gmane.comp.security.firewalls.efw.user

2.2RC3 Remote logging not working ?

Steph — 2008-12-01T10:14:43

Hi, I'm using EFW 2.2 RC3 Remote logging with Kiwi syslog installed on my workstation. Work nice in previous versions of EFW Do you have same problem ? no log from EFW ! Regards Stephane Bonjour, J'utilise actuellement EFW 2.2 RC3 avec Kiwi syslog installé sur mon poste de travail. Cela fonctionnait parfaitement sur les versions précédentes de EFW avez vous le meme probleme ? aucun log n'est envoyé depuis EFW ! ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/_______________________________________________ Efw-user mailing list Efw-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org https://lists.sourceforge.net/lists/listinfo/efw-user

Best rules to use to prevent

Chris — 2008-11-30T20:58:13

I am sorry if the following questions looks obvious, but I am new to endian/IPcop, and not familiar with the Firewall component. I had a private nntp server in the past, which is inactive now, but I still have users trying to connect to it. So my firewall logs are full of: INPUT:DROP ppp0 KEY_TCP client_ip client_port ... my_public_ip 119 Beside that, on my green network, I have an openfiler appliance, wich generate a lots of logs like this: INPUTFW:DROP br0 KEY_UDP 172.16.0.22 138 somemac 172.16.0.255 138 INPUTFW:DROP br0 KEY_UDP 172.16.0.22 137 somemac 172.16.0.255 137 Which should be the best Firewall rules to implement to hide these logs ?? Optional question: Which files should I edit to clean up the logs to have something readeable and making real alerts more visible ? Beside that, I have a PPPoE connection, a modem with 1.1.1.2/24 address, my red eth1 have 1.1.1.1/24 address. I can connect to the modem from the efw itself. If I try to connect from the green network, I have the follow

Re: connecting to a PPPoE adsl modem.

Chris — 2008-11-30T20:49:59

Hi, I managed the first step of a good workaround. I just added an extra ip address "1.1.1.2/24" to my adsl modem, and now I am able to connect using telnet from the endian virtual server ! I just have now issues with firewall rules, but I have many questions on that so I am starting a new thread. Chris explained : ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/

2 Networks, 2-3 WAN Links, and a WiFi AP (Orange)

orty — 2008-11-30T19:37:33

OK, I have a couple endian firewalls running 2.2RC3, so I am familiar with things a bit, but would still consider myself a newbie sometimes. I wanted to throw this out there just to see if there are any pitfalls or gotchas (and note that I inherited this config, and am hoping to fix some of it). Basically, I work at an office that has two separate companies that are sharing the same internet connection. Currently, they have a Cisco router that's plugged into a T1 line, that's then split into two consumer firewalls (a sonicwall and a linksys router with dd-wrt on it). The T1 router has two public IP addresses, and each firewall for each company is configured for one of them. The WAN card on the T1 router died over the weekend, and I was running things over a backup DSL line here in the office (as they run a bunch of web-based apps here in our office, so they need Web access as much as possible). That DSL line is generally used for a public access WiFi hot spot, plugged into a ZoneCD (www.publicip.net) serve

Re: Speed problems between Orange/Green (SNORT)

Vassilis — 2008-11-30T18:45:40

I did some further testing with netIO, here are a few numbers: Within the Green network I get speeds of up to 110.100 KB/s. Within the Orange network I get max speeds of 113.200 KB/s. From Green to Orange network with snort active 2.900 KB/s. From Green to Orange network with snort deactivated 43.520 KB/s. I checked the system monitor for unusual high usage of HDD or CPU but didnt find anything. The CPU never spiked over 80% and the HDD also didnt show any unusual high activity. I understand that having a firewall between the Orange and Green network will reduce the speed, but I didnt expect it to be reduced by over 50%. 43.520 KB/s from Green to Orange is something I can live with but I would rather keep snort activated. Anyone has some tips why snort has such a huge effect on the speed? Vassilis: ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications w

Re: Re boot / Shutdown problems

Scott Silva — 2008-11-29T22:28:58

------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/_______________________________________________ Efw-user mailing list Efw-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org https://lists.sourceforge.net/lists/listinfo/efw-user

Speed problems between Orange/Green (SNORT)

Vassilis — 2008-11-28T22:10:36

Hello all! I am having speed problems when I connect to my orange server through my green workstation. FTP aswell as Netio gives me a top speed of 2MB/s when I connect through the endian box, but when I connect directly the orange server to the workstation (crossed cable), Netio gives me speeds of up to 100MB/S. To make a long story short, I tried every situation to find the problem and found out that the problem lies within endian and specificly with the intrusion detection system (snort). As soon as I disable snort, my speed goes up to 40MB/s and when I activate it, the speed goes down to 2MB/s. Is that normal? Is there any way to have snort activated and keep a high speed between my orange and green network? I am using Endian 2.2 RC3, all NICs are Gigabit. Thank you! ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prize

Backup Link - Notify - Endian 2.2RC3

Julio Cesar — 2008-11-28T19:19:29

Clamav 0.94.2 posted

Mike Tremaine — 2008-11-28T16:20:09

I posted rpms for EFW 2.0 and EFW 2.2 those interested. -Mike ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/

Re: Re boot / Shutdown problems

Guymon — 2008-11-28T15:58:48

FYI: I determined that my Power supply was not adequate enough when the CPU was being maxed out. I noticed watching "top" that havp (HTTP Antivirus Proxy) was doing all the possessing when he was on this game. I went into EFW (proxy/http/antivirus) and put in the url into "Do not scan the following URL's:" that was being accessed & turned "Max. content scan size (MB):" down to 10 megs (not sure if that really matters on this game). Also I turn off caching (proxy/http/Cache management/) for this url. Now the CPU is not maxing out when he is playing that game. I will upgrade the power supply here soon after I put in a bigger CPU. It's nice to know EFW has the ability to be tuned to keep CPU usage down. Guymon wrote:

Re: EFW proxy : Issue with a number of websites as wellasMedia center guide downloads

compdoc — 2008-11-27T19:15:45

EFW proxy : Issue with a number of websites as well asMedia center guide downloads

2008-11-27T18:56:26

Re: Block IP from RED Interface

Guymon — 2008-11-27T00:03:29

iptables -L

Re: Block IP from RED Interface

danodemano — 2008-11-26T23:56:54

This appears to have worked though I can't for the life of me remember the comment to list out all the iptables rules. :/ < at >compdoc: Yes, I know this to be true, though it's better than nothing. My little NAS works VERY hard with a number of things and any little bit I can do to keep it running smoothly for me is a plus. SPAM is impossible to block though....I will give you that one. Guymon wrote:

Re: Block IP from RED Interface

compdoc — 2008-11-26T22:37:56

That would stop one ip address. But what happens if they are using a dynamic ip, or some other kid finds you? It's an unending battle... I once thought blocking ip addresses of spammers was a solution. I blocked entire ranges of addresses. Of course, it wasn't a solution at all... -----Original Message----- From: danodemano [mailto:danodemano-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org] Sent: Wednesday, November 26, 2008 12:35 PM To: efw-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org Subject: Re: [Efw-user] Block IP from RED Interface I will give that a shot when I get home from work and let you know how it turns out. Thanks for the help!! ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/

Re: Re boot / Shutdown problems

Guymon — 2008-11-26T20:52:08

I still think the CPU is OK. I have ordered 2 1000mhz PIII to replace it(in case), I have a slot for a second CPU so I will use it(my have to do a reinstall of EWF). I don't think it's a capacitor issue, I know what to look for in that, but it could be the power supply is underpowered. When I built the system I tried to go light on the wattage usage so maybe this "Game" is taxing the CPU enough that it AWKS the power supply, makes sence. I have a nice 80% efficient NEW PS I will plop in after I get the new CPUs and see if that helps. I'd hate to have to replace this hardware it's such a sweet little set up.

Re: Re boot / Shutdown problems

Scott Silva — 2008-11-26T20:34:29

Re: Block IP from RED Interface

danodemano — 2008-11-26T19:34:59

I will give that a shot when I get home from work and let you know how it turns out. Thanks for the help!! Guymon wrote:

Re: Re boot / Shutdown problems

Guymon — 2008-11-26T19:26:17

I'll do a memtest tomorrow or this week-end when I can take the servers off line. The Firewall is really not that old, the power supply is only a few years old. The power supply might be getting overloaded, maybe that is the problem, I can swap it out for a bigger one and have my son run his game and see if that works.

Re: Re boot / Shutdown problems

compdoc — 2008-11-26T19:19:41

A system that old could have hardware problems. Bad capacitors is very common, and I replace a lot of boards and power supplies for this reason. Look here to see what to look for. The motherboard is easy to check, but the power supply has to be opened to inspect: http://en.wikipedia.org/wiki/Capacitor_plague (click on the pics to see close up) Also, might be a good idea to download memtest86+ and run it through a couple of passes... ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/

Re: Block IP from RED Interface

Guymon — 2008-11-26T19:01:25

Hmmm you might try vi /etc/init.d/rc.local insert ( i ) TYPE BELOW #! /bin/sh ### Write a comment and date it for future reference #### iptables -A INPUT -p ALL -s 25.55.55.55 -j DROP NOW then hit ESC :wq! I'm not and expert so if anyone else has a better answer.