I executed the iptables -L command and got the following output: Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination I'm not really that familiar with firewalls in linux, but I would assume that iptables is running without rules? I also noticed that it's not one particular host that bumps me out of telnet, but all connections and all hosts. The network folks don't know (or maybe they do) that I'm running linux on the network, but is there a way for them to periodically reset the port I'm using in the data closet? This is really quite interesting to me, so any input is very helpful. Thanks. -----Original Message----- From: Theo Van Dinter [mailto:felicity@kluge.net] Sent: Tuesday, April 02, 2002 11:11 AM To: wlug@mail.wlug.org Subject: Re: [Wlug] Problems dropping telnet sessions On Tue, Apr 02, 2002 at 09:36:00AM -0500, Simoncini, Matthew wrote:
Anyone have this type of problem or more importantly, can someone point me in the right direction?
My first two thoughts are: iptables times out your connection for some reason, or the remote side has an autologout value set. Is there a firewall setup on your box? You can do "iptables -L" to find out. As for autologout, I would think this would have affected you before, but it's something to rule out anyway. What shell are you using on the remote machines? If it's a csh variant, run "echo $autologout" and see what it comes back with. If it comes back with a defined non-0 value, that is a likely cause of your problem. Run "set autologout=0" and see if that fixes your problem. -- Randomly Generated Tagline: "Note that if I can get you to \"su and say\" something just by asking, you have a very serious security problem on your system and you should look into it." (By Paul Vixie, vixie-cron 3.0.1 installation notes) _______________________________________________ Wlug mailing list Wlug@mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug
Try ipchains -L too, since you might have an ipchains based firewall. On Tue, Apr 02, 2002 at 11:33:44AM -0500, Simoncini, Matthew wrote: Matthew.Simoncini> This is really quite interesting to me, so any input is very helpful. Maybe the TCP timers are different on Linux? They are in /proc/sys/net/ipv4/tcp*. Some docs for these variables are available here: http://www.linuxhq.com/kernel/v2.4/doc/networking/ip-sysctl.txt.html You might also want to look at the tcp(7) manual page where they also document the sysctls: man 7 tcp -- Charles R. Anderson <cra@wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886
"Charles R. Anderson" <cra@WPI.EDU> writes:
Try ipchains -L too, since you might have an ipchains based firewall.
I doubt it, since he's running 2.4.10... Of course, it's possible, but I doubt SuSE would ship a firewall setup with 2.4.x, and use the compatibility module for ipchains...
Maybe the TCP timers are different on Linux? They are in /proc/sys/net/ipv4/tcp*.
Perhaps... I would think the firewall would only timeout connections which are being masq'd and run through connection tracking...and in that case, I thought the default timeout was pretty high. try iptables -t nat -L to see what's going on there. -- Josh Huber
Hi all Josh Huber wrote:
"Charles R. Anderson" <cra@WPI.EDU> writes:
Try ipchains -L too, since you might have an ipchains based firewall.
I doubt it, since he's running 2.4.10...
Of course, it's possible, but I doubt SuSE would ship a firewall setup with 2.4.x, and use the compatibility module for ipchains...
I have SuSE 7.2 and I get a response to ipchains -L but not to iptables -L :-) (uname -r gives 2.4.4-4GB) SuSE supplies two firewalls, a personal one (a quickie, basically just masquerading) and "SuSE firewall". The latter is configured via a file /etc/rc.config.d/firewall.rc.config which has this line Note: For 2.4 kernels, you need to have ipchains support enabled. in the comments section. So Chuck's instincts seem well-based. In SuSE's defense, this is back at 2.4.4 kernel which, I gather, was not quite ready for prime time even with the ipchains modules. Also SuSe does not claim to hand-hold for firewall stuff; you have to pay extra for that >-) doug PS My spell-checker thinks "firewall" might be "fireball" :-)
participants (4)
-
Charles R. Anderson -
doug waud -
Josh Huber -
Simoncini, Matthew