5. Step Four

Oh yeah, for people who have asked me questions on whether to REJECT or DENY, here is a basic answer:

When you REJECT something, you send a polite ICMP unreachable packet to the sender.
When you DENY something, you drop the offending packet, without giving notice to the sender, which is good because then they will think your host does not exist (from a first glance).

5.1 Installing PMFirewall

Go to the directory where you downloaded the latest version of pmfirewall.

mv pmfirewall* /tmp

Go through the installation script and set it up to suit your needs. If you have any questions, I have a logfile that you can look at while you are installing. Some of the entries the logfile I added in, but I went into the pmfirewall.rules.local file and # (commented) them out.. they are there just because 'for instance' if you were to want to add something later, and unsure, it's going to be in the file, and you can just edit it. Editing something is ten times easier than making something new, especially if you are unfamiliar with IPCHAINS.

For convenience sake, type:

cp /usr/local/pmfirewall/pmfirewall /usr/bin

This will allow you to type pmfirewall stop:start:restart from anywhere.

5.2 Running PMFirewall

5.2.5 Messed anything up?

pmfirewall (to copy to /usr/local/pmfirewall, or where you had pmfirewall installed)

pmfirewall.conf (to copy to /usr/local/pmfirewall, or where you had pmfirewall installed)

pmfirewall.rules.local (to copy to /usr/local/pmfirewall, or where you had pmfirewall installed)

5.3 Additional Tips, Tricks, and Solutions

Thanks to Gaccm for informing me that if you have pppoe dsl (he's only tested with rp-pppoe, so he doesn't know if anything else causes problems) then you need to change a line in your pmfirewall.conf:

change the OUTERIF=eth0 to OUTERIF=ppp0

Option 1:

/sbin/ipchains -A input -i $OUTERIF -p tcp -s any/0 1024:65535 -d $OUTERIP 6699 -j ACCEPT
/sbin/ipchains -A output -i $OUTERIF -p tcp -s $OUTERIP 1024:65535 -d any/0 1024:65535 -j ACCEPT

Option 2:

Okay, here's another workaround.. it seems to work excellent download this file (ipmasqadm-0.4.2-4.i386.rpm) first.

Install ipmasqadm:

load up your favorite editor (I use pico just because it's fast and easy)

and add these lines:

Restart pmfirewall (pmfirewall restart), and go disconnect/reconnect to napster on your windows box, and it should work a *lot* better! I have been told that newer versions of Napster (beta 6 and up) basically find any acceptable port on its own, but just like I remind my brother, who keeps complaining to me, "Napster doesn't work!" - We are configured properly, but they aren't - there could be a lot of reasons, but one of the main reasons would probably be that the other end-user is behind a firewall who does not allow Napster traffic.

#
#-----INCOMING-------
#
#echo reply (pong)
$IPCHAINS -A input  -p icmp --icmp-type  0 -j ACCEPT
#destination unreachable
$IPCHAINS -A input  -p icmp --icmp-type  3 -j ACCEPT
#source quench
$IPCHAINS -A input  -p icmp --icmp-type  4 -j ACCEPT
#time to live (TTL) for traceroute
$IPCHAINS -A input  -p icmp --icmp-type 11 -j ACCEPT
#now deny all other INCOMING icmp packets
$IPCHAINS -A input  -p icmp -j DENY -l
#
#-----OUTGOING------
#
#destination unreachable
$IPCHAINS -A output -p icmp --icmp-type  3 -j ACCEPT
#source quench
$IPCHAINS -A output -p icmp --icmp-type  4 -j ACCEPT
#echo request (ping)
$IPCHAINS -A output -p icmp --icmp-type  8 -j ACCEPT
#now deny all other OUTGOING icmp packets
$IPCHAINS -A output -p icmp -j DENY -l

Install ipmasqadm:

load up your favorite editor (I use pico just because it's fast and easy)

and add these lines (note, you can use this same syntax in ANY firewall script!):

Allowing Diablo II through with ipmasqadm (thanks to Taylor)

First go back here to see how to install ipmasqadm if you don't have it and how to use it through your firewall scripts.

If you have anything else that you have done to get any programs, games, or hardware (such as Cable Modems, DSL, etc) working through your firewall using IPCHAINS, please email me and I will update this page with your information provided.