**SUPPORT** Personal Firewall with Shorewall Tutorial

big_D · n00b Joined: 14 Apr 2005 Posts: 40 Location: UK

Here you go:

Sith_Happens · Posted: Thu Apr 14, 2005 9:52 pm Post subject:

Is this computer connected directly to the internet, or are you behind a fiewall/router appliance?
_________________
"That question was less stupid; though you asked it in a profoundly stupid way."
I'm the brains behind Jackass! | Tutorials: Shorewall

big_D · n00b Joined: 14 Apr 2005 Posts: 40 Location: UK

It's behind a combined router & modem.

Sith_Happens · Posted: Thu Apr 14, 2005 11:08 pm Post subject:

big_D · n00b Joined: 14 Apr 2005 Posts: 40 Location: UK

I told you it was something really obvious!

It's sorted now, thanks for your help.

Sith_Happens · Posted: Thu Apr 14, 2005 11:36 pm Post subject:

arthurdent · n00b Joined: 19 Feb 2005 Posts: 24

Hi Sith,

Thanks for a most fantastic tutorial. I have been using Fedora Core for a couple of years now and I recently decided to try Gentoo to take my level of Linux understanding up a notch. Whilst I am reasonably PC-savvy I know absolutely nothing about networking so the idea of having to create my own firewall scared the bejasus out of me (Fedora does it all for you). Your tutorial rescued me and made the whole thing a breeze. Thank you!

I do have one question however. When I pop in an audio CD, my apps (eg gnome-cd-player) can't access the CDDB servers to display CD information (artist, title, tracks etc.). How do I set up Shorewall to allow them access to the servers? (Remember I am a networking dunce).

Thanks for a great resource.

Mark

Johnyp · Guru Joined: 23 Mar 2005 Posts: 301

Check what port is used by CDDB (can be 888, 8880 or anything else really) and then open that port just as you have opened all the rest). You should be able to check the port in the app itself or in the config file for it.
_________________
Gentoo Unanswered Questions- Give it a try!

arthurdent · n00b Joined: 19 Feb 2005 Posts: 24

I'd already tried both 888 and 8880 but neither of them seemed to work.
Do I need to stop and restart Shorewall after making changes to /etc/shorewall/rules? (because I didn't do that - I just editited the rules file and then re-tried the CD Player).

Mark

Edit: I've added both ports 888 and 8880 to /etc/shorewall/rules and stopped and restarted shorewall. Still no joy.

Johnyp · Guru Joined: 23 Mar 2005 Posts: 301

Yes, you need to restart the Shorewall and flush all the rules. One way to do it is to reboot your PC. second is this

Sith_Happens · Posted: Sun Apr 17, 2005 3:39 am Post subject:

A.S. Pushkin · Posted: Sun Apr 17, 2005 5:27 am Post subject: Deception Tool Kit

I, too, find shorewall very nice. I originally thought to use iptables, or even knetfilter or firestarter, but found all of these very complex, due, no doubt, to my lack of knowledge in this area.

I may attempt to use DTK in conjunction with shorewall and offer more confusion factor.
_________________
ASPushkin

"Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves."

-- William Pitt {1759-1806 British Statesman}

arthurdent · n00b Joined: 19 Feb 2005 Posts: 24

Sith & Johnyp,

Thanks very much for your help. Although I had tried stopping and re-starting shorewall I didn't realise that you had to run "clear". Having rebooted (or actually gone to bed and booted up the next day...) it worked!

Thanks again.

Great resource (again)!

Mark

kamagurka · Posted: Mon Apr 18, 2005 5:26 pm Post subject:

Strange problem here: when I try starting shorewall, I get this output:

Johnyp · Guru Joined: 23 Mar 2005 Posts: 301

If you are not doing any NAT (network address translation. For example if your gentoo box does not serve as a firewall to a network) - comment out loc and dmz in your /etc/shorewall/zones file.
Most likely it will still fail after this, but at least we will get the first part resolved.

You may also want to provide your zone,policy and rules files.
_________________
Gentoo Unanswered Questions- Give it a try!

Sith_Happens · Posted: Mon Apr 18, 2005 6:35 pm Post subject:

kamagurka · Posted: Mon Apr 18, 2005 7:04 pm Post subject:

gifti · n00b Joined: 03 Jan 2004 Posts: 13

Hi,
I'm not sure this question belong here, but I will take a shot anyhow. I'm running shorewall and sshd with a number of users. I would like to restrict ssh access to one user at a time, unless it is myself. I should always be permitted to login disregarding other users. The user that is allowed to login should not necessarily be limited to one connection. Is this a firewall job or how can this be done?

thx
g

Johnyp · Guru Joined: 23 Mar 2005 Posts: 301

kamagurka

just looked at my output and Iptables/Netfilter featerus all read - Avaliable.
Are you sure you compiled your kernel with iptables/netfilter?
_________________
Gentoo Unanswered Questions- Give it a try!

Johnyp · Guru Joined: 23 Mar 2005 Posts: 301

gifti
No, this may be an SSH feature, or you may want to look into tcp_wrappers (tcpd). I really don't think you can set something like this with iptables/netfilter (shorewall). And even if it's possible - i think it may be very-very difficult to do it with firewall (if possible at all).
_________________
Gentoo Unanswered Questions- Give it a try!

Sith_Happens · Posted: Mon Apr 18, 2005 8:31 pm Post subject:

kamagurka · Posted: Mon Apr 18, 2005 9:25 pm Post subject:

I have definetely enabled "Network packet filtering" in my kernel. Your howto doesn't provide information on this, but in there I enabled the following:

Johnyp · Guru Joined: 23 Mar 2005 Posts: 301

M stands for - to install as a module. I belive you need to change it to *, so it's compiled normally into kernel and not as a module. But i may be wrong here.
_________________
Gentoo Unanswered Questions- Give it a try!

Sith_Happens · Posted: Mon Apr 18, 2005 10:55 pm Post subject: