Red Hat Bugzilla – Bug 164187
Unable to configure port range in Other Ports
Last modified: 2007-11-30 17:11:10 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Description of problem:
I used /usr/bin/system-config-securitylevel and tried to open a port range using 6881-6999:tcp. system-config-securitylevel accepted the command, but when I checked it, only port 6881:tcp was opened. Am I missing something? I looked for a man page or help for system-config-securitylevel and couldn't find one. I did a google search for system-config-securitylevel and "port range" and got some stuff on ftp but nothing on actually opening a range.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
2.Enter a port range to open in "Other ports", i.e., 6881-6999:tcp
5.Only first port shows in "Other ports", i.e., 6881:tcp
Actual Results: Only first port shows in "Other ports", i.e., 6881:tcp
Expected Results: A port range should have been created.
This makes it impossible to participate in a bittorent community.
No, you're not missing anything. s-c-securitylevel doesn't currently support
The option -dport will accept a range according to the man page for iptables. If
I hand edit the /etc/sysconfig/iptables file to specify a range, will the
firewall accept it?
Answered my own question. Tried it. iptables -L lists the rule so it appears
this works. Of course now I cannot use system-config-securitylevel or it will
overwrite the rule and drop the port range.
Further comment. I can still use system-config-securitylevel to change SELinux
enforcing without rewriting the /etc/sysconfig/iptables file. I cannot change
the firewall ports or the iptables file is overwritten.
Seems this might be a fairly simple enhancement. system-config-securitylevel
will already accept ip-ip:tcp as a iprange on the "other ports" section. It just
does not parse and write the range. The output of system-config-securitylevel
could process the string before the : as it currently does and substitute a
colon for the dash since the format for a range is
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 6881:6999 -j
Just a thought.