Login or Register to Ask a Question and Join Our Community


Solaris

How to enable ping?a litte complex

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Operating Systems Solaris How to enable ping?a litte complex
# 8  
Old 04-10-2018
Sorry,forgot to put ouput
Here's output

Code:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 318K   76M            all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 318K   76M            all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 318K   76M            all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 318K   76M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW,RELATED,ESTABLISHED
    9   536 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:6000
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:3000
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:2000
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:137
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:137
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:138
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:138
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:139
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:139
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:445
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:445
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:65529
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:65530
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:65533
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:65529
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:65533
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:65530
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpts:4711:4712
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpts:4711:4712
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:25
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:631
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:631
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:515
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:515
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:111
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:111
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:662
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:662
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:2049
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:2049
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:4001
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:4001
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:32768
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpt:32768
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:2122
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:20 state ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:21 state ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:2121 state ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpts:60000:65535
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpts:60000:65535
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpt:5859
    0     0 ACCEPT     tcp  --  *      *       192.168.0.0/24       0.0.0.0/0            tcp dpts:54233:54234
    0     0 ACCEPT     udp  --  *      *       192.168.0.0/24       0.0.0.0/0            udp dpts:54233:54234
   14   817 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 415K packets, 499M bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:20 state NEW,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:21 state NEW,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:2121 state NEW,ESTABLISHED

# 9  
Old 04-10-2018
Ok. That'll help you a lot.

If you look at your table...

... what rules would you assume relevant for the failed ping?
... what rule, do you assume, matches for your icmp-packages(inbound and outbound)?

And last but not least, what do you think the following of your rules does accomplish?
Code:
iptables -A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

You will be suprised, what you have created. Very rare. ;-)

Hint: Look at the counters!
Last edited by stomp; 04-10-2018 at 01:48 PM..
This User Gave Thanks to stomp For This Post:
Linusolaradm1
# 10  
Old 04-10-2018
Sorry, I'm a little(or more..) not too expert with firewallls.

This rule

Code:
 iptables -A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

accept connections if new,releated or already estabilished before firewall start,or i'm wrong?

Code:
 ... what rules would you assume relevant for the failed ping?

The latest,with big count.

Code:
 ... what rule, do you assume, matches for your icmp-packages(inbound and outbound)?

Mmm..the latest?
Now try to fix..

---------- Post updated at 01:20 PM ---------- Previous update was at 01:12 PM ----------

Thanks stomp for help.
I have fixed the script removing the last line
# 11  
Old 04-10-2018
There is no single rule about allowing ICMP-pakets, which means it goes to the default-drop-rule(last line of INPUT Chain with packet count 14).

Code:
 iptables -A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

This rule means that EVERY stateful Connection is allowed. Every possible TCP-Connection.

The only thing being not allowed is ping. (more or less ;-) )

Delete the NEW-State of the rule, so only established and related connections are matched by this rule.

And remove all -m something Elements of your iptables rules.

replace the icmp block with this:

Code:
 # Icmp
iptables -A INPUT -p icmp --icmp-type 0 -j ACCEPT

This User Gave Thanks to stomp For This Post:
Linusolaradm1
# 12  
Old 04-10-2018
Made it, thanks for help me
# 13  
Old 04-10-2018
Quote:
I have fixed the script removing the last line
This way too, you disabled your firewall-functionality completely.

---

The first 3 rules of INPUT Chain seem defective. They have no effect and there must be some error in the rules so that the rules show up like this.
# 14  
Old 04-10-2018
Quote:
Originally Posted by stomp
This way too, you disabled your firewall-functionality completely.

---

The first 3 rules of INPUT Chain seem defective. They have no effect and there must be some error in the rules so that the rules show up like this.
Whoops!
I fix now.

---------- Post updated at 01:42 PM ---------- Previous update was at 01:40 PM ----------

This is the script now.
I'm testing it

Code:
#!/bin/sh
#a simple script firewall

# We need this for redirection
echo 1 > /proc/sys/net/ipv4/ip_forward

firewall_start() {
# Clean
iptables -F
iptables -X
iptables -Z
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z

# Default policy
#iptables -P PREROUTING  ACCEPT
#iptables -P OUTPUT  ACCEPT
#iptables -P POSTROUTING  ACCEPT
#iptables -P INPUT ACCEPT
#iptables -P FORWARD ACCEPT


# firewall rules INPUT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT


# X11
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 6000 -j ACCEPT

# Vdr
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 3000 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 2000 -j ACCEPT

# Samba
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 137 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 137 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 138 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 138 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 139 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 139 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 445 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 445 -j ACCEPT

# Amule
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 65529 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 65530 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 65533 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 65529 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 65533 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 65530 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 4711:4712 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 4711:4712 -j ACCEPT

# Mail
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 25 -j ACCEPT

# Print
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 631 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 631 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 515 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 515 -j ACCEPT

# Nfs
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 111 -j ACCEPT 
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 111 -j ACCEPT 
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 662 -j ACCEPT 
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 662 -j ACCEPT 
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 2049 -j ACCEPT 
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 2049 -j ACCEPT 
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 4001 -j ACCEPT 
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 4001 -j ACCEPT 
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 32768 -j ACCEPT 
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 32768 -j ACCEPT 

# Ssh 
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 2122 -j ACCEPT

# Ftp
iptables -A INPUT  -p tcp --sport 20 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT  -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT  -p tcp --sport 2121 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 2121 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 60000:65535 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 60000:65535 -j ACCEPT

# Secure telnet
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 5859 -j ACCEPT

# Ktorrent
iptables -A INPUT -s 192.168.0.0/24 -p tcp  --dport 54233:54234 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -p udp  --dport 54233:54234 -j ACCEPT

# Firewall rules NAT/OUTPUT
iptables -t nat -A PREROUTING -s 192.168.0.0/24  -p tcp --dport 21 -j REDIRECT --to-port 2121
iptables -t nat -A OUTPUT -s 192.168.0.0/24  -p tcp -o lo --dport 21 -j REDIRECT --to-port 2121
iptables -t nat -A PREROUTING -s 192.168.0.0/24 -p tcp --dport 22 -j REDIRECT --to-ports 2122
iptables -t nat -A OUTPUT -s 192.168.0.0/24 -p tcp -o lo --dport 22 -j REDIRECT --to-ports 2122

# Icmp
iptables -A INPUT -p icmp --icmp-type 0 -j ACCEPT

# Log
#iptables -A INPUT -j LOG
#iptables -A FORWARD -j LOG

#Final rules
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
}

firewall_stop() {
# Clean
iptables -F
iptables -X
iptables -Z
iptables -t nat -F
iptables -t nat -X
iptables -t nat -Z
iptables -t mangle -F
iptables -t mangle -X
iptables -t mangle -Z
}


firewall_restart() {
firewall_stop
firewall_start
}

case "$1" in
'start')
  firewall_start
  ;;
'stop')
  firewall_stop
  ;;
'restart')
  firewall_restart
  ;;
*)
  echo "usage $0 start|stop|restart"
esac
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Linux

Please: a litte help to crosscompile.

I have installed the "mipsel tuxbox" compile suite for crosscompile Host system is x86_64 slackware destination is mipsel32bit "vuduo+" For example,I want to compile a program, I use this script make clean export TOOLCHAIN=/opt/mipsel-tuxbox-linux-gnu export... (0 Replies)
Discussion started by: Linusolaradm1
0 Replies

2. Programming

Ping test sends mail when ping fails

help with bash script! im am working on this script to make sure my server will stay online, so i made this script.. HOSTS="192.168.138.155" COUNT=4 pingtest(){ for myhost in "$@" do ping -c "$COUNT" "$myhost" &&return 1 done return 0 } if pingtest $HOSTS #100% failed... (4 Replies)
Discussion started by: mort3924
4 Replies

3. UNIX for Advanced & Expert Users

Enable lpfc changes!

Hi Folks! I am writing a script which changes lpfc.conf if there it has been setup on RHEL BOXes, do I need to put dracut -f for enabling it? I am not sure, Can someone help! (6 Replies)
Discussion started by: nixhead
6 Replies

4. SCO

Auditing: how to enable?

edit: solution found Auditing Quick Start and Compatibility Notes (1 Reply)
Discussion started by: Linusolaradm1
1 Replies

5. Shell Programming and Scripting

How to get reason for ping failure using perls Net::Ping->new("icmp");?

Hi I am using perl to ping a list of nodes - with script below : $p = Net::Ping->new("icmp"); if ($p->ping($host,1)){ print "$host is alive.\n"; } else { print "$host is unreacheable.\n"; } $p->close();... (4 Replies)
Discussion started by: tavanagh
4 Replies

6. Shell Programming and Scripting

Animation Ping on Solaris Like Cisco Ping

Hi, I develop simple animation ping script on Solaris Platform. It is like Cisco ping. Examples and source code are below. bash-3.00$ gokcell 152.155.180.8 30 Sending 30 Ping Packets to 152.155.180.8 !!!!!!!!!!!!!.!!!!!!!!!!!!!!!. % 93.33 success... % 6.66 packet loss...... (1 Reply)
Discussion started by: gokcell
1 Replies

7. AIX

Enable SMT

How to enable SMT in aix 5.2 ml 9? If i run smtctl it gives error ksh: smtctl: not found. please tell me if SMT is supported in 5.2 (4 Replies)
Discussion started by: vjm
4 Replies

8. AIX

How to enable XDMCP?

Hello everyone, I installed AIX the other day (several times!) but I can't get XDMCP to work. I remember from when I installed it the last time it worked out of the box. So why doesn't it work now? This is the error message I get: XDMCP fatal error: Session failed Session 2 failed for... (3 Replies)
Discussion started by: Kotzkroete
3 Replies

9. Linux

How to enable Hibernate

Hi, I want to enable hibernate in my machine. when i click hibernate option, it is throwing message that hibernate is not enabled in kernel. earlier, i was hibernating in the same machine with windows os. any idea ? Thx in advance. Siva (0 Replies)
Discussion started by: Sivaswami
0 Replies

10. Solaris

enable log

dear all i want to enable the below logs can you help me /var/adm/xferlog /var/spool/uucp/.Admin thanx you (0 Replies)
Discussion started by: murad.jaber
0 Replies
Login or Register to Ask a Question