SliTaz Forum

TraceE

Member

Registered: 2014-02-02

Posts: 112

Re: Simple iptables config for Transmission?

Ok after a few days trying out the latest core cooking flavors (which just didn't work at all with my Aspire 7520 dual core (TK-55), 4Gb ram.

I am back with the 2012 stable core flavor release.

I did a fresh install and had a problem for a while with iptables -L ..... reporting that iptables couldn't be found.... seems to be sorted now after uninstalling and reinstalling with ...... # tazpkg -gi iptables --forced

Before I try anything further here are my firewall.conf file and what iptables -L reports:

# /etc/firewall.conf: SliTaz firewall configuration.

# Config file used by: /etc/init.d/firewall.sh

#

# Network interface.

INTERFACE="wlan0"

# Enable/disable kernel security.

KERNEL_SECURITY="yes"

# Enable/disable iptables rules (iptables package must be installed).

IPTABLES_RULES="yes"

# Netfilter/iptables rules.

# This shell function is included in /etc/init.d/firewall.sh

# to start iptables rules.

#

iptables_rules()

{

# Drop all input connections.

iptables -P INPUT DROP

# Drop all output connections.

iptables -P OUTPUT DROP

# Drop all forward connections.

iptables -P FORWARD DROP

# Accept input on localhost (127.0.0.1).

iptables -A INPUT -i lo -j ACCEPT

# Accept input on the local network (192.168.0.0/24).

iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT

# Accept near all output trafic.

iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# Accept input trafic only for connections initialized by user.

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# If you manage a HTTP/SSH/FTP/IRC server you can accept input for non-established connections an some ports.

# else you can disable the lines below for more secured setup

# Accept input on port 80 for the HTTP server.

iptables -A INPUT -i $INTERFACE -p tcp --source-port 80 -j ACCEPT

# Accept input on port 22 for SSH.

iptables -A INPUT -i $INTERFACE -p tcp --destination-port 22 -j ACCEPT

# Accept port 21 and, 1024 to 60310 for FTP.

iptables -A INPUT -i $INTERFACE -p tcp --destination-port 21 -j ACCEPT

iptables -A INPUT -i $INTERFACE -p tcp --destination-port 1024:60310 -j ACCEPT

# Accept port 6667 for IRC chat.

iptables -A INPUT -i $INTERFACE -p tcp --source-port 6667 -j ACCEPT

# Accept unprivileged ports.

iptables -A INPUT -i $INTERFACE -p udp --destination-port 1024:65535 -j ACCEPT

# Accept ping.

iptables -A INPUT -i $INTERFACE -p icmp -j ACCEPT

}

And here is the output from iptables -L:

root@slitaz:/home/tux# iptables -L

Chain INPUT (policy ACCEPT)

target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

I've just got a funny feeling that I used to get more results from that previously?

That doesn't look correct does it?

sixofeight

Member

Registered: 2013-07-02

Posts: 234

Re: Simple iptables config for Transmission?

you need to install linux-netfilter-2.6.37.tazpkg to get the Firewall working.

TraceE

Member

Registered: 2014-02-02

Posts: 112

Re: Simple iptables config for Transmission?

Aha! ..... got it now ..... I just forgot to /etc/init.d/firewall stop .... and start.

Here are the proper results from # iptables -L:

root@slitaz:/home/tux# /etc/init.d/firewall start

Setting up kernel security rules...                                  [ OK ]

Setting up iptables rules defined in: /etc/firewall.conf...          [ OK ]

root@slitaz:/home/tux# iptables -L

Chain INPUT (policy DROP)

target     prot opt source               destination

ACCEPT     all  --  anywhere             anywhere

ACCEPT     all  --  192.168.0.0/24       anywhere

ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:www

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp

ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:1024:60310

ACCEPT     tcp  --  anywhere             anywhere            tcp spt:ircd

ACCEPT     udp  --  anywhere             anywhere            udp dpts:1024:65535

ACCEPT     icmp --  anywhere             anywhere           

Chain FORWARD (policy DROP)

target     prot opt source               destination         

Chain OUTPUT (policy DROP)

target     prot opt source               destination

ACCEPT     all  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED

Does that look ok before I try some of your suggestions?

gdesilva

Member

Registered: 2011-04-07

Posts: 419

Re: Simple iptables config for Transmission?

The rules themselves look OK but the question is, is this what you want to achieve? ie. do you want www, ssh, ftp,irc and leave tcp ports 1024-60310 opened?

transmission

Member

Registered: 2014-03-08

Posts: 4

Re: Simple iptables config for Transmission?

Hi TraceE,

So, how are things progressing with your firewall project?

Regards,

Jim

TraceE

Member

Registered: 2014-02-02

Posts: 112

Re: Simple iptables config for Transmission?

Been short on time ..... I'll try and get back to it this weekend ...

I've just posted these settings and results as a reference point.