open ports

open ports

[azeem ahmad]

hi all
i have a LAN environment. users from LAN connect to internet via my linux 
box. on this box iptables firewall runs. what ports should i open to allow 
users to get all the services like all chat rooms and yahoo, msn messengers 
and browsing http/ftp etc

Regards
Azeem

_________________________________________________________________
Protect your PC - get McAfee.com VirusScan Online 
http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

Re: open ports

[Antony Stone]

On Sunday 16 May 2004 10:22 am, azeem ahmad wrote:

> hi all
> i have a LAN environment. users from LAN connect to internet via my linux
> box. on this box iptables firewall runs. what ports should i open to allow
> users to get all the services like all chat rooms and yahoo, msn messengers
> and browsing http/ftp etc

1. Start with the following ruleset

iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -j LOG

2. Get one of your LAN machines to attempt a connection to something you want 
to be allowed (eg: web borwsing).

3. Look at the LOG entries to see what packets tried to get through the 
firewall (just before DROPped by the default policy).

4. Add a rule, between the two rules given above, to allow that type of 
traffic (eg: for web browsing:
iptables -I 2 FORWARD -i $intIF -p tcp --dport 80 -j ACCEPT)

5. Read one of the networking tutorials from http://www.netfilter.org to get a 
better understanding of what network protocols should always be allowed (eg: 
both types of DNS), and how to find out what port numbers etc are used by the 
services you want to allow through the system.

Regards,

Antony.

-- 
If you can't find an Open Source solution for it, then it isn't a real 
problem.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: open ports

[azeem ahmad]

i m also doing so but there is the problem of some programs that some times 
use dynamic ports like msn messenger uses dynamic ports for file transfer 
through it (i think so if it is wrong then tell me please) ad where the log 
will go and can i specify any file instead of the one default

Regards
Azeem


>From: Antony Stone <Antony@Soft-Solutions.co.uk>
>Reply-To: netfilter@lists.netfilter.org
>To: netfilter@lists.netfilter.org
>Subject: Re: open ports
>Date: Sun, 16 May 2004 10:43:06 +0100
>
>On Sunday 16 May 2004 10:22 am, azeem ahmad wrote:
>
> > hi all
> > i have a LAN environment. users from LAN connect to internet via my 
>linux
> > box. on this box iptables firewall runs. what ports should i open to 
>allow
> > users to get all the services like all chat rooms and yahoo, msn 
>messengers
> > and browsing http/ftp etc
>
>1. Start with the following ruleset
>
>iptables -P FORWARD DROP
>iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
>iptables -A FORWARD -j LOG
>
>2. Get one of your LAN machines to attempt a connection to something you 
>want
>to be allowed (eg: web borwsing).
>
>3. Look at the LOG entries to see what packets tried to get through the
>firewall (just before DROPped by the default policy).
>
>4. Add a rule, between the two rules given above, to allow that type of
>traffic (eg: for web browsing:
>iptables -I 2 FORWARD -i $intIF -p tcp --dport 80 -j ACCEPT)
>
>5. Read one of the networking tutorials from http://www.netfilter.org to 
>get a
>better understanding of what network protocols should always be allowed 
>(eg:
>both types of DNS), and how to find out what port numbers etc are used by 
>the
>services you want to allow through the system.
>
>Regards,
>
>Antony.
>
>--
>If you can't find an Open Source solution for it, then it isn't a real
>problem.
>
>                                                      Please reply to the 
>list;
>                                                            please don't CC 
>me.
>
>

_________________________________________________________________
The new MSN 8: advanced junk mail protection and 2 months FREE* 
http://join.msn.com/?page=features/junkmail

RE: open ports

[Rob Sterenborg]

> i m also doing so but there is the problem of some programs 
> that some times use dynamic ports like msn messenger uses 
> dynamic ports for file transfer through it (i think so if it 
> is wrong then tell me please) ad where the log will go and 
> can i specify any file instead of the one default

AFAIK MSN likes to connect to port 1863/tcp by default (it does here) and if
that failes it will try to connect to some servers on port 80/tcp.
So, if you ACCEPT connections for both ports 80/tcp and 1863/tcp you should
be fine. Although some MSN functions like file-transfer might not work.


Gr,
Rob

Re: open ports

[Alistair Tonner]

On May 16, 2004 05:52 am, azeem ahmad wrote:
> i m also doing so but there is the problem of some programs that some times
> use dynamic ports like msn messenger uses dynamic ports for file transfer
> through it (i think so if it is wrong then tell me please) ad where the log
> will go and can i specify any file instead of the one default
>
> Regards
> Azeem
>

	Your logging is managed by your syslog daemon -- syslog.conf will tell you 
where the log data are written.  The default syslog daemon will not allow 
*too* much granularity on this front, but can be managed.  I've since 
switched to syslog-ng which is more detail oriented, but takes a *lot* more 
reading to manage.

	*with much snippage for brevity*

	Alistair Tonner

RE: open ports

[azeem ahmad]

but its not the soulution to just leave the programs that have dynamic 
ports. there must be a solution for them in netfilter

Regards
Azeem


>From: "Rob Sterenborg" <rob@sterenborg.info>
>To: <netfilter@lists.netfilter.org>
>Subject: RE: open ports
>Date: Sun, 16 May 2004 12:03:47 +0200
>
> > i m also doing so but there is the problem of some programs
> > that some times use dynamic ports like msn messenger uses
> > dynamic ports for file transfer through it (i think so if it
> > is wrong then tell me please) ad where the log will go and
> > can i specify any file instead of the one default
>
>AFAIK MSN likes to connect to port 1863/tcp by default (it does here) and 
>if
>that failes it will try to connect to some servers on port 80/tcp.
>So, if you ACCEPT connections for both ports 80/tcp and 1863/tcp you should
>be fine. Although some MSN functions like file-transfer might not work.
>
>
>Gr,
>Rob
>
>

_________________________________________________________________
MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*. 
http://join.msn.com/?page=features/virus

Re: open ports

[David Cannings]

From: "azeem ahmad" <azeem484@hotmail.com>
> but its not the soulution to just leave the programs that have dynamic
> ports. there must be a solution for them in netfilter

If you are very worried and have a large network, set up a SOCKS proxy.  I
believe the Windows MSN client also supports HTTP proxying but I've never
tried.  On a smaller scale, it is fairly safe to allow the whole range of
outgoing ports to be ACCEPTed in your OUTPUT chain, such as allowing out
2000-3000. You would have to find out the exact range it uses.  A rule
allowing ESTABLISHED or RELATED in your INPUT chain will handle the replies.

Unless you're going to use UPnP to open and close ports as needed it isn't
easy to get programs like MSN that use lots of ports to work fully behind a
firewall or NAT.  There is a UPnP daemon for Linux and a good article at:
http://www.ruwebit.net/article/77.

David