OpenSUSE Network :: GRC Failing Firewall Setup / Set Up With Gibson Research Centre, It Fails?
Apr 21, 2011
Before I go any further I must admit that I'm pretty rubbish at setting these up, so please be gentle!
Now my problem; I have a normal desktop pc (I don't want to set it up as a server) but when I check the hardness of my set up with Gibson Research Centre, it fails. It can see ports 22,23,80,443 as closed but still visible.....? I have never had this happen to me before and struggling my way through yast firewall tool, I can find no easy way of sorting this out.
I'm trying to get OpenMPI (a parallel programming library) working on my home system. I have just two machines on it now, t61 and quad, connected through a router. (Which is also connected to cable modem for internet.) I can ssh between the machnes, mount directories with NFS, etc. However, I just can't get the OpenMPI to run. The OpenMPI message board suggested that the most probable cause is that the firewall is blocking TCP. I don't know how to tell if that's the problem, and can't find any manual for the SuSE firewall, while the various Wikis &c that pop up in a search don't provide any information that addresses my problem.
I suspect this is an initial configuration bug. All firewall logs seem to be going to all three files. That causes a lot of clutter in the log files, and makes it difficult to see whether there are any serious problems being logged.
I am attempting to set up a firewall in my home network environment. the rest of the environment is windows, sorry I am attempting now so bear with me. what I have is a cable modem coming in, then my fedora 11 box with 2 nics, then the wireless router and the rest of the network.
everything works fine until I put the linux box in. If I put the firwall in the firewall sees the internet but the wireless router directly after does not. I am doing something wrong with the dhcp I am guessing. I dont want the firewall to give the address to the network I want the router to. I tried to get the firewall to do it (yum install dhcp leafnode) but it kept saying something didn't work right.
so I figure I will let the cable modem give the firewall an ip and the router give the rest of the network their ip's but how do I get the firewall and router to see each other and allow passthrough?
I currently want to set up a network with 2 Ubuntu servers (mail and web) in a DMZ in order to separate them from an internal network. I want to use a dedicated Linux firewall. This firewall will have 3 network interfaces on it. One network interface will connect to the external router/modem (router and modem in one box), one interface will connect to the DMZ and the other interface will connect to the internal network. The router/modem lets you put, I think it's 1 or 2, interfaces in a DMZ.
But, when I think of any of the dedicated firewall's or servers' interfaces it doesn't make sense to me to put any of them in the router/modem's DMZ (I think it would be better for the dedicated firewall's and the servers' interfaces to have static private I.Ps ie 192.168.2.4 etc right?). What I mean is that even if, as far as the router/modem is concerned, none of the interfaces were in a DMZ, the area where the servers are would still effectively be a perimeter network and with such a set up would still be, effectively,a DMZ, right?
I am learning to setup firewall in my home for that i have selected four system(sys1,sys2....sys4) for testing .I have configured sys2 to act as a firewall with two NIC. sys3 and sys4 are inside the firewall . sys1 is not connected to firewall for testing purpose.
the IP assignments are follows :
sys1 : ( fedora, not connected to firewall i am thinking, But i am not sure )
what happened is that sys1(not connected to firewall) can ssh to sys4(connected,inside firewall),since the rules are written not to ssh form sys1 to sys4..
then I came to know whatever the request I give, It directly goes as sys1 --> sys4. Not as sys1-----> sys2(firewall)---> sys4 .and the firewall is not filtering and processing anything for both inbound and outbound (i think it's my mistake some where). the requests are directly going inside without firewall.
I'm trying to share the internet connection from my Ubuntu 11.04 desktop to one of my laptops (Mac OS X) using an ad-hoc network. Really I don't care what kind of AP the desktop broadcasts as long as I can share the internet connection. According to the documentation on the hardware the adapter supports ad-hoc. However I am getting the 8B06 error below.
The problem: iwconfig wlan0 mode ad-hoc yields -> Error for wireless request "Set Mode" (8B06) :
I want some advice for making my system more secure. I want deactivate any network connection that is unnecessary. Only my browser and the update ability of zypper should have access to the internet. On windows there are personal firewalls.
How can I block internetaccess for all other programmes on openSUSE?
Samba is working correctly if Susefirewall2 is off. I have added Samba client and Samba Services for extern access but samba is not working when firewall is now on. Which services should I also add ?
I virtualised backtrack on windows 7, and set up the network connection to bridged mode, but my networking still fails. dhclient eth0, outputs many DHCPDISCOVER but no DHCP offers.
I am trying to connect my huawei e160 usb modem but it keeps failing and does not show on the Network Manager, checking on /var/log/messages this it what I get:
Oct 5 15:31:30 LPKENBITD002 modem-manager: (ttyUSB1): re-checking support... Oct 5 15:31:30 LPKENBITD002 modem-manager: (Huawei): (ttyUSB1) deferring support check Oct 5 15:31:33 LPKENBITD002 modem-manager: (ttyUSB1): re-checking support... Oct 5 15:31:33 LPKENBITD002 modem-manager: (Huawei): (ttyUSB1) deferring support check Oct 5 15:31:36 LPKENBITD002 modem-manager: (ttyUSB1): re-checking support... Oct 5 15:31:36 LPKENBITD002 modem-manager: (Huawei): (ttyUSB1) deferring support check
Just installed 11.3 on an aging IBM Thinkpad X40. But the network (and xdm) does not work. I saw in the logs the cryptic message nl80211 driver does not support authentication/association or connect commands. This machine worked on 10.3, so this is a confusion. What should I try next?
During my research on enabling composite effects and xinerama, I stumbled upon a few threads and discussions which showed xserver 1.10+ has resolved the conflicts between the 2 modules. I'm wondering if anyone knows of someone/somewhere to get a SUSE compatible build of xserver 1.10+ ? If not, could someone point me toward an easy-to-follow tutorial on how to build packages for SUSE?
1. Added myself to vboxusers 2. Installed dkms 3. Ran the "sudo /etc/init.d/vboxdrv setup" command.
When I run "/etc/init.d/vboxdrv setup" it gives me the error: modprobe vboxdrv failed. use 'dmesg' to find out why
Code: The VirtualBox Linux kernel driver (vboxdrv) is either not loaded or there is a permission problem with /dev/vboxdrv. Please reinstall the kernel module by executing '/etc/init.d/vboxdrv setup'
as root. Users of Ubuntu, Fedora or Mandriva should install the DKMS package first. This package keeps track of Linux kernel changes and recompiles the vboxdrv kernel module if necessary. One other thing, I looked in the file system and there is no "/dev/vboxdrv". Is this correct?
Im trying to setup multiple domU through the default bridge setup. I am able to access only one of them through the network at a time. If you ping one of the domU it works perfectly but you cannot ping any of the others until you stop pinging the one and even then it takes a bit before you can. Ive looked around for a while and seen similar problems but nothing ever seems quite the same. Im probably missing something really stupid. Or is this the way the bridge is supposed to behave? Do i need to use a routed virtual network?
I am trying to add a custom allow rule in the firewall for a range of IPs from 74.201.102.0 - 74.201.103.255, what exactly am I supposed to enter in the source box? I believe I have to add two separate rules for 102 and 103, and I put /24 at the end of both, is this correct to get the whole range of IPs?
1. Under openSUSE 11.2, I allowed printer sharing through CUPS by setting the Firewall to Allow Services of CUPS in the External Zone section. I don't see the CUPS option in the Allow Services of the Firewall under 11.4, any zone. Is my system missing something?2. If I turn off the Firewall, the client computer can see the printers, even get the broadcasted names. If I put port 631 in TCP of the Advanced setting of the External Zone, the client computer can see the printer too, but I know I read somewhere that putting 631 in the External Zone is basically allowing printer requests from the entire internet.
switched recently to 11.2 and it works fine for me as workstation I want to set up a router separating a part of the network and also acting as a firewall/proxy... Configured 2 Ethernet Interfaces, checked Ip forwarding in Yast but it does not forward the packets from the "internal" to the "external" network. Hovewer after I set up my router as default for machines on internal network I can ping the external interface but no adress on external network (particularly the one of the default router) !!! From the router I can reach both networks and the net via default gateway on external. Tried to:
a) switch firewall completely off b) iptables -P FORWARD ACCEPT c) masquarading internal adresses to the external network
my interfaces configuration looks like: eth0 Link encap:Ethernet HWaddr 00:13:D4:E3:A2:7B inet addr:192.168.1.34 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: fe80::213:d4ff:fee3:a27b/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
We have reason to ask this of you following some strange firewall behaviour - But don't panic If you use openSUSE 11.2 and you think: Your Firewall should be running You are not sure but think it should be check and report back here.
SuSE 10.0 X86 32 acting as my internet gateway and firewall.
eth0 is my internal interface network 192.168.0.0/24 IP 192.168.0.254 dsl0 is my internet connection and is a single ip PtP connection to my ISP.
My internal network is masquaraded onto the external network.
I run an smtp server on my gateway box that I need to be accessable to both the internal and external networks.
However I want to prevent machines on the internal network from establishing connections to external smtp servers, but still alow them to connect to the smtp server on the gateway to send email.
NOTE I do not want to force attempts to connect to [URL] 25 to be re-directed to my internal server I just want to drop or reject the connection.
The firewall up until now has just been configured through YaST, but am not afraid to edit script files if needed
The reason for doing this it to prevent spambots from being able to send through my isp, I keep my own machines clean but sometimes get asked to disinfect machines for other people (family members etc), where I need to connect to the outside world to get updates/virus defs etc, but don't want them spamming from my network.
can I deny the access to my server for a specific OS? I have one PC which I want to give it acces from winxp, but if it's boot into ubuntu I want to deny all access to my server, same IP, same ethernet card
I've setup vnc over ssh tunnelling however the Suse firewall seems to be blocking it. On the local host I have this in ~/.ssh/config:LocalForward localhost:5900 remotehost.com:5900 The problem is that this only works when I either disable the firewall or add an exception for VNC. Both of these actions defeat the whole purpose of ssh tunnelling since they leave my VNC port open to the outside world (very insecure).
I'm in the situation where I'm trying to create 2 private networks using ESX server, all behind a NAT router (static ips are used). I used an openSuse11 vm as a router and was able to configure it so that a machine on one private network was able to access the public network. The problem I have now it that I need to be able to access a machine on the private network from the public network using a different set of IP's.
So if a machine in the private network has an IP of 10.1.0.222 I should be able to ping it using 10.99.0.222 or some other IP. I have never done this before and after reading up on iptables and linux routing I feel more confused than before. Is it possible to add IPs to eth0 (public) and have them mapped to machines on a private network eth1 or eth
I'm looking forward to the release of openSUSE 11.4, which I'm looking to install as an Internet facing gateway on a mini-ITX machine with 2 Ethernet cards. As such I've been reading up on the YaST Firewall trying to find out to configure it, and there's one thing I'd like to be able to do: 'stealth' all the firewall ports.
In other words, if someone were to hypothetically do a port scan of my external IP address, I would rather they not know whether any of the ports on my gateway are open or closed, so instead of replying with the status of those ports the packets get dropped. I've been able to do this with a product called Astaro Security Gateway, which I currently have installed on a second hand Dell Optiplex machine, but I am now looking into the possibility of installing this as a virtual machine inside an openSUSE 11.4 host (extra level of security) and would like the same functionality for the host OS.
How I can refuse an outgoing connection on opensuse firewall by default outbound policy is permissive, and the p2p I explicitly deny an outgoing, according to protocol, remote port and local port.
But I can add rules as how to run opensuse firewall rules are permissive only for inbound traffic and so I can not specifically deny an outgoing connection.
Before using fwbuilder is very powerful and configurable but now I'm with suse for convenience but want to know if you can do what I want, if not I will have to use fwbuilder.
I have done a new install of 11.4 and as with previous versions, I have to go to YAST2 and disable the firewall before I have internet and local network access. Finally I must find out how to do this correctly.
How to I change the default firewall to allow me internet and local network access without disabling it completely? Also I am unclear about the function of Novel Network Armor? What does this do?
