opening a range of ports + xinetd

[eanda10]

I need to open a range of ports i.e. everything greater then 1023 on my redhat box I think what is blocking the connections is the xinted deamon how can I open a range of ports 1023 - 50,000?


can I just assign port to read 1023-50000

service AS2
{
port = 1023
socket_type = stream
protocol = tcp
user = root
server = /sbin/LexiCom/LexiCom
type = UNLISTED
wait = no
}

 

[sleipnir214]

It's most likely firewall settings.

No service provided by your server requires every port on the machine be open. What are you trying to do? Want the best answers? Ask the best questions:

http://www.tuxedo.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[eanda10]

I am setting up my server for the lovely AS2 communications with walmart they are telling me i have to open any port greater then 1024 to accept data from them.

 

[marsd]

What they mean is that you need to have available
client recv ports(INPUT chain) available greater
than 1024.
This is SOP on a well configured desktop firewall, but
never are all ports necessary. This is
laziness/stupidity on the tech support side.

A minimal config could look like this:
iptables -P INPUT DROP
iptables -A INPUT -s 0/0 -d $localbox -p tcp --dport 1024:5500 -j RECV_CHAIN(or just ACCEPT, but this
is cheesy and not really safe)
iptables -A INPUT -s 0/0 -d $localbox -p udp --dport 1024:5500 -j RECV_CHAIN/ACCEPT
iptables -A INPUT -s 0/0 -d $localbox -p tcp --dport 30000:65000 -j RECV_CHAIN/ACCEPT
iptables -A INPUT -s 0/0 -d $localbox -p udp --dport 30000:65000 -j RECV_CHAIN/ACCEPT
iptables -A INPUT -s 0/0 -d $localbox -p icmp -j icmp_chain

Where the user defined targets are rulesets you
implement to do what you need for your protection.
Given liberal rules elsewhere this should allow you
to talk with their services. Otherwise get them to
give you an exact client port range. gt 1024 is not acceptable IMO.

General theory:
You allow the input and watch your services and output,
that's the better rule than blocking ports that no
services are running on.
A decent stateful outbound chain makes sure
that conversations between client and server are
monitored and logged so aberrancies are noticed in
case of some backdoor or security breach.