Hello, I would like to be able to have a machine with that allows remote connections through SSH. It should also accept traffic through 15 UDP ports. The SSH and 15 UPD ports traffic should be limited to two subnets: in the example below, they are 12.203.150.0/24 and 12.203.162.0/26. All other traffic should be rejected. The machine will not act as a router, I just want to use SuSEfirewall2 as a personal firewall. I only has one network card. Will the configuration file below satisfy the requirements I've stated? I suspect I'm allowing anybody to connect suing ssh by setting FW_SERVICES_EXT_TCP, is that correct? I'd appreciate any suggestion. Rafael -------------------------- FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh" FW_SERVICES_EXT_UDP="40001:40015" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="12.203.150.0/24 12.203.162.0/26" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="" # Beware to use this! FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV=""
On Fri, Oct 03, 2003 at 08:59:46PM -0400, Rafael E. Herrera wrote:
Hello,
I would like to be able to have a machine with that allows remote connections through SSH. It should also accept traffic through 15 UDP ports.
The SSH and 15 UPD ports traffic should be limited to two subnets: in the example below, they are 12.203.150.0/24 and 12.203.162.0/26. All other traffic should be rejected.
The machine will not act as a router, I just want to use SuSEfirewall2 as a personal firewall. I only has one network card.
Will the configuration file below satisfy the requirements I've stated?
I suspect I'm allowing anybody to connect suing ssh by setting FW_SERVICES_EXT_TCP, is that correct?
Yes, you are right. You have to use FW_TRUSTED_NETS if you want to allow access from those nets only.
I'd appreciate any suggestion.
Rafael
-------------------------- FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh"
FW_SERVICES_EXT_TCP=""
FW_SERVICES_EXT_UDP="40001:40015"
FW_SERVICES_EXT_UDP=""
FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="12.203.150.0/24 12.203.162.0/26"
FW_TRUSTED_NETS="12.203.150.0/24,tcp,ssh 12.203.162.0/26,tcp,ssh 12.203.150.0/24,udp,40001:40015 12.203.162.0/26,udp,40001:40015" Regards, -Kastus
Hello again, In a followup to my previous email, after allowing access to UPD port 39001, I got this in my system log: Oct 5 10:36:29 linux kernel: SuSE-FW-ILLEGAL-TARGET IN=eth0 OUT= MAC=00:c0:a8:89:46:79:00:04:23:0c:ab:22:08:00 SRC=12.203.150.231 DST=12.203.150.232 LEN=144 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=39001 DPT=39001 LEN=124 Wuold any body care to explain what this means? Thanks. -- Rafael
participants (2)
-
Kastus -
Rafael E. Herrera