around and try hacking your computer, whereas 'stealth' would have just dropped the probe and given no indication that a computer existed there.

Whether this is OK or not is up to you to decide; your security is OK for the moment but you have to balance the risk of announcing your presence against the benefit you get from having these ports 'closed', rather than set for 'stealth'. Only you will know this.

What should you do with these ports? Probably nothing at this stage; just leave it as it is and monitor for intrusion attempts. Your firewall should have logs that you can check for this.

For better info on this, look at grc.com's FAQ page in the Shield's Up section.

Geoff.