Re: VLAN Konfig

[Thomas Berthel <t.berthel@gmx.net>]

[-- Attachment #1: Type: text/plain, Size: 3986 bytes --]

Hi,

> This was more a question then a statement ;-)
me too ;-)

> This is really strange, have no clue why this happens.
There is not the Problem  - i must restart my FW and then all Modus1 and
Custom-changes Rules back.

> Which rules did you try to edit ?
Only in my firewall.local file, and then i stop and start the
/etc/init.d/firewall. I check the WhatsApp-Ports in WUI for Blue. He did
nothing - then i change it in my firewall.local the functionality was there.

As I see it, everything is well controlled in the IPTables and nothing
in the WUI. :(

BG, Thomas



Am 09.06.2013 15:31, schrieb Erik K.:
> 
> Am 09.06.2013 um 13:58 schrieb Thomas Berthel:
> 
>>
>>> I meant in this section --> http://wiki.ipfire.org/de/optimization/vlan/start#iptables_uebersicht are only spts: to be seen, but no dpts: in the rules you define "--dports 993,995,110,587,465" but they are listed as "spts:" (source ports) for example i have in the iptables -L listing for Mail something like this
>>> RETURN     tcp  --  192.168.7.0/24      anywhere             multiport dports imaps,urd,submission,pop3s,smtp TIME from 00:00:00 to 00:00:00 UTC
>>> so the dports are specified. I can´t find something like that in your iptables -L listing.
>>
>> Ah. I'm using dport for single port (dpts:52 for DNS) an multiport
>> dports for more destination ports, is this not okay?
> 
> O.K. my bad have overseen it.
> 
>>
>>> So you have allowed only unprivileged ports as a source port, but isn´t it that the case per default anyway ? Or do you regard a security method with this ? 
>>> So i´am also not sure with this, but if you define only --dports isn´t it the same behavior anyway with the source port then you defined it ?
>>
>> is this a default? Sorry, i don't now. Is that so wrong?
> 
> This was more a question then a statement ;-)
> 
>>
>>> What rules do you use in Mode 1 ?
>>
>> A lot of rules ;) I can't post it here... one snipp: DNS, Mail,
>> Game-Ports, Whois, FTP, NTP and ssh for green, red and all interfaces.
>>
>> But these rules are all double in my tables after the restart.
> 
> May it is because you define them in firewall.local also ? Did you try a complete reboot ?
> 
>> Another
>> problem is when I usually re-upload my FW mode 0 although the WUI shows
>> me mode 1.
> 
> This is really strange, have no clue why this happens. 
> 
>>
>> I have all my ports manually specified are no longer seen in the tables,
>> only when I reboot the FW.
> 
> Have had the same issue since i was working a little bit with firewall.local. After modifications of firewall.local and stop|start|restart|reload tests the iptables -L listing shows me sometimes nothing in the CUSTOM chains. It seems that the best way is to reboot IPFire . Important to test this behavior with the new Firewall. I think in Core 69 (test image) the new FW is already implemented.
> 
>>
>>> Ahh O.K. but is it possible to arrange rules for the VLAN interfaces over the WUI (e.g. DMZ pinnholes, etc...) ?
>>> So maybe it is less complicated (especially for the explanations in the wiki) if all the rules which can be arranged over the WUI will be set in that way ? MIght be nice if you can go for a try . So also if the outgoing FW will be configured, i think the CUSTOMFORWARD rules are defined then in the FORWARD and OUTPUT chains.
>>
>> I just tested it on wui and FW mode 1 do not apply the rules. It seems
>> as if for wireless (blue) and the rule come from a different direction
>> no matter what is stored in the WUI.
> 
> Which rules did you try to edit ?
> 
>>
>> _______________________________________________
>> Documentation mailing list
>> Documentation(a)lists.ipfire.org
>> http://lists.ipfire.org/mailman/listinfo/documentation
> 
> _______________________________________________
> Documentation mailing list
> Documentation(a)lists.ipfire.org
> http://lists.ipfire.org/mailman/listinfo/documentation
>