Re: Can't establish connection -

[Bob Goodwin <bobgoodwin@xxxxxxxxxxxx>]

On 26/05/10 09:54, Bob Goodwin wrote:
> On 26/05/10 04:09, Tim wrote:
>> On Tue, 2010-05-25 at 16:19 -0700, Rick Stevens wrote:
>>> If you want to log ALL new connections from box6 (remember that the
>>> "-s" bit is specifying connections coming FROM box6), use the "-I"
>>> version.
>> Yes, and you certainly want any logging rules before any ignoring rules,
>> because not only will such connections be ignored (not connecting),
>> they'll never get logged, either.
>>
>> On the other hand, if you want to log things that got past your
>> firewall, then you do want logging rules set after firewall rules.
>>
>
>    Well then if line location is important what I need is to be able to
>    add/modify the iptables file with a text editor, not via some
>    command. What is the name of the file I need to work on?
>
>    I'll look for it, see what I can find.
>
>    Thanks.
>
>    Bob
>
>
>
>


    less /etc/sysconfig/iptables  Produces the following. Is this the
    file I need to work on? It looks "simpler" than I expected but I am
    admonished not to "customize" it manually?

        # Firewall configuration written by system-config-firewall
        # Manual customization of this file is not recommended.
        *filter
        :INPUT ACCEPT [0:0]
        :FORWARD ACCEPT [0:0]
        :OUTPUT ACCEPT [0:0]
        -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
        -A INPUT -p icmp -j ACCEPT
        -A INPUT -i lo -j ACCEPT
        -A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT
        -A INPUT -m state --state NEW -m tcp -p tcp --dport 631 -j ACCEPT
        -A INPUT -m state --state NEW -m udp -p udp --dport 631 -j ACCEPT
        -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
        -A INPUT -m state --state NEW -m tcp -p tcp --dport 2049 -j ACCEPT
        -A INPUT -m state --state NEW -m udp -p udp --dport 2049 -j ACCEPT
        -A INPUT -m state --state NEW -m udp -p udp --dport 5060 -j ACCEPT
        -A INPUT -m state --state NEW -m udp -p udp --dport 8000:8005 -j
        ACCEPT
        -A INPUT -m state --state NEW -m udp -p udp --dport 5198:5200 -j
        ACCEPT
        -A INPUT -j REJECT --reject-with icmp-host-prohibited
        -A FORWARD -j REJECT --reject-with icmp-host-prohibited
        COMMIT
        ~
        ~
        ~

    Bob

    -- 

-- 
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines