iptables in stealth [SOLVED]

gregor · 2011-10-30 20:36:12

when i ;

[greglee@myhost ~]$ s0 firestarter
External network device eth0 is not ready. Aborting..

so firestarter doesn't recognize my 'eth0'

[greglee@myhost ~]$ ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 metric 1
inet 213.218.3.193 netmask 255.255.240.0 broadcast 255.255.255.255
inet6 fe80::725a:b6ff:fedb:e7b prefixlen 64 scopeid 0x20<link>
ether 70:5a:b6:db:0e:7b txqueuelen 1000 (Ethernet)
RX packets 93429 bytes 133327047 (127.1 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 52287 bytes 4206895 (4.0 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 18

[greglee@myhost ~]$ lspci | grep net
05:00.0 Ethernet controller: Broadcom Corporation NetLink BCM5784M Gigabit Ethernet PCIe (rev 10)

it's up and running ..... What could be wrong ?

Last edited by gregor (2011-11-11 19:09:20)

falconindy · 2011-10-30 20:45:01

firestarter parses the output of ifconfig instead of figuring out what's up and available on its own. The latest ifconfig changed its output, so unexpected results are returned. See src/scriptwriter.c for the glorious, terrifying details.

gregor · 2011-10-30 21:54:34

dude realize please ... we're not all developers ,this is to much to handle for me by my self.

i googled the 'src/scriptwriter.c' and got a shitload of info ,none of my comprehension

firewall issues are not my thing... my router broke down so i needed to install one.

Last edited by gregor (2011-10-30 21:56:54)

R00KIE · 2011-10-30 22:07:15

gregor wrote:

dude realize please ... we're not all developers ,this is to much to handle for me by my self.
i googled the 'src/scriptwriter.c' and got a shitload of info ,none of my comprehension
firewall issues are not my thing... my router broke down so i needed to install one.

The first part of the answer was quite clear, I guess you will have to wait until there is a patch that solves the problem or use an alternative iptables frontend or use iptables directly.

As for the code, from what I can understand all the values that are used come from grepping and cutting the output of several system tools, if anything changes, which it did, all hell breaks loose.

@falconindy
"... glorious, terrifying details."
This one was epic XD and made me check the source to see all the terrifying details in all their glory

gregor · 2011-10-30 22:22:35

mmmh.....script wankers

Last edited by gregor (2011-10-30 22:23:44)

jelly · 2011-10-30 22:31:15

I recommend learning IPtables by hand. Not that hard
https://wiki.archlinux.org/index.php/Iptables

gregor · 2011-10-30 22:41:45

who are u kidding /? that HOWTO sucks

R00KIE · 2011-10-30 23:27:43

Missed the links? https://wiki.archlinux.org/index.php/Iptables#Guides

gregor · 2011-10-31 08:59:20

first of all i have to solve my eth0 problem.... it,s up and running but doesn,t get detected somehow

laloch · 2011-10-31 09:46:58

There's no problem with your eth0. The guys already told you that the firestarter is broken. You just have to wait for someone to fix it or learn to use something sane to control the netfilter (which would be better for everyone).

gregor · 2011-10-31 10:29:32

something is wrong ,when i install 'guarddog' (other firewall) and try to save the setup it rejects and starts nagging about the iptabels not loaded (which they are)

[greglee@myhost ~]$ lsmod | grep iptable
iptable_nat 4056 0
nf_nat 15629 1 iptable_nat
iptable_mangle 1584 0
nf_conntrack_ipv4 11665 3 iptable_nat,nf_nat
nf_conntrack 59639 4 iptable_nat,nf_nat,nf_conntrack_ipv4,xt_state
iptable_filter 1488 0
ip_tables 16775 3 iptable_nat,iptable_mangle,iptable_filter
x_tables 17467 9 iptable_nat,iptable_mangle,xt_NFQUEUE,ipt_REJECT,xt_state,xt_limit,xt_tcpudp,iptable_filter,ip_tables

laloch · 2011-10-31 11:12:28

gregor wrote:

...when i install 'guarddog' (other firewall) and try to save the setup it rejects and starts nagging about the iptabels not loaded (which they are)

Another broken package. See comments at https://aur.archlinux.org/packages.php?ID=8998

Edit: btw, if you really need some graphical front-end, try fwbuilder. It's maintained, it works and it's in [extra].

Last edited by laloch (2011-10-31 11:29:03)

gregor · 2011-10-31 11:38:43

thnx gonna try

[EDIT;] looks just fine

Last edited by gregor (2011-10-31 14:18:21)

gregor · 2011-11-04 15:37:18

does anybody know the firewall-builder well ? i can,t get it into stealht mode [using iptables....] I have no experience with this what so ever. I tried over and over again..still nothing works how it should be.

this annoys me allot

gregor · 2011-11-11 18:33:52

# Cleanup old rules # All the time firewall is in a secure, closed state
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables --flush # Flush all rules, but keep policies
iptables --delete-chain

## Workstation Minimal firewall ###
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -A INPUT -i lo --source 127.0.0.1 --destination 127.0.0.1 -j ACCEPT
iptables -A INPUT -m state --state "ESTABLISHED,RELATED" -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

####### HOLES ####### Edit holes below, then run this script again
#iptables -A INPUT -p tcp --dport ssh -j ACCEPT
#iptables -A INPUT -p tcp --dport http -j ACCEPT
#iptables -A INPUT -p tcp --dport https -j ACCEPT
##################### Edit above

iptables -A INPUT -j LOG -m limit --limit 40/minute
iptables -A INPUT -j DROP

whow "stealth"

source= http://myy.helia.fi/~karte/iptables_firewall.html

Last edited by gregor (2011-11-13 12:24:02)

Arch Linux

#1 2011-10-30 20:36:12

iptables in stealth [SOLVED]

#2 2011-10-30 20:45:01

Re: iptables in stealth [SOLVED]

#3 2011-10-30 21:54:34

Re: iptables in stealth [SOLVED]

#4 2011-10-30 22:07:15

Re: iptables in stealth [SOLVED]

#5 2011-10-30 22:22:35

Re: iptables in stealth [SOLVED]

#6 2011-10-30 22:31:15

Re: iptables in stealth [SOLVED]

#7 2011-10-30 22:41:45

Re: iptables in stealth [SOLVED]

#8 2011-10-30 23:27:43

Re: iptables in stealth [SOLVED]

#9 2011-10-31 08:59:20

Re: iptables in stealth [SOLVED]

#10 2011-10-31 09:46:58

Re: iptables in stealth [SOLVED]

#11 2011-10-31 10:29:32

Re: iptables in stealth [SOLVED]

#12 2011-10-31 11:12:28

Re: iptables in stealth [SOLVED]

#13 2011-10-31 11:38:43

Re: iptables in stealth [SOLVED]

#14 2011-11-04 15:37:18

Re: iptables in stealth [SOLVED]

#15 2011-11-11 18:33:52

Re: iptables in stealth [SOLVED]

Board footer