Redhat 7.1 firewall 2

[axman505]

I think the firewall is blocking me from accessing SWAT. How do i allow swat to pass through the firewall

 

[marsd]

ACCEPT traffic for port 901.

 

[ifincham]

Hi,

Its probably xinetd actually. Swat is one of those ip services launched on demand by xinetd. The config file /etc/xinetd.d/swat is installed when you install the samba rpm but the service is disabled by default. (This also applies to telnet-server, wu-ftpd, etc.)

So, edit /etc/xinetd.d/swat and change 'disable=yes' to 'disable=no'. Then restart xinetd with '/etc/rc.d/init.d/xinetd restart' or '/sbin/service xinetd restart'.

Then connect with browser as

http://localhost:901

and it should work.

Rgds.

 

[axman505]

Everythign is all installed and enabled .. i just dont know how to let it throught the firewall

 

[axman505]

I can load swat withing linux, but it is not getting through the firwall. So i just need to know how to allowport 901 to get through the firewall

 

[ifincham]

Hi,

OK.. If you are using the redhat firewall its still ipchains based even for version 7.1 . So you'd add some ipchains commands to your firewall script like these ...

ipchains -A input -p tcp -d any/0 901 -j ACCEPT

ipchains -A output -p tcp ! -y -s any/0 901 -d any/0 1024:65535 -j ACCEPT

This assumes that swat is running on the same box as the firewall.

Regards..

 

[axman505]

Is there anything special i need to do to add those to the firewall config, or just type them in and hit enter?

 

[axman505]

It added, but im still not getting anything.

 

[axman505]

THis is what is says:

ACCEPT tcp ------ anywhere anywhere any -> swat
Chain forward (policy ACCEPT):
Chain output (policy ACCEPT):
target prot opt source destination ports
ACCEPT tcp -y---- anywhere anywhere swat -> 1024:65535

 

[ifincham]

Hi,

I assumed that the connection to port 901 was from an unprivileged client port. Maybe that's not the case. Try again with exactly the same commands but completely remove the '1024:65535'. I.e. :

ipchains -A input -p tcp -d any/0 901 -j ACCEPT
ipchains -A output -p tcp ! -y -s any/0 901 -d any/0 -j ACCEPT

Also, where are you trying to use swat from, where is the firewall, and where would the swat server be running ? Is this 3 different machines, 2 , or just one with everything ?

Rgds

 

[johnhoke]

The problem is *probally* NOT with the firewall, but rather with xinetd

/etc/xinetd.d/swat

has a line that only allows from 127.0.0.1

Remove that line
then /etc/init.d/xinetd restart

-John ---
John Hoke

 

[axman505]

The only from line is not in the swat config file, that is one of the first things i tried.

I have a home network running and the linux box the dmz host of the router, and i need me computer to be able to load swat within the lan.

I tried entereing that stuff with the 1024:65535 and it still didnt work. DO i have to save the changes to the ipchains beofre it will work, because i noticed that when i reboot linux those entrys diapper.

 

[ifincham]

Hi,





I've been using iptables for some time and have never used the RH firewall, but I believe it creates all the config files in /etc/sysconfig. I think there's a file /etc/sysconfig/ipchains and also files for each interface. For example, /etc/sysconfig/firewall.ifcfg-lo for the loopback interface. I suspect they are triggered via the sysv init system rather than from the actual /etc/rc.d/rc.sysinit boot-up script.





So, you could just try to configure the RH firewall using either 'lokkit' or 'gnome-lokkit' as commands for the latest one or 'firewall-config' for the one before that. If it doesn't make sense then you could either try to add some rules to the files used by the firewall (i.e. the /etc/sysconfig ones referred to above) or add them to a script of your own.





Easiest would be to add to commands to /etc/rc.d/rc.local . This iscript is designed for local customisation and is run right at the end of the boot process before you get the logon prompt. You'd just add the lines as shown before :





ipchains -A input -p tcp -d any/0 901 -j ACCEPT


ipchains -A forward -p tcp -d any/0 901 -j ACCEPT


ipchains -A output -p tcp ! -y -s any/0 901 -d any/0 -j ACCEPT





I've added a 'forward' rule there because I'm still not sure what's where in your setup.

And, yes, they do have to be in a file because they are not magically remembered as such - in fact all firewall scripts start by flushing existing chains anyway. Your only problem might be if the firewall scripts somehow ran again after normal sysinit then your rules in rc.local might be flushed away !



Hope this is clearer....

 

[axman505]

THis is what i got when i tried to add the forward one:

[root@mmax sysconfig]# ipchains -A forward -p tcp -d any/0 901 -j ACCEPT
Warning: you must enable IP forwarding for packets to be forwarded at all:
Use `echo 1 > /proc/sys/net/ipv4/ip_forward'

 

[ifincham]

Hi,



Yes, you do indeed require to do that command - it just puts a value of '1' (yes) into the 'file' in the /proc filesystem.


Normally, you would have that line in your firewall script. Or you can just type it from the command line :



echo 1 > /proc/sys/net/ipv4/ip_forward



There are some similar settings that can be used for firewalling but I won't bore you with them now...



Regards

 

[axman505]

Thanks a million. You dont know how helpful you have been. I ran lokkit and just configered it to add port 901 and it all worked. Thanks again!!