Re: Icons Freeze on debian, connected online.

[/dev/rob0 <rob0@gmx.co.uk>]

Sachin wrote:
> I am new to IPTABLES and recently put my debian sarge online with
> firestarter as the firewall. As soon as i connect the desktop icons
> are inaccesible and freeze as if SLEEP mode is activated. 

"Firestarter" tells me nothing. Is there a firestarter help forum? Try 
asking there.

There's probably something dreadfully wrong in your iptables rules. I 
would have to see them (hint: iptables-save(8)) to know what it is, 
although I do have a theory.

>   If i am logging to virtual terminal lot of output starts on the
> screen and it seems somebody is scanning me.

Why do you think that somebody is scanning you?

> As i am a newbie i am not able to decrypt whats
> goin on the background.

And this is precisely why you should not jump to conclusions about being 
scanned or attacked. Newbie paranoia is not good. When you see something 
you don't understand, think, "Here is something I don't understand," not 
"Oh no! Something terrible is happening!!" Then look it up and find out 
what it is.

> I am posting the output of the dmesg which also flows
> down on the virtual terminal when i login. Is there a way to stop it.

My theory: rampant LOG rules. Delete all LOG rules. Only use LOG for 
specific purposes, and generally in conjunction with -m limit.

> I assume the icons freeze because of this and so i cannot browse the
> local file system once online.

It is quite reasonable to think that LOG rules could bring a system to a 
crawl.

> Snip --
> 
> IN=ppp0 OUT= MAC= SRC=83.88.20.210 DST=220.226.22.163 LEN=168 TOS=0x00
> PREC=0x00 TTL=242 ID=30185 PROTO=ICMP TYPE=11 CODE=0

Now, let's work on understanding these. IN= gives the name of the 
incoming interface, if appropriate. OUT=, outgoing. SRC=, the source IP, 
DST=, destination. After that you'll usually be most interested in PROTO 
and in this case being ICMP, it's a type 11.

http://www.faqs.org/docs/iptables/icmptypes.html

> [SRC=220.226.22.163 DST=158.36.2.10 LEN=40 TOS=0x00 PREC=0x00 TTL=5
> ID=36362 PROTO=UDP SPT=36179 DPT=33617 LEN=20 ]

Here's the UDP packet that generated the ICMP one. SPT=, source port, 
DPT=, destination port. (Those also apply to PROTO=TCP.) I'd have to 
look it up to be sure, but I think that might be a traceroute.

You are getting a lot of ICMP 11's. Here's a type 3:

> IN=ppp0 OUT= MAC= SRC=163.13.240.201 DST=220.226.22.163 LEN=56
> TOS=0x00 PREC=0x00 TTL=54 ID=15028 PROTO=ICMP TYPE=3 CODE=3
> [SRC=220.226.22.163 DST=163.13.240.201 LEN=40 TOS=0x00 PREC=0x00 TTL=1
> ID=36391 PROTO=UDP SPT=36179 DPT=33646 LEN=20 ]

And here's a TCP SYN packet:

> IN=ppp0 OUT= MAC= SRC=220.226.36.161 DST=220.226.22.163 LEN=48
> TOS=0x00 PREC=0x00 TTL=123 ID=7263 DF PROTO=TCP SPT=2260 DPT=1433
> WINDOW=16384 RES=0x00 SYN URGP=0

I bet if you delete your LOG rules all will be well. Why would you want 
to have logs you cannot interpret?

Again, and I've said this on this list before, I rarely use LOG. When I 
am looking for something in particular I turn them on. I don't care 
about logging what I've dropped, in most cases. Why bother?

(Yes, yes, I know that there might be cases in which it's worth the 
bother. In those cases you'd have some kind of monitoring software, though.)
-- 
     mail to this address is discarded unless "/dev/rob0"
     or "not-spam" is in Subject: header