Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 62932 - firewall-config can't DENY SYN packets
firewall-config can't DENY SYN packets
Product: Red Hat Linux
Classification: Retired
Component: firewall-config (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Harald Hoyer
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2002-04-07 20:08 EDT by Peter Fales
Modified: 2007-04-18 12:41 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2002-04-07 20:09:00 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Peter Fales 2002-04-07 20:08:56 EDT
I'm try to create a set of firewall rules that will allow any outgoing 
connections, but accept incoming connections only on a limited set of 
ports.  I currently do this with a set of commands like:

ipchains -A input -i eth0 -s 0/0 -d 0/0 http -p tcp -y -j ACCEPT
ipchains -A input -i eth0 -s 0/0 -d 0/0 ssh  -p tcp -y -j ACCEPT
ipchains -A input -i eth0 -l -s 0/0 -d 0/0   -p tcp -y -j DENY

This accepts SYN packets on port 80 or port 22, but denies connections
on any other ports.   I was trying to start doing this the "right"
way using firewall-config, but I wasn't able to do it - firewall-config 
greys out the "start of connection" button when the ACTION is ACCEPT.

I can't think of any obvious way to provide this functionality some
other way, but even if there is a different/better way to do it  I
think firewall-config should allow you to create any rule that is 
legal for ipchains.  The first two rules are accepted by the ipchains
command and seem to do what I want, but I can't enter that rule
using firewall-config.

How Reproducible:

Steps to Reproduce:

Actual Results:

Expected Results:

Additional Information:
Comment 1 Harald Hoyer 2002-04-08 04:11:48 EDT
hmm, with this set, you can even remove the "-y". But you are right. You may  
solve this with another rule set or write /etc/sysconfig/ipchains with vi.  
firewall-config was not intended to include _all_ options of ipchains.  
As time permits, firewall-config will be rewritten completly (iptables) in the 
next half year.

Note You need to log in before you can comment on or make changes to this bug.