7:11 p.m.
Hi all,
When I run /sbin/system-config-services
I see that iptables is enabled, and that
/etc/sysconfig/iptables contains the rules
I want.
However, after bootup, I open a terminal and
run iptables -L -n
and do not see those rules at all, and all
the rules are in "ACCEPT" state.
I have to resort to start iptables manually
in order to install the rules I have in
/etc/sysconfig/iptables.
So, what needs to be done to force iptables to run
and to use the rules I have in the iptables file?
8:44 a.m.
On Jun 30, 2014 9:03 PM, "JD" <jd1008(a)gmail.com> wrote:
On Mon, Jun 30, 2014 at 7:04 PM, Pete Travis <lists(a)petetravis.com> wrote:
> Congrats, you've created a firewall ruleset just like the default, but
without ssh. You could have:
> `firewall-cmd --remove-service ssh --permanent `
>
> You can read about firewalld at https://fedoraproject.org/wiki/FirewallD
. If
you prefer to disable firewalld and use iptables, there are
instructions on the same page.
>
>
Well, Pete, thanks for the heads up again.
Indeed, it was the firewalld that was defaulting to a fully
open firewall.
I disabled it, and now iptables is indeed working after bootup.
Thanx again.
--
You should go back and read the iptables dump you had by default. It was
*not* fully open; you had ssh and I think mdns, every other new packet was
rejected.
Iptables can be confusing. Firewalld can be much easier to understand and
manage once you get the hang of it. You really should read that wiki page.
--Pete
6:42 a.m.
On Mon, Jun 30, 2014 at 17:21:21 -0700,
Mike Wright <mike.wright(a)mailinator.com> wrote:
ps. Could you not use html mail? I can barely read the pale gray text. Thx.
Note that the original message was a multipart/alternative message with
both text/html and text/plain versions of the same text. You may be able
to tell your client to display the text/plain version in preference to
the text/html version. That will normally make these messages more
readable. And I find that html only mail is somewhat rarer than
multipart messages, so it covers a that vast majority of non-spam that
I receive.
10:02 p.m.
On Mon, Jun 30, 2014 at 7:04 PM, Pete Travis <lists(a)petetravis.com> wrote:
Congrats, you've created a firewall ruleset just like the default, but
without ssh. You could have:
`firewall-cmd --remove-service ssh --permanent `
You can read about firewalld at https://fedoraproject.org/wiki/FirewallD
. If you prefer to disable firewalld and use iptables, there are
instructions on the same page.
Well, Pete, thanks for the heads up again.
Indeed, it was the firewalld that was defaulting to a fully
open firewall.
I disabled it, and now iptables is indeed working after bootup.
Thanx again.
7:21 p.m.
06/30/2014 05:11 PM, JD wrote:
Hi all,
When I run /sbin/system-config-services
I see that iptables is enabled, and that
/etc/sysconfig/iptables contains the rules
I want.
However, after bootup, I open a terminal and
run iptables -L -n
and do not see those rules at all, and all
the rules are in "ACCEPT" state.
I have to resort to start iptables manually
in order to install the rules I have in
/etc/sysconfig/iptables.
So, what needs to be done to force iptables to run
and to use the rules I have in the iptables file?
Hi, JD.
Is it possible that firewalld is pre-empting it?
ps. Could you not use html mail? I can barely read the pale gray text. Thx.
8:09 p.m.
New subject: Thunderbird Plugins
On 07/01/14 09:06, Chris wrote:
On 07/01/2014 02:21 AM, Mike Wright wrote:
> ps. Could you not use html mail? I can barely read the pale gray text. Thx.
Of course, it's better not to use HTML e-mail. But BTW, "Allow HTML
Temp" is a nice Thunderbird Extension, especially for this case. It's
also nice to see, who is using which MUA. That's why I've installed
"Display Mail User Agent". But that's off-topic. Sorry.
You don't need a plugin. Thunderbird has as standard feature the ability to define
"Plain Text Domains".
So, you can send html to all domains and specify fedoraproject.org as a plain text domain
an T-Bird will do the needful.
--
If you can't laugh at yourself, others will gladly oblige.
8:23 p.m.
On Mon, Jun 30, 2014 at 7:04 PM, Pete Travis <lists(a)petetravis.com> wrote:
On Jun 30, 2014 6:51 PM, "JD" <jd1008(a)gmail.com> wrote:
>
>
> On Mon, Jun 30, 2014 at 6:28 PM, Ed Greshko <ed.greshko(a)greshko.com>
wrote:
> >
> > On 07/01/14 08:11, JD wrote:
> >
> > Hi all,
> > When I run /sbin/system-config-services
> > I see that iptables is enabled, and that
> > /etc/sysconfig/iptables contains the rules
> > I want.
> >
> > However, after bootup, I open a terminal and
> > run iptables -L -n
> > and do not see those rules at all, and all
> > the rules are in "ACCEPT" state.
> >
> > I have to resort to start iptables manually
> > in order to install the rules I have in
> > /etc/sysconfig/iptables.
> >
> > So, what needs to be done to force iptables to run
> > and to use the rules I have in the iptables file?
> >
> >
> >
> >
> >
> > Directly after a reboot I would run....
> >
> > systemctl status iptables.service
> >
> > And, yeah, your emails are a bit hard to read.
> >
>
> # systemctl status iptables.service
> iptables.service - IPv4 firewall with iptables
> Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled)
> Active: inactive (dead)
>
> # iptables -L -n ....
>
> --------------------------
>
> What I have in /etc/sysconfig/iptables:
> # Firewall configuration written by system-config-firewall
> # Manual customization of this file is not recommended.
> *filter
> :INPUT
> ACCEPT[0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> -A INPUT -m state --state NEW -j DROP
> COMMIT
>
> --
>
Congrats, you've created a firewall ruleset just like the default, but
without ssh. You could have:
`firewall-cmd --remove-service ssh --permanent `
You can read about firewalld at https://fedoraproject.org/wiki/FirewallD
. If you prefer to disable firewalld and use iptables, there are
instructions on the same page.
-
I am not familiar with firewalld (yet).
But it was enbled by default, and I think that
is what was the culprit, since I had not created
any rulesets for it.
I just disabled it, and will spend some time studying
ruleset creation for it.
By the way, why would I need a rule to allow sshd?
I never ssh into my machine from other computers.
Thanks for the heads up.
8:06 p.m.
New subject: Thunderbird Plugins (was: Re: Problem with iptables)
On 07/01/2014 02:21 AM, Mike Wright wrote:
ps. Could you not use html mail? I can barely read the pale gray
text. Thx.
Of course, it's better not to use HTML e-mail. But BTW, "Allow HTML
Temp" is a nice Thunderbird Extension, especially for this case. It's
also nice to see, who is using which MUA. That's why I've installed
"Display Mail User Agent". But that's off-topic. Sorry.
--
Christian
8:04 p.m.
On Jun 30, 2014 6:51 PM, "JD" <jd1008(a)gmail.com> wrote:
On Mon, Jun 30, 2014 at 6:28 PM, Ed Greshko <ed.greshko(a)greshko.com>
wrote:
>
> On 07/01/14 08:11, JD wrote:
>
> Hi all,
> When I run /sbin/system-config-services
> I see that iptables is enabled, and that
> /etc/sysconfig/iptables contains the rules
> I want.
>
> However, after bootup, I open a terminal and
> run iptables -L -n
> and do not see those rules at all, and all
> the rules are in "ACCEPT" state.
>
> I have to resort to start iptables manually
> in order to install the rules I have in
> /etc/sysconfig/iptables.
>
> So, what needs to be done to force iptables to run
> and to use the rules I have in the iptables file?
>
>
>
>
>
> Directly after a reboot I would run....
>
> systemctl status iptables.service
>
> And, yeah, your emails are a bit hard to read.
>
# systemctl status iptables.service
iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled)
Active: inactive (dead)
# iptables -L -n ....
--------------------------
What I have in /etc/sysconfig/iptables:
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT
ACCEPT[0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -m state --state NEW -j DROP
COMMIT
--
Congrats, you've created a firewall ruleset just like the default, but
without ssh. You could have:
`firewall-cmd --remove-service ssh --permanent `
You can read about firewalld at https://fedoraproject.org/wiki/FirewallD .
If you prefer to disable firewalld and use iptables, there are instructions
on the same page.
--Pete
7:50 p.m.
On Mon, Jun 30, 2014 at 6:28 PM, Ed Greshko <ed.greshko(a)greshko.com> wrote:
On 07/01/14 08:11, JD wrote:
Hi all,
When I run /sbin/system-config-services
I see that iptables is enabled, and that
/etc/sysconfig/iptables contains the rules
I want.
However, after bootup, I open a terminal and
run iptables -L -n
and do not see those rules at all, and all
the rules are in "ACCEPT" state.
I have to resort to start iptables manually
in order to install the rules I have in
/etc/sysconfig/iptables.
So, what needs to be done to force iptables to run
and to use the rules I have in the iptables file?
Directly after a reboot I would run....
systemctl status iptables.service
And, yeah, your emails are a bit hard to read.
# systemctl status iptables.service
iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled)
Active: inactive (dead)
# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate
RELATED,ESTABLISHED
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0
INPUT_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with
icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate
RELATED,ESTABLISHED
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0
FORWARD_IN_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
FORWARD_IN_ZONES all -- 0.0.0.0/0 0.0.0.0/0
FORWARD_OUT_ZONES_SOURCE all -- 0.0.0.0/0 0.0.0.0/0
FORWARD_OUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with
icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OUTPUT_direct all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD_IN_ZONES (1 references)
target prot opt source destination
FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
FWDI_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
Chain FORWARD_IN_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_OUT_ZONES (1 references)
target prot opt source destination
FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
FWDO_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain FORWARD_direct (1 references)
target prot opt source destination
Chain FWDI_public (2 references)
target prot opt source destination
FWDI_public_log all -- 0.0.0.0/0 0.0.0.0/0
FWDI_public_deny all -- 0.0.0.0/0 0.0.0.0/0
FWDI_public_allow all -- 0.0.0.0/0 0.0.0.0/0
Chain FWDI_public_allow (1 references)
target prot opt source destination
Chain FWDI_public_deny (1 references)
target prot opt source destination
Chain FWDI_public_log (1 references)
target prot opt source destination
Chain FWDO_public (2 references)
target prot opt source destination
FWDO_public_log all -- 0.0.0.0/0 0.0.0.0/0
FWDO_public_deny all -- 0.0.0.0/0 0.0.0.0/0
FWDO_public_allow all -- 0.0.0.0/0 0.0.0.0/0
Chain FWDO_public_allow (1 references)
target prot opt source destination
Chain FWDO_public_deny (1 references)
target prot opt source destination
Chain FWDO_public_log (1 references)
target prot opt source destination
Chain INPUT_ZONES (1 references)
target prot opt source destination
IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
IN_public all -- 0.0.0.0/0 0.0.0.0/0 [goto]
Chain INPUT_ZONES_SOURCE (1 references)
target prot opt source destination
Chain INPUT_direct (1 references)
target prot opt source destination
Chain IN_public (2 references)
target prot opt source destination
IN_public_log all -- 0.0.0.0/0 0.0.0.0/0
IN_public_deny all -- 0.0.0.0/0 0.0.0.0/0
IN_public_allow all -- 0.0.0.0/0 0.0.0.0/0
Chain IN_public_allow (1 references)
target prot opt source destination
ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353
ctstate NEW
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
ctstate NEW
Chain IN_public_deny (1 references)
target prot opt source destination
Chain IN_public_log (1 references)
target prot opt source destination
Chain OUTPUT_direct (1 references)
target prot opt source destination
--------------------------
What I have in /etc/sysconfig/iptables:
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT
ACCEPT[0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -m state --state NEW -j DROP
COMMIT
7:28 p.m.
On 07/01/14 08:11, JD wrote:
Hi all,
When I run /sbin/system-config-services
I see that iptables is enabled, and that
/etc/sysconfig/iptables contains the rules
I want.
However, after bootup, I open a terminal and
run iptables -L -n
and do not see those rules at all, and all
the rules are in "ACCEPT" state.
I have to resort to start iptables manually
in order to install the rules I have in
/etc/sysconfig/iptables.
So, what needs to be done to force iptables to run
and to use the rules I have in the iptables file?
Directly after a reboot I would run....
systemctl status iptables.service
And, yeah, your emails are a bit hard to read.
--
If you can't laugh at yourself, others will gladly oblige.
3587
days inactive
3587
days old
10 comments
6 participants
participants (6)
-
Bruno Wolff III -
Chris -
Ed Greshko -
JD -
Mike Wright -
Pete Travis