Red Hat Bugzilla – Bug 62932
firewall-config can't DENY SYN packets
Last modified: 2007-04-18 12:41:45 EDT
I'm try to create a set of firewall rules that will allow any outgoing connections, but accept incoming connections only on a limited set of ports. I currently do this with a set of commands like: ipchains -A input -i eth0 -s 0/0 -d 0/0 http -p tcp -y -j ACCEPT ipchains -A input -i eth0 -s 0/0 -d 0/0 ssh -p tcp -y -j ACCEPT ipchains -A input -i eth0 -l -s 0/0 -d 0/0 -p tcp -y -j DENY This accepts SYN packets on port 80 or port 22, but denies connections on any other ports. I was trying to start doing this the "right" way using firewall-config, but I wasn't able to do it - firewall-config greys out the "start of connection" button when the ACTION is ACCEPT. I can't think of any obvious way to provide this functionality some other way, but even if there is a different/better way to do it I think firewall-config should allow you to create any rule that is legal for ipchains. The first two rules are accepted by the ipchains command and seem to do what I want, but I can't enter that rule using firewall-config. How Reproducible: Steps to Reproduce: 1. 2. 3. Actual Results: Expected Results: Additional Information:
hmm, with this set, you can even remove the "-y". But you are right. You may solve this with another rule set or write /etc/sysconfig/ipchains with vi. firewall-config was not intended to include _all_ options of ipchains. As time permits, firewall-config will be rewritten completly (iptables) in the next half year.