Re: [Sheflug] ipchains & kde

[ross <nospam [at] virgin.net>]

On Thu, 13 Jul 2000, Martin P Holland wrote:
> >the rules i am using are:
> >ipchains -A input -p tcp ! -y -j ACCEPT
> >
> >i believe the idea is to close all ports which require a root service and only
> >allow packets with the SYN flag enabled through.
> 
> Errr no! The last rule is actually accepting any _non_ SYN packets. 
err.... yes your right ....... i read the info incorrectly ;-) (but you knew
that i guess)

> 1. You have to allow all packets on the interface lo or your computer won't be
> able to talk to itself.
> 
i have now and this seems to have resolved the problem.... thanks

> 3. The ipchains howto is actually very good. Read it.
> 
i've read it now and it's all starting to make sense (well kind of!)

> 4. Take a look at my generic firewall at www.noether.freeserve.co.uk
> 
i have and it's working a treat

On Thu, 13 Jul 2000, Alex Hudson wrote:
> I agree. To be honest, the ruleset given looks like a bit of a club hammer
> to me, and probably not worth a great deal, although it's probably better
> than no rulesset. It's much better to have a finer set of rules; besides,
> it's an exercise in networking if nothing else, you'll understand things a
> whole lot better.
> As for the problem itself.. could be one of two things. I've tried
> replicating it here, and it works fine for me, but I have a funny K setup,

> so it could be I'm doing something wildly different to me. 

how do you manage that then Al? :-)

> If you could tell
> us a little more about what you've got: distro-wise, version of K, etc.,
> that would probably be of help. Also, are you sure the X session locks up??
> Is it just kfm that goes belly up? Or does everything else close down? And
> does it really lock up, or is it in a long pause?
> 
mandrake7.0 with KDE1.1.2 (bog standard)
once i accessed 'file:/' i could not access any other x service. (even after
several minutes) i have to 'ctrl-alt-f1' and log in as root to remove the rule
set and 'ipchain -F' 'ipchain -X' via CLI to recover (quite an achievement for
me:-)

it's definitatly a steep learning curve for this kind of thing
(but i'm making progress:) i haven't identified the exact problem with the
rules but allowing full access to 'lo' seems to have resolved the problem for
now.

thanks again for the time you spent on this though.................
 -- 
     Ross
               ros.h [at] virgin.net
____________________________________________________________________________
---------------------------------------------------------------------
Sheffield Linux User's Group - http://www.sheflug.co.uk
To unsubscribe from this list send mail to
- <sheflug-request [at] vuw.ac.nz> - with the word 
 "unsubscribe" in the body of the message. 

  GNU the choice of a complete generation.