Fórum Ubuntu CZ/SK
Ostatní => Archiv => Téma založeno: tchimo 14 Ledna 2007, 18:35:38
-
Ak nastavím vo Firehole "client all accept", tak sa cez Linuxdc pripojím normálne na huby. Ale keď skúšam povoliť len "client dcpp accept", potom sa nespojím so žiadnym hubom. Služby dcc aj dcpp majú definované client-porty ako default. Keď definujem novú službu s nejakými client-portami tak, my firehol vyhodí chybu:
root@fero:/etc/firehol# firehol restart
--------------------------------------------------------------------------------
ERROR : # 1.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A out_internet_linuxdc_c13 -p tcp --sport tcp/27448 --dport 27448 -m state --state NEW\,ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid TCP port/service `tcp/27448' specified
Try `iptables -h' or 'iptables --help' for more information.
Kde robím chybu?
--------------------------------------------------------------------------------
ERROR : # 2.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A in_internet_linuxdc_c13 -p tcp --sport 27448 --dport tcp/27448 -m state --state ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid TCP port/service `tcp/27448' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 3.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A out_internet_linuxdc_c13 -p tcp --sport udp/15061 --dport 27448 -m state --state NEW\,ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid TCP port/service `udp/15061' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 4.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A in_internet_linuxdc_c13 -p tcp --sport 27448 --dport udp/15061 -m state --state ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid TCP port/service `udp/15061' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 5.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A out_internet_linuxdc_c13 -p udp --sport tcp/27448 --dport 15061 -m state --state NEW\,ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid UDP port/service `tcp/27448' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 6.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A in_internet_linuxdc_c13 -p udp --sport 15061 --dport tcp/27448 -m state --state ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid UDP port/service `tcp/27448' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 7.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A out_internet_linuxdc_c13 -p udp --sport udp/15061 --dport 15061 -m state --state NEW\,ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid UDP port/service `udp/15061' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 8.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A in_internet_linuxdc_c13 -p udp --sport 15061 --dport udp/15061 -m state --state ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid UDP port/service `udp/15061' specified
Try `iptables -h' or 'iptables --help' for more information.
Stopped: Couldn't activate new firewall.
FireHOL: Restoring old firewall: OK
-
...Kde robím chybu?...
Vzhledem k tomu, ze jste neposlal konfiguracni soubor FireHOLu, tak tezko rict.
-
Až teraz som sa dostal k PC. Konfigurácia fireholu je:
# $Id: client-all.conf,v 1.2 2002/12/31 15:44:34 ktsaou Exp $
#
# This configuration file will allow all requests originating from the
# local machine to be send through all network interfaces.
#
# No requests are allowed to come from the network. The host will be
# completely stealthed! It will not respond to anything, and it will
# not be pingable, although it will be able to originate anything
# (even pings to other hosts).
#
version 5
# Accept all client traffic on any interface
# interface any world
# client all accept
# DEFAULT_CLIENT_PORTS="1024:65535"
server_icq_ports="tcp/5190"
client_icq_ports="default"
server_linuxdc_ports="tcp/27448 udp/15061"
client_linuxdc_ports="tcp/20000 udp/20000"
interface ppp0 internet src not "${UNROUTABLE_IPS}"
policy drop
protection strong 10/sec 10
server ident reject with tcp-reset
client dhcp accept
client dns accept
client http accept
client https accept
client ftp accept
client ntp accept
client ssh accept
client pop3 accept
client icq accept
client cups accept
client smtp accept
client linuxdc accept
UNMATCHED_INPUT_POLICY="DROP"
UNMATCHED_OUTPUT_POLICY="DROP"
FIREHOL_LOG_LEVEL=1
Zaujíma ma odkiaľ bere firehol čísla povolených portov, keď je definovaná nová služba s client-portom "default". Je to odtiaľto: DEFAULT_CLIENT_PORTS="1024:65535"? Alebo ak to je okomentované tak, z premennej "net.ipv4.ip_local_port_range"? Skúšal som aj "client_linuxdc_ports="any"", ale ani to nepomohlo.
-
Ano, rozsah portu pro klientske aplikace se nacita z promenne DEFAULT_CLIENT_PORTS. Pri pokusu o pripojeni k hubu si v terminalu otevrte log jadra a sledujte, co se blokuje:
tail -f /var/log/kern.log
-
A keď nie je definovaná v konfiguráku premenná DEFAULT_CLIENT_PORTS tak, potom odkiaľ bere rozsah portov?
Ten výpis z kern.log je (xx.xx.xx.xx je moja IP adresa):
Pred pripojením na HUB:
Jan 16 18:56:48 fero kernel: [17188646.684000] ''IN-internet':'IN=ppp0 OUT= MAC= SRC=63.76.25.100 DST=xx.xx.xx.xx LEN=48 TOS=0x10 PREC=0x60 TTL=115 ID=18502 DF PROTO=TCP SPT=12369 DPT=445 WINDOW=64240 RES=0x00 SYN URGP=0
Jan 16 18:56:48 fero kernel: [17188647.152000] ''IN-internet':'IN=ppp0 OUT= MAC= SRC=71.96.14.88 DST=xx.xx.xx.xx LEN=51 TOS=0x00 PREC=0x00 TTL=120 ID=19799 PROTO=UDP SPT=50053 DPT=39498 LEN=31
Jan 16 18:56:49 fero kernel: [17188648.368000] ''IN-internet':'IN=ppp0 OUT= MAC= SRC=71.96.14.88 DST=xx.xx.xx.xx LEN=51 TOS=0x00 PREC=0x00 TTL=120 ID=19828 PROTO=UDP SPT=50053 DPT=39498 LEN=31
A počas pripájania na HUB:
Jan 16 18:57:24 fero kernel: [17188682.824000] ''IN-internet':'IN=ppp0 OUT= MAC= SRC=172.182.106.52 DST=xx.xx.xx.xx LEN=51 TOS=0x00 PREC=0x00 TTL=116 ID=55204 PROTO=UDP SPT=62197 DPT=39498 LEN=31
Jan 16 18:57:25 fero kernel: [17188683.728000] ''IN-internet':'IN=ppp0 OUT= MAC= SRC=172.182.106.52 DST=xx.xx.xx.xx LEN=51 TOS=0x00 PREC=0x00 TTL=116 ID=55236 PROTO=UDP SPT=62197 DPT=39498 LEN=31
Jan 16 18:57:26 fero kernel: [17188684.908000] ''IN-internet':'IN=ppp0 OUT= MAC= SRC=66.83.59.174 DST=xx.xx.xx.xx LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=16672 DF PROTO=TCP SPT=1861 DPT=445 WINDOW=16384 RES=0x00 SYN URGP=0
Jan 16 18:57:31 fero kernel: [17188689.608000] ''IN-internet':'IN=ppp0 OUT= MAC= SRC=66.98.18.154 DST=xx.xx.xx.xx LEN=51 TOS=0x00 PREC=0x00 TTL=114 ID=35726 PROTO=UDP SPT=6348 DPT=39498 LEN=31
Jan 16 18:57:31 fero kernel: [17188689.620000] ''IN-internet':'IN=ppp0 OUT= MAC= SRC=84.47.10.194 DST=84xx.xx.xx.xx LEN=60 TOS=0x00 PREC=0x00 TTL=125 ID=36129 DF PROTO=TCP SPT=4514 DPT=135 WINDOW=32768 RES=0x00 SYN URGP=1026
Väčšina hlášok je na protokole UDP a cieľový port 39498. Lenže ako viem koho je to komunikácia?
-
Ešte niečo. Keď dám client_linuxdc_ports="any" nemalo by blokovať žiadny port, ak tomu dobre rozumiem. Ináč v LinuxDC mám nastavené porty TCP 20000 a UDP 20000 pri active spojení do DC.
-
Ešte niečo. Keď dám client_linuxdc_ports="any" nemalo by blokovať žiadny port, ak tomu dobre rozumiem. Ináč v LinuxDC mám nastavené porty TCP 20000 a UDP 20000 pri active spojení do DC.
Tim v podstate uplne vyradite Firewall z provozu (ve smeru od vas ven).
-
Takže dal som client_linuxdc_ports="any", ale ani tak som sa nepripojil. Znamená to že treba definovať nejaké konkrétne porty pre aplikáciu typu server?
A keď nie je definovaná v konfiguráku premenná DEFAULT_CLIENT_PORTS tak, potom odkiaľ bere rozsah portov? Je to zo systémovej premennej "net.ipv4.ip_local_port_range"?
-
Ta promenna v konfiguracnim souboru je proto, abyste ji pouzil. Chovani FireHOLu v pripade nedefinovane hodnoty tento promenne neni v dokumentaci popsano.
Presne chovani LinuxDC a pozadovane porty pro spojeni zkuste zjistit v dokumentaci nebo od jeho autoru. Tento program bohuzel neznam a nepouzivam, takze vam neumim presne odpovedet. Muzu vam poradit jen obecny postup definovani novych sluzeb do FireHOLu.
-
Skúšal som rôzne nastavenia a zistil som, že funguje to pri takto definovanej službe:
server_linuxdc_ports="tcp/500:10000 udp/500:10000"
client_linuxdc_ports="any"
interface ppp0 internet src not "${UNROUTABLE_IPS}"
client linuxdc accept
teda okrem iného. Ale keď som client_linuxdc_ports="any" zmenil na client_linuxdc_ports="tcp/1412 udp/1412", tak firehol po reštarte mi vyhodil:
--------------------------------------------------------------------------------
ERROR : # 1.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A out_internet_linuxdc_c13 -p tcp --sport tcp/1412 --dport 500:10000 -m state --state NEW\,ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid TCP port/service `tcp/1412' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 2.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A in_internet_linuxdc_c13 -p tcp --sport 500:10000 --dport tcp/1412 -m state --state ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid TCP port/service `tcp/1412' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 3.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A out_internet_linuxdc_c13 -p tcp --sport udp/1412 --dport 500:10000 -m state --state NEW\,ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid TCP port/service `udp/1412' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 4.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A in_internet_linuxdc_c13 -p tcp --sport 500:10000 --dport udp/1412 -m state --state ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid TCP port/service `udp/1412' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 5.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A out_internet_linuxdc_c13 -p udp --sport tcp/1412 --dport 500:10000 -m state --state NEW\,ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid UDP port/service `tcp/1412' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 6.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A in_internet_linuxdc_c13 -p udp --sport 500:10000 --dport tcp/1412 -m state --state ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid UDP port/service `tcp/1412' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 7.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A out_internet_linuxdc_c13 -p udp --sport udp/1412 --dport 500:10000 -m state --state NEW\,ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid UDP port/service `udp/1412' specified
Try `iptables -h' or 'iptables --help' for more information.
--------------------------------------------------------------------------------
ERROR : # 8.
WHAT : A runtime command failed to execute (returned error 2).
SOURCE : line INIT of /etc/firehol/firehol.conf
COMMAND : /sbin/iptables -t filter -A in_internet_linuxdc_c13 -p udp --sport 500:10000 --dport udp/1412 -m state --state ESTABLISHED -j ACCEPT
OUTPUT :
iptables v1.3.5: invalid UDP port/service `udp/1412' specified
Try `iptables -h' or 'iptables --help' for more information.
Stopped: Couldn't activate new firewall.
FireHOL: Restoring old firewall: OK
Neviete čo s tým?
-
client_linuxdc_ports="tcp/1412 udp/1412"je nesmysl. Viz. http://firehol.sourceforge.net/adding.html
nastavenim server_linuxdc_ports="tcp/500:10000 udp/500:10000"otevrete vsem aplikacim vsechny porty 500-10000
-
Takže môžem dať len any alebo default? A keď dám default tak zoberie z premennej DEFAULT_CLIENT_PORTS=. A táto premenná je spoločná pre všetky služby? Asi na tejto úrovni sa nedá povoliť porty len pre určitú aplikáciu. Na stránke DC++ "http://dcpp.net/faq/index.php?action=artikel&cat=7&id=1&artlang=en" som našiel nasledovné: "Active mode requires both TCP and UDP access on the same port incoming and all ports outgoing for DC++ to work properly." Má to znamenať pre firehol client port=any a server port same? Len ešte zistiť, ktoré sú to tie same. Teraz skúšam pochopiť nastavenie firewallov pre Win tu: "http://dcpp.net/faq/index.php?action=show&cat=8".
-
Klientske porty muzete nastavit, ale bez udani protokolu. Projdete si http://firehol.sourceforge.net/adding.html
-
No dobre. Ako vlastne nastaviť Firehol? Predpokladám, že keď treba "all ports outgoing for DC++ to work properly", tak musí byť client_linuxdc_ports="any". A čo so server_linuxdc_ports= aby firewall mal zmysel? Alebo treba ešte nejako definovať prístup na službu linuxdc len pre aplikáciu LinuxDC?
-
Pokud nejaka aplikace potrebuje pro svuj provoz otevrit komplet vsechny porty, je to pr*s*rn*. Pro informace o povoleni provozu jen konkretni aplikaci Hledejte (http://forum.ubuntu.cz/search.php) zde ve foru vyraz shaping.
-
Skúsil som ešte povoliť client all accept, pritom nebola povolená žiadna server_service a vtedy P2P fungoval. Ale keď som dal:
DEFAULT_CLIENT_PORTS="0:65535"
server_linuxdc_ports="tcp/615 udp/615"
client_linuxdc_ports="default"
client linuxdc accept
tak nešli ani www stránky. Myslel som, že som otvoril všetky porty. Ako to vlastne je?
-
Osobne doporucuju ve fireholu nastavit
client all accept
Vzhledem k tomu, ze neni mozne zakazovat/povolovat pripojeni konkretnim programum, tak IMHO tohle omezovat trosku ztraci smysl.
Tim ti pojede DC v pasivnim modu.
Abys mohl byt aktivni, nadefinuj si v DC porty a ty pak povol.
Ja mam v configu napr
# LinuxDC++
server_linuxdc_ports="tcp/27448 udp/15061"
client_linuxdc_ports="default"
server linuxdc accept
-
Ešte by ma zaujímalo ako nastaviť premennú "DEFAULT_CLIENT_PORTS=" a aké porty nastaviť v LinuxDC pre active TCP/UDP. Predpokladám, že active porty musia byť detto ako "server_linuxdc_ports=".
-
Psal jsem "nadefinuj si v DC porty a ty pak povol" = nadefinuj si nejake porty v DC a ty stejne pak povol ve firewallu :) Kdyz ty porty nebudou stejny v DC a ve firewallu, tak to samozrejme fungovat nebude
-
To znamená - to čo je v DC je aj v server portoch. A čo mám mať v premennej "DEFAULT_CLIENT_PORTS="? Už som vyskúšal toľko nastavení, že ani neviem, čo má kde byť. Teraz tam mám 0:65535 a to je vlastne celý rozsah.
-
O default_client_ports si prectes na oficialni strance http://firehol.sourceforge.net/ kam byses mel kouknout automaticky
konkretne treba http://firehol.sourceforge.net/commands.html?
-
Ďakujem Vám za pomoc. Zistil som že, musia byť definované aj porty, na ktorých komunikujú HUB-y, nielen tie čo sú v LinuxDC. Potom nemusím povolovať všetky služby (client all accept), ale len tie čo naozaj potrebujem. Takže stačí pridať:
# LinuxDC++
server_linuxdc_ports="tcp/225 tcp/411 tcp/412 tcp/413 tcp/415 tcp/422 tcp/444 tcp/555 tcp/666 tcp/901 tcp/999 tcp/1111 tcp/1128 tcp/1234 tcp/2345 tcp/4111 tcp/4112 tcp/4114 tcp/4242 tcp/4411 tcp/4444 tcp/5565 tcp/6666 tcp/8888 tcp/27448 tcp/65353 udp/15061"
client_linuxdc_ports="default"
server linuxdc accept
client linuxdc accept
-
IMHO v tom mas trosku gulas :)
-
Je to možné, ale ani z tvojej odpovede nie som múdrejší.