Re: scanning over the network and firewall configuration

Alain Bertrand wrote:
> Rolf Pedersen a écrit :
>> Alain Bertrand wrote:
>>> Hi all,
>>>
>>> I am trying to configure my firewall to allow scanning (as a client) 
>>> over the network.
>>> With guarddog, I have enabled the tcp port 6566.
>>> If the firewall is off, scannig is OK.
>>> If the firewall is on, connection withe the scanner works, I can 
>>> launch the preview but it seems that no data is send back and xsane 
>>> freezes.
>>> If the firewall is configured with firestarter, enabling the  port 
>>> 6566 is enough.
>>> As I prefer guarddog, I would like to know how to configure 
>>> correctly guarddog.
>>>
>>> TIA,
>>>
>>> Alain
>>>
>>>   
>>
>> You could
>>
>> # tail -f /var/log/messages
>>
>> and watch for something relevant when you try scanning.  It might be 
>> necessary to enable logging in guarddog.
>> Rolf
>>
>>
> Jan 16 15:29:48 logodenn kernel: [146018.172000] DROPPED IN= OUT=eth1 
> SRC=192.168.0.2 DST=192.168.0.3 LEN=44 TOS=0x00 PREC=0x00 TTL=64 
> ID=36516 DF PROTO=TCP SPT=3531 DPT=50677 SEQ=382092484 ACK=0 
> WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B4)
> Jan 16 15:30:07 logodenn kernel: [146037.328000] DROPPED IN= OUT=eth1 
> SRC=192.168.0.2 DST=192.168.0.255 LEN=151 TOS=0x00 PREC=0x00 TTL=64 
> ID=0 DF PROTO=UDP SPT=631 DPT=631 LEN=131
> Jan 16 15:30:12 logodenn kernel: [146042.172000] DROPPED IN= OUT=eth1 
> SRC=192.168.0.2 DST=192.168.0.3 LEN=44 TOS=0x00 PREC=0x00 TTL=64 
> ID=36517 DF PROTO=TCP SPT=3531 DPT=50677 SEQ=382092484 ACK=0 
> WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B4)
> Jan 16 15:30:38 logodenn kernel: [146068.348000] DROPPED IN= OUT=eth1 
> SRC=192.168.0.2 DST=192.168.0.255 LEN=151 TOS=0x00 PREC=0x00 TTL=64 
> ID=0 DF PROTO=UDP SPT=631 DPT=631 LEN=131
> Jan 16 15:31:00 logodenn kernel: [146090.172000] DROPPED IN= OUT=eth1 
> SRC=192.168.0.2 DST=192.168.0.3 LEN=44 TOS=0x00 PREC=0x00 TTL=64 
> ID=36518 DF PROTO=TCP SPT=3531 DPT=50677 SEQ=382092484 ACK=0 
> WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B4)
> Jan 16 15:31:09 logodenn kernel: [146099.360000] DROPPED IN= OUT=eth1 
> SRC=192.168.0.2 DST=192.168.0.255 LEN=151 TOS=0x00 PREC=0x00 TTL=64 
> ID=0 DF PROTO=UDP SPT=631 DPT=631 LEN=131
> Jan 16 15:31:40 logodenn kernel: [146130.364000] DROPPED IN= OUT=eth1 
> SRC=192.168.0.2 DST=192.168.0.255 LEN=151 TOS=0x00 PREC=0x00 TTL=64 
> ID=0 DF PROTO=UDP SPT=631 DPT=631 LEN=131
>
> 192.168.0.2 is my computer (I got an eth0 wich is *not* configured)
> 192.168.0.3 is the scanner server.
>
> In the advanced tab, I have defined a saned protocol with TCP type and 
> port 6566 to 6566. This protocol is accepted both in the local and 
> internet zone.
>
> Regards,
>
> Alain

I don't know networking but have been playing around, a little, with 
firewall concerns.

If you didn't know, PROTO is protocol, SPT is source port, DPT is 
destination port, etc.

You might want to set up a zone with the IP of the sane server and set 
your rules wrt, not the entire internet.  I think it is better to allow 
services from the server to your machine, whether internet or other 
zone, not to be a server to other zones, as this machine is not a 
server.  Port 631 is the internet printing protocol, used also by CUPS, 
it has a pre-configured checkbox in guarddog, and you might want to 
enable that from the server to you.  Although the port specified doesn't 
make sense to me, like I said, I don't know networking.  You could try 
enabling the other port(s) mentioned between you and the server IP in 
the zone made for the sane server.  If you get it to work, it might be a 
good idea to uncheck the other ports as much as possible to reduce 
vulnerability.
Rolf

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Guarddog-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/guarddog-user