Re: Which ports for http?

Patrick Benson
Sun, 25 Jan 2004 12:01:09 -0000

the_activ@activ.dhs.org wrote:
>
> I''m trying to make my shorewall only allow access to http.
> So I made a default reject policy and rules to allow port 80 and 443
> outgoing. Now I know http uses other ports but I have no clue which ports
> I also need to open.
> Sorry for my ignorance but please help me, I tried lot''s and got
nowhere.

Sounds like you want to only allow http through your firewall, coming
from your subnet, rejecting all else. If your policy''s file looks like
this:

#SOURCE         DEST            POLICY          LOG LEVEL
LIMIT:BURST
loc             net             DROP
# If you want open access to the Internet from your Firewall
# remove the comment from the following line.
#fw             net             ACCEPT
net             all             DROP            ULOG
all             all             REJECT          ULOG
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

and your rules file like this:

ACCEPT          loc       net            tcp     80
ACCEPT          loc       net            tcp     443

should be no problem, since reply packets coming in, at your own request
by adding those ACCEPT rules, will be allowed through automatically.




--
Patrick Benson
Stockholm, Sweden