Wednesday, June 21, 2006

Firestarter


I installed Firestarter today, after the whole "Mysterious Download" thing, I got a little paranoid. Now I'm quite a n00b when it comes to networks and stuff. But I managed to get Firestarter running just fine :)

First, I apt-getted firestarter. Then I started it. Then I had to go through the configuration wizard. I didn't understand a word of wtf was going on in the wizard, so I just kept the default options, and kept clicking Next.

The Firestarter window has 3 main tabs. Status, Events and Policy. I figured I had to open the ports that I get incoming connections on. So after fiddling around a little, I clicked on "Policy", (Editing > Inbound traffic policy)

Then I clicked on "Add rule", and added FTP (ports 20-21), since I run an FTP server. Next, I added Samba, (ports 137-139 445). Here I didn't choose the default option of "When Source is Anyone". I wanted only LAN clients to be allowed, but for some reason, that option was grayed out. So I selected "IP, Host or network" and entered the IP 10.10.19. Notice I didn't put the last digits.



Next, I added Bittorrent (ports 6881-6889). And then clicked on "Apply Policy" on the top.

Now I tested my FTP and Samba. Both were working fine. (I'll also get my friend to test these from his computer, just to be sure. This post will be edited if I encounter problems).

Bittorrent: Azureus was using port 21351, which was obviously blocked. So I configured azureus to use port 6889. Then it showed the nice "green" status, and I was happy. :)

I also noticed many connections on Bittorrent ports, even after quitting azureus. I asked some people on the azureus IRC chatroom if this was normal. Yes, they said its normal. It probably happens because the tracker(s) have my IP address, and people try connecting. But since azureus is not running, the connections just get rejected, or something like that.

2 comments:

adamvan2000 said...

I am just wondering whether or not the idea of using the first three sets of digits in the IP address worked for allowing only the LAN clients to access Samba over the network? I am in a similar situation myself and really don't want to open Samba shares to everyone and anyone.

Aku said...

Yes. As far as I remember that is exactly why I had done that. And it had worked.