--On Friday, August 05, 2005 12:50:07 -0400 Jason 'XenoPhage' Frisvold <[EMAIL PROTECTED]> wrote:
> Frank Smith wrote: > >> amandad normally listens on UDP port 10080, so you need to add that >> > > As in : > > -A INPUT -s $amanda -p udp --dport 10080 -j ACCEPT > > correct? Where $amanda is the IP address of the server? If this were not in > the iptables config, and ip_conntrack_amanda were on, would it still allow > it? I'm not competely familiar with the connection tracking modules.. I've > been able to do most > everything without them thus far.. Although, it's looking like I'll > definitely need them for stuff like amanda, ftp, and nfs.. (Not sure if > there is an nfs module tho) Yes, $amanda is the IP address of the server, I was pasting a line out of one of my home machines and didn't explain the variable (iptables rules become simpler to manage if you make your IPs and networks variables. Not only is it easier to change, you won't typo a single IP in one rule and spend hours trying to figure out why it isn't working propoerly). The various conntrack modules work by relating activity on various ports. For example, the if the ftp conntrack modules is installed, after a connection is made to port 21 it will allow the reverse data conection from the remote IP, but only if a) you have a RELATED accept rule, and b) if you allow the incoming packets to port 21 in the first place. I don't recall if you had ESTABLISHED,RELATED or just ESTABLISHED in your rules, if only ESTABLISHED then none of the conntract modules will work. > >> There were a few early 2.6 kernel versions (soon after the Amanda code was >> added into >> iptables) where the Amanda iptables module was broken and all backups would >> fail even >> if you had no rules defined (i.e., were accepting all packets in and out). >> >> > > Hrm.. I would *hope* that redhat updated their distro with the fixes.. I'm > running the latest RHES 4.0 packages.. Wouldn't know, I'm a Debian person who always builds custom kernels anyway. > >> Did your 'LOG' rules log any packets that would be dropped? >> >> > > Nope. And that cause more confusion than you know.. I kept thinking it was > the tape drive and not the firewall.. I spent countless hours testing and > re-testing that tape drive... :P > >> If you are using one of the broken kernels and can't upgrade, you can do >> what we did >> before it was part of iptables and use these rules (along with your >> 'ESTABLISHED' rules: >> >># Amanda backups >> -A INPUT -p udp -s $amanda --dport 10080 -j ACCEPT >> -A INPUT -p tcp -s $amanda --dport 1024:65534 -j ACCEPT >> >> if you use the default build. You can also configure Amanda with the >> tcpportrange and >> udpportrange options and narrow down the range of open ports (although if it >> is only >> open to the Amanda server it is not as big an issue). >> >> > > I'll look at using these rules if I can't get the connection tracking to > work.. And, again, in your example, $amanda is the server IP, right? Yes. > Thanks for the info!!!!! > > As an aside.. Did you get multiple copies of my first email? I got 2 > myself, and 4 copies of your reply.. *boggle* Yep, I saw two copies as well, but only replied once. Frank > > Jason -- Frank Smith [EMAIL PROTECTED] Sr. Systems Administrator Voice: 512-374-4673 Hoover's Online Fax: 512-374-4501