On Thursday 11 November 2004 22:37, Kaj Haulrich wrote: > On Thursday 11 November 2004 23:10, Derek Jennings wrote: > > <large snip> > > > If you go to http://scan.sygatetech.com/ you can check which > > other ports are open. > > </large snip> > > Derek, on a related note : when doing so from my box - which isn't a > server - the scan invariably warns me that my ports 80 (http) and > port 113 (ident) are closed, but not blocked. In shorewall I've > disabled all services. The same result shows when trying > http://www.grc.com > > Question : how to block ports in shorewall and what is the downside > of blocking those ports ? > > TIA > Kaj Haulrich.
It is likely that your ISP is blocking those ports and giving the 'closed' response before the packet gets as far as your computer. ISPs do that when they do not want their clients running web servers. It is also possible for these online test sites to get totally confused about which IP address you originate from and test the wrong device. So do not get too alarmed. As for how to block ports in shorewall: Shorewalls default behaviour is to drop all packets from the internet. You have to make a conscious decision to allow packets through. The Mandrake Control Centre GUI is pretty useless at configuring shorewall. There is a webmin module which is very good, but personally I edit the files by hand. The main file is /etc/shorewall/rules . The text files are full of example configurations and are real easy to understand. BTW: The big mistake people often make with shorewall is to forget that shorewall assumes it could be attacked by someone on the local network as well as from the internet. Shorewalls default behaviour is to block packets from the local network to the firewall server (while letting packets through from the local network to the internet) So if you want to run a service such as Samba or CUPS on the same computer which is running the firewall, then you must open up Samba or CUPS to the local network, and NOT to the internet as the original poster seems to have done. This is where the Mandrake GUI falls down badly. It is unable to select to which interface a service is opened to. derek -- www.jennings.homelinux.net http://twiki.mdklinuxfaq.org
____________________________________________________ Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com Join the Club : http://www.mandrakeclub.com ____________________________________________________
