opening firewall ports on the command line with Fedora';s firewall

[Scott Berry]

Hello there,

I need to open port I believe it is 6667 on the firewall for my Fedora server.  How would
this be done?

Scott

[David Christopher Chiipman]

	Hi Scott, 

		If I were you, I would look into using iptables ("man
iptables" for details). You do all of the firewall configuration as
"root", of course. Later, 

			-David Chipman

[Sam Varshavchik]

Scott Berry writes:

>  Hello there, 
>    
>  I need to open port I believe it is 6667 on the firewall for my Fedora 
>  server.  How would this be done?  
System → Administration → Security Level And Firewall

On Wednesday 16 May 2007, Sam Varshavchik wrote:
>  Scott Berry writes:
>  > Hello there,
>  >  
>  > I need to open port I believe it is 6667 on the
>  > firewall for my Fedora server.  How would this be done?
>
>  System → Administration → Security Level And Firewall 
He wants to know how to do it on the command line on a 
remote server.

-- 
If the word following begins with 
a vowel, the word you want is...
to read the rest of this, go here 
http://www.wsu.edu/~brians/errors/a.html

[Scott Berry]

Yup your right.

Scott

----- Original Message ----- 
From: <linuxmaillists(a)charter.net&gt;
To: "For users of Fedora" <fedora-list(a)redhat.com&gt;
Sent: Wednesday, May 16, 2007 8:40 PM
Subject: Re: opening firewall ports on the command line with Fedora';s 
firewall


>  On Wednesday 16 May 2007, Sam Varshavchik wrote:
> > Scott Berry writes:
> > > Hello there,
> > >
> > > I need to open port I believe it is 6667 on the
> > > firewall for my Fedora server. How would this be done?
> >
> > System → Administration → Security Level And Firewall
>
>  He wants to know how to do it on the command line on a
>  remote server.
>
>  -- 
>  If the word following begins with
>  a vowel, the word you want is...
>  to read the rest of this, go here
>  http://www.wsu.edu/~brians/errors/a.html
>
>  -- 
>  fedora-list mailing list
>  fedora-list(a)redhat.com
>  To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>
>
>
>  -- 
>  No virus found in this incoming message.
>  Checked by AVG Free Edition.
>  Version: 7.5.467 / Virus Database: 269.7.1/805 - Release Date: 5/15/2007 
>  10:47 AM
>
>

[Todd Zullinger]

Scott Berry wrote:
>  I need to open port I believe it is 6667 on the firewall for my
>  Fedora server.  How would this be done? 
It depends a little on what you mean by the subject.  If you just want
to use the standard Fedora tools from a console, then take a look at
system-config-securitylevel-tui.  Using that you would go to Customize
and then in the Allow incoming section, add 6667:tcp in the other
ports box.

If you instead want to be able to open this port via a command or
shell script, then you'll want to peruse the iptables man page and do
a little googling for examples.

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
A person is just about as big as the things that make them angry.
    -- Anonymous

[Doncho N. Gunchev]

On Thursday 2007-05-17 03:34:02 Scott Berry wrote:
>  Hello there,
>  
>  I need to open port I believe it is 6667 on the firewall for my Fedora server.  How would
> this be done?
>   
# iptables -I RH-Firewall-1-INPUT 1 -m state --state NEW -p tcp --dport 6667 -j ACCEPT
# iptables-save > /etc/sysconfig/iptables
# echo '--port=65022:tcp' >> /etc/sysconfig/system-config-securitylevel

that '1 ' after FORWARD should probably be 9 or more, just before the
last two lines, that log and reject the packet, in the RH-Firewall-1-INPUT
chain, but 1 would do. The third command is to make sure next time
you use system-config-securitylevel your port will not get lost.

-- 
Regards,
  Doncho N. Gunchev, GPG key ID: 0EF40B9E, Key server: pgp.mit.edu

[Matej Cepl]

On 2007-05-17, 00:34 GMT, Scott Berry wrote:
>  I need to open port I believe it is 6667 on the firewall for my 
>  Fedora server.  How would this be done? 
system-config-securitylevel-tui works through ssh (or at least it 
should work). However, just because I would love to get 
a feedback from wiser people, I will post here my script for 
iptables -- I found managing a script much better than fiddling 
with GUI (nothing against that -- it may be better for really 
simple operations, but when you run IRC server or something, 
a little bash script is just better, IMHO a IMMV):

    #!/bin/sh
    service iptables stop

    iptables -P INPUT  DROP
    for CHAIN in OUTPUT FORWARD ; do
        iptables -P $CHAIN ACCEPT
    done

    iptables -A INPUT -i lo -j ACCEPT
    iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT

    for CHAIN in INPUT OUTPUT FORWARD ; do
        iptables -A $CHAIN -m state --state ESTABLISHED,RELATED \
            -j ACCEPT
        iptables -A $CHAIN -m state --state INVALID -j LOG
        iptables -A $CHAIN -m state --state INVALID -j DROP
    done

    # Most of the work is done above -- so only NEW packets are 
    # of interest to us.

    # world open -- only ssh and even that is remapped to 
    # different port on firewall
    iptables -A INPUT -p tcp --dport ssh -j ACCEPT

    ## these are opened for the local network
    # HTTP
    iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport http -j ACCEPT
    # DNS
    iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 53 -j ACCEPT
    iptables -A INPUT -p udp -s 10.0.0.0/24 --dport 53 -j ACCEPT
    # ANY OTHER OPEN PORTS GO HERE....

    # masquerading (for Xen guests)
    iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

    # I prefer REJECT to DROP, but REJECT cannot be used as 
    # a default policy
    iptables -A INPUT -j REJECT

    service iptables save

I think you can find an inspiration here.

Matej

[Bruno Wolff III]

On Thu, May 17, 2007 at 11:05:27 +0200,
  Matej Cepl <mcepl(a)redhat.com&gt; wrote:
>  On 2007-05-17, 00:34 GMT, Scott Berry wrote:
>  > I need to open port I believe it is 6667 on the firewall for my 
>  > Fedora server.  How would this be done?
>  
>  system-config-securitylevel-tui works through ssh (or at least it 
>  should work). However, just because I would love to get 
>  a feedback from wiser people, I will post here my script for 
>  iptables -- I found managing a script much better than fiddling 
>  with GUI (nothing against that -- it may be better for really 
>  simple operations, but when you run IRC server or something, 
>  a little bash script is just better, IMHO a IMMV): 
What I like to do is maintain a creation script to do the initial setup
and then use the service commands to save the configuration where Fedora
normally does.

[Matej Cepl]

On 2007-05-17, 16:37 GMT, Bruno Wolff III wrote:
>  What I like to do is maintain a creation script to do the 
>  initial setup and then use the service commands to save the 
>  configuration where Fedora normally does. 
Do you see that

service iptables save

in the end of my script? That's the way how Fedora saves the 
settings. You can see the current tables (before and after 
running my script) with the command

/sbin/iptables -v -L

The original Red Hat firewall contains custom chain (that's 
something like procedures in the programming languages) which is 
good, but IMHO not required for the simple script like what is 
needed by both of us.

Best,

Matej

[Scott Berry]

You bet I see it.  I saved it.  Got it working for right now but I will work 
on the script when I get time.

Scott

----- Original Message ----- 
From: "Matej Cepl" <mcepl(a)redhat.com&gt;
To: <fedora-list(a)redhat.com&gt;
Sent: Thursday, May 17, 2007 3:03 PM
Subject: Re: opening firewall ports on the command line with Fedora'; s 
firewall


>  On 2007-05-17, 16:37 GMT, Bruno Wolff III wrote:
> > What I like to do is maintain a creation script to do the
> > initial setup and then use the service commands to save the
> > configuration where Fedora normally does.
>
>  Do you see that
>
>  service iptables save
>
>  in the end of my script? That's the way how Fedora saves the
>  settings. You can see the current tables (before and after
>  running my script) with the command
>
>  /sbin/iptables -v -L
>
>  The original Red Hat firewall contains custom chain (that's
>  something like procedures in the programming languages) which is
>  good, but IMHO not required for the simple script like what is
>  needed by both of us.
>
>  Best,
>
>  Matej
>
>  -- 
>  fedora-list mailing list
>  fedora-list(a)redhat.com
>  To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
>
>
>
>  -- 
>  No virus found in this incoming message.
>  Checked by AVG Free Edition.
>  Version: 7.5.467 / Virus Database: 269.7.1/807 - Release Date: 5/16/2007 
>  6:05 PM
>
>