Firewall problems...

[TheBigBasicQ]

I am using Jay's Firewall configuration utility to configure my iptables firewall. Originally when configured it, all ports were stealthed. But now some of my ports are visible. Ports 25(SMTP) and 53(DNS) are shown as closed and open respectively. Also, I am getting some errors when my system boots up:
ifup: /etc/sysconfig/network-scripts/ifup-post: network-functions: line 224: syntax error: unexpected end of file

ifup: /etc/sysconfig/network-scripts/ifup-aliases: network-functions: line 224: syntax error: unexpected end of file

I havent changed any settings for quite sometime now so how did these ports become 'unstealthed'?

Also, I have set all ICMP requests to be dropped. Is that alright?

Where can I view the logs? I cant find them anywhere in my /var/logs/messages etc...

I am using RedHat 9 and am a newbie so please explain me in detail.

Nobody is perfect =(
.
.
.
.
I am nobody =D

 

[stefanwagner]

Sorry - but setting up a firewall is NOT a newbie issue.
You have to have a deep knowledge of your system and on networkprotocols/ services too.

 

[bfks3230]

Actually, you could use the Mandrake Multi Network Firewall. It's pretty self-explanatory.

http://www.mandrakesoft.com/products/mnf

If you have a small network, you can do Coyote Linux. It runs off a floppy.

http://www.coyotelinux.com/

This really is not a newbie issue, but you can't buy this kind of experience at Walmart.

Red Hat has become somewhat bloated. A lot of the specifically designed firewall products can run on very minimal machines.

You can get a decent hardware-based firewall for about $50 nowadays. I saw a Belkin a couple weeks ago for $9.95

 

[zeland]

How do you check to see if your ports are open? If you expect a connection to come in on that port, then it should be open. Stealth (dropping ICMS packets) usually means that your machine will not respond to an ICMP request but doesn't stop people from connecting to it. IPTABLES will log everything in /var/logs/messages if you append the "-j LOG" to your ruleset. It will be easier for you to spot them if you used the prefix option -j LOG --log-prefix "FIREWALL LOG: ". Now you can do a cat /var/logs/messages | grep "FIREWALL LOG" to it all.

Anything can go wrong. It's just a matter of how far wrong it will go till people think its right.