I realy need help with a firewall!

[yogee]

I have a linksys cable/dsl router and have 4 pc's hooked up to it. One of which is a redhat 7.1 system with many ports i need to use as services. This redhat system has nothing hooked up to it (ie monitor, keyboard or mouse) and all my systems have static ip's. My real ip changes (not very often at all) via dhcp service. Im using webmin and vncserver to use and control the entire system. In the router setup i have set the redhat system to the DMZ host which takes effect after all other rules on ports that have been setup on the router. Those of you not familiar with DMZ, it opens the entire system specified by way of its static ip, to the entire internet only after other rules have been taken effect by the router. I would like to use ipchains OR iptables in the redhat system to firewall it leaving the services needed open to use. In webmin on the redhat system there is a ipchains module to configure the system firewall but i cant or dont want to use it as a starting point. REALY though, i dont know how to work it at all. Its very confusing. When i setup redhat, i used the firewall config and it left me with some basic ipchains rules which will be posted at the bottom of this message. I added some ports (while setting up redhat), to open webmin and vncserver services so i could get in and control the system. What services are port 22 and 25? 25 im guessing is ssh and 25 ill guess is dns. Can this (ipchains) be changed over to a iptables rule set easy or is it still to early to get good help?
Also, this system is booting in run level 3. Vncserver seems to have gone and clunked out on me. I can launch it and open the login screen but cant actualy get in. Im not sure what i did but i would like to reinstall it or something to get it working again. Any ideas on that?

What i need opened: port 80, www server / port 21, ftp server / port 10000, webmin server w/SSL Encryption (can be set to anything) / ports 5801 - 5805, vncservers (just incase one crashes ill move to the next launched vncserver via ssh login inside webmin. / SSH


Have no idea why or what these are in the follwing rules created by redhats ipcains configuration upon instalation. I know what the dns is, but why it was included is beyond me.
-A input -s DNS.DNS.DNS.* 53 -d 0/0 -p udp -j ACCEPT
-A input -s DNS.DNS.DNS.* 53 -d 0/0 -p udp -j ACCEPT

I think this rule is telling the system the the default rule is to reject.
-A input -s 0/0 -d 0/0 -p tcp -y -j REJECT
-A input -s 0/0 -d 0/0 -p udp -j REJECT


My current firewall rules, but it is disabled right now!
# Firewall configuration written by lokkit
# Manual customization of this file is not recommended.
# Note: ifup-post will punch the current nameservers through the
# firewall; such entries will *not* be listed here.
:input ACCEPT
:forward ACCEPT
:output ACCEPT
-A input -s 0/0 -d 0/0 10000 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 5801 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 5802 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 5803 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 5804 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 5805 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 25 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 80 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 21 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 22 -p tcp -y -j ACCEPT
-A input -s 0/0 -d 0/0 -i lo -j ACCEPT
-A input -s DNS.DNS.DNS.* 53 -d 0/0 -p udp -j ACCEPT
-A input -s DNS.DNS.DNS.* 53 -d 0/0 -p udp -j ACCEPT
-A input -s 0/0 -d 0/0 -p tcp -y -j REJECT
-A input -s 0/0 -d 0/0 -p udp -j REJECT

[ 08 August 2001: Message edited by: yogee ]

[VRay]

Well, if I understand your configuration scheme correctly, if you set up a firewall on RedHat, then only that machine will be firewalled. Doesn't the linksys have a firewall? If so, don't bother with a firewall on the RH system, the linksys should protect your network. My setup is one nix box has two nics, one to the internet, one to the hub. This machine protects the network and maquerades using pmfirewall (easy to configure, check it out). Sorry I couldn't be more helpful, but I struggled to follow your post just a tad....

[mychl]

VRay is right, you should send everything through your nix machine. It can be your router. You just need 2 nics in your nix.... :D . One goes out, one goes to the hub.... Then you can really have fun!!!.. i mean that too
:cool:

[yogee]

Yes the linksys is a router-firewall. I had no choice to use the router to open my game server to the outside world. Ive done the 2 nic and redhat as router thing but could never get my game server to get the ports forwarded to it. It is simply out of the question to do it that way now. I will not waist more time asking for help that i will not be able to get. Everything is easier said than done. Everyone knew what i NEEDED but couldnt posibly explain how to DO IT.


Now to keep this as simple as posible for you. I have the redhat machine set with a local static ip. In the router setup i have that static ip set to the dmz host. This means anything coming to my ip (dynamic) goes to the redhat box. This happens only after any other rules that are setup and forwarded in the router. Which means my game server gets its things and then everything else goes to the linux server. What i need is to get my firewall setup correctly on the redhat box. I run a vncserver and webmin to control the redhat box. I CAN NOT get in the vncserver or get https pages when the firewall is active.


VRay--
To answer one of your suggestions:
I can not disable ipchains and use the router for my firewall. I have tried to set it up that way and cannot get the same as above working. i opened just 5801-5806 and vncserver will not let me in.

[Morphine]

I basically have Redhat 7.1 as my router and firewall to my windows computers. I would suggest implementing iptables since it's far more powerful than ipchains.

This site has a great script to run to get your firewall up. Just look it over slowly since it's pretty self-explanatory.
http://www.sentry.net/~obsid/IPTables/rc.scripts.dir/current/rc.firewall.iptables.multi

Backup your /etc/sysconfig/iptables. Once you execute the script, execute the iptables-save > /etc/sysconfig/iptables command. Go and edit that /etc/sysconfig/iptables file, and it would be much easier to read.

/etc/rc.d/rc3.d/S08iptables will execute the config file in /etc/sysconfig/iptables. :D

[ 09 August 2001: Message edited by: Morphine ]