Firewall Configuration in Linux in Centos 6.2
-
@thanksajdotcom said:
s ICMP as the traffic typ
OK but how can i make the other system in the same network as well as other network to be easily ping the system. -
ICMP (Ping and TraceRoute) should be enabled by default. Have you tested them to see if they are already blocked?
-
@Lakshmana said:
@thanksajdotcom said:
s ICMP as the traffic typ
OK but how can i make the other system in the same network as well as other network to be easily ping the system.If they're on the same network, you don't have to do anything to enable it. Just type ping ip.of.the.device or the hostname.
-
@StrongBad said:
ICMP (Ping and TraceRoute) should be enabled by default. Have you tested them to see if they are already blocked?
Exactly. You're freaking out about enabling them when they are enabled by default, so unless you did something SPECIFIC TO DISABLE THEM, they are already working.
-
@Lakshmana said:
@thanksajdotcom I need to open Port number 22 (SSH),and also Ping.I need to do the block diagram to design the process?
Port 22 is open by default as well. How did these get closed?
-
@thanksajdotcom So now I have to use only SSH as open to use the protocol.How to do block diagram?
-
@StrongBad said:
@Lakshmana said:
@thanksajdotcom I need to open Port number 22 (SSH),and also Ping.I need to do the block diagram to design the process?
Port 22 is open by default as well. How did these get closed?
Exactly. Especially if this is a server, you shouldn't have a GUI by default, meaning you MUST have SSH access as it is.
-
Maybe you should provide us the output of your IPTables configuration file. Then we can tell you what to change. Not sure how else to help.
-
@Lakshmana said:
@thanksajdotcom So now I have to use only SSH as open to use the protocol.How to do block diagram?
Again, I have no idea what you're talking about. SSH should already be open. Ping should already be open. Have you tried actually using either to make sure they work before you talk about getting them to work? Please try pinging and SSHing into your devices and paste the output here. Until you do that, we can't help you any further.
-
@StrongBad I did not configured IP table.I need to configure IP table tommorow only.I dont know how to configure Iptable any link anyone provide.
-
@Lakshmana said:
@StrongBad I did not configured IP table.I need to configure IP table tommorow only.I dont know how to configure Iptable any link anyone provide.
What do you need to configure it for? What is your purpose of configuring IPTables? It sounds like you want to know how to do something without a clearly defined objective of what you actually need to do. What is your purpose in configuring IPTables?
-
@thanksajdotcom I need to configure basic firewall in Linux OS and to test the ports are working from the WAN to LAN after configuring the firewall.This is my objective
-
This is what we need:
cat /etc/sysconfig/iptables -
@Lakshmana said:
@StrongBad How to do a block diagram for designing the Firewall?
What is a block diagram?
-
@Lakshmana said:
@StrongBad I did not configured IP table.I need to configure IP table tommorow only.I dont know how to configure Iptable any link anyone provide.
It's not simple. You cannot simple "configure." Please provide us the listing of your current configuration. IPTables is pretty easy, but you have to work with the text file and edit it. So we need to know what you have in order to fix it.
-
@StrongBad It is the diagram to show how the components(firewall) will be connected in a network
-
@Lakshmana said:
@StrongBad It is the diagram to show how the components(firewall) will be connected in a network
What is the purpose, though? You just open or close ports. Why would you use a diagram? I think that you are making something very easy into something very complicated.
-
Here is what a healthy configuration file looks like for CentOS 6. Just use this if what you state as your needs above is all that you need....
Just put this into /etc/sysconfig/iptables
# Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT -
Then to make it take effect...
/etc/init.d/iptables restart -
To be clear, this is the default. You would only need to do this if you've altered IPTables already. SSH (22) and ICMP (Ping) are open by default as soon as you install. So someone has broken your system if you need to do this.
