LINUX LIGHTS

If you want your machine to respond to requests initiated from elsewhere on the internet, in effect to be a server, you need to open the required ports. To do this properly, you need to know:

1. What service you want to open up?
2. Whether it is a tcp or udp service?
3. What port number(s) it uses?

You may also wish to think about restricting access to certain machines; e.g. if you only want people in the X dept to access the machine.

For example, to enable ssh access to your box from anywhere on campus, you could use something like

iptables -A allowed -p tcp --dport 22 -s 129.2.0.0/16 -j ACCEPT
iptables -A allowed -p udp --dport 22 -s 129.2.0.0/16 -j ACCEPT

iptables -A allowed -p tcp --dport 22 -s 128.8.0.0/16 -j ACCEPT
iptables -A allowed -p udp --dport 22 -s 128.8.0.0/16 -j ACCEPT

This allows both udp and tcp traffic from either of the two class B networks to access port 22 on your machine. Of course, you need to have an sshd daemon running as well for this to work; the code above merely punches the required holes in the firewall.

msn messenger user port 1863
yahoo messenger uses 5000,5010 and 5050

To block AOL IM and ICQ:

# iptables -A FORWARD –dport 5190 -j DROP
# iptables -A FORWARD -d login.oscar.aol.com -j DROP

To block MSN messenger:

# iptables -A FORWARD -p TCP –dport 1863 -j DROP
# iptables -A FORWARD -d 64.4.13.0/24 -j DROP

To block Yahoo messenger:

# iptables -A FORWARD -p TCP –dport 5000:5010 -j REJECT
# iptables -A FORWARD -d cs.yahoo.com -j REJECT
# iptables -A FORWARD -b scsa.yahoo.com -j REJECT

Note that this will only block clients on the computer itself. If you are using the computer as a router with NAT, you will want to use “-t nat -A PREROUTING” instead.