AMule Project FAQ - User contributions [en]

Talk:Firewall

2005-06-16T23:52:33Z

24.215.161.51:

I think that think page should also contain basic Linksys and Dlink router information since you're also trying to attract windows users.
[[User:Ateo|-- Juan]] 21:28, 27 May 2005 (CEST)

'''Yap. fine now, who's gonna provide that info? ;-P'''

I'll add linksys information soon. Anyone with a DLink router should also contribute.. =) [[User:Ateo|-- Juan]] 19:41, 28 May 2005 (CEST)

Um. I thought the == before and after a section automatically creates a menu for the page? Am I wrong?

'''You're not. But only if there are at least four == sections in the article. Otherwise no menu will be created'''

I just threw some D-Link info in there, based on what I did on my DI-624 to get aMule to show High ID. I have to admit though that I don't quite get how the Applications page settings relate to the port forwarding in Virtual Servers, unless you do an entry in Virtual Servers for each port in the 4662-4672 range for UDP. Any thoughts? -Sharakan

Firewall

2005-06-16T23:50:32Z

24.215.161.51:

<center>'''English''' | [[Firewall-es|Español]] | [[Firewall-de|Deutsche]] </center>

== Distro specific guides ==

*'''[http://www.suse.com SuSE Linux]''' users try [[Firewall_SuSE|this HowTo]] first.
*'''[http://fedora.redhat.com Fedora Core]''' users try [[Firewall_Fedora|this HowTo]] first.

== IPTables Configuration ==

If you set [http://www.ietf.org/rfc/rfc793.txt TCP] port in [[aMule]] to XX and [http://www.faqs.org/rfcs/rfc768.html UDP] port to YY then you have to set your firewall like this:

''iptables -A INPUT -p tcp --dport '''XX''' -j ACCEPT'' 
''iptables -A INPUT -p udp --dport '''XX+3''' -j ACCEPT'' 
''iptables -A INPUT -p udp --dport '''YY''' -j ACCEPT'' 

If you are building your iptables-rules from scratch, you also need to allow ''ESTABLISHED'' and ''RELATED'' traffic to come through your firewall:

''iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT''

And you must enable traffic to leave your machine aswell, by either allowing all outgoing traffic:

''iptables -P OUTPUT ACCEPT''

or specifying special rules.

'''NOTE:''' for [http://www.mandrake.com Mandrake] 10.0 Official and [http://www.iptables.org iptables] you may have to change the multi-port entry to ''iptables -A INPUT -p udp --dport '''XX:ZZ''' -j ACCEPT'' where ''XX'' is the same [http://www.ietf.org/rfc/rfc793.txt TCP] port number used in first line and ''ZZ'' is that number plus 3 (eg: ''4662:4665'')

If you want to setup [[aMule]] behind a NAT gateway, you should add these lines to your [http://www.netfilter.org iptables] configuration script, on the gateway :

''EXTIF'' is your external interface

''EMULEPORT='''4662''''' 
''EMULEUDP='''4672''''' 
''EMULEUDP2=`expr $EMULEPORT + 3`'' 
''EMULEHOST='''10.0.0.2''''' 
''iptables -t nat -A PREROUTING -i $EXTIF -p tcp --destination-port $EMULEPORT -j DNAT --to-destination $EMULEHOST:$EMULEPORT'' 
''iptables -t nat -A PREROUTING -i $EXTIF -p udp --destination-port $EMULEUDP -j DNAT --to-destination $EMULEHOST:$EMULEUDP'' 
''iptables -t nat -A PREROUTING -i $EXTIF -p udp --destination-port $EMULEUDP2 -j DNAT --to-destination $EMULEHOST:$EMULEUDP2''

You also should make sure that your FORWARD-string is set up correctly. Usually, you will have an entry like this:

''iptables -A FORWARD -i $EXTIF -o $INTIF -d $EMULEHOST -m state --state ESTABLISHED,RELATED -j ACCEPT''

where ''INTIF'' is your internal interface and ''EMULEHOST'' is the host running the [[FAQ_eD2k-Kademlia#What_is_ED2K?|eD2k]] [[server]] on your internal network.

This will prevent new connections. So, you should allow all forwarding for [[aMule]]-related ports:

''iptables -A FORWARD -i $EXTIF -o $INTIF -p tcp --dport $EMULEPORT -d $EMULEHOST -j ACCEPT'' 
''iptables -A FORWARD -i $EXTIF -o $INTIF -p udp --dport $EMULEUDP -d $EMULEHOST -j ACCEPT'' 
''iptables -A FORWARD -i $EXTIF -o $INTIF -p udp --dport $EMULEUDP2 -d $EMULEHOST -j ACCEPT'' 

Once everything is set, you can check [http://www.amule.org/testport.php here] if your ports are now open.

== [http://www.linksys.com Linksys] Router configuration ==

This portion of the wiki applies only to stock versions of the [http://www.linksys.com Linksys] firmware. If you are using a [http://www.linksys.com Linksys] router running a variant of the [http://www.linksys.com/support/gpl.asp GPL Code], please follow the guides directly above as you are most likely using iptables.

Log into your [http://www.linksys.com Linksys] router. After successfully logging in, click on the main menu link labeled '''Applications & Gaming''' after which you should see an additional submenu list for this section. Make sure you are under the correct submenu by clicking '''Port Range Forwarding'''.

At this point, you should see a table with 6 columns. The columns are: ''Application'', ''Start to'', ''End'', ''Protocol'', ''IP Address'', ''Enable''.

'''The Application column''' 
Friendly name for the service. Put anything you want here, [[aMule]] being suggested.

'''The Start to -> End column''' 
Start and end ports. '''Start to''' should be ''4662'' but, in the end, this should reflect whatever port you have defined in [[aMule]] ''Preferences'' -> ''Connection'' -> ''Client TCP Port''. '''End''' should be ''4672'' but, in the end, this should reflect whatever port you have defined in [[aMule]] ''Preferences'' -> ''Connection'' -> ''eMule extended UDP Port''.

I suggest using 2 separate entries for each port unless this is not possible.

'''The Protocol column''' 
Protocol to listen for. If you use one line to open your [[aMule]] ports, set this option to '''Both'''. If you use a separate entry line for each, select option '''TCP''' for [[FAQ_ed2k#What_does_each_port_do?|Client TCP Port]] and option '''UDP''' for [[eMule]] [[FAQ_ed2k#What_does_each_port_do?|extended UDP Port]].

'''The IP Address column''' 
Internal [[IP|IP address]] to forward requests to. This is typically the internal (private) [[IP|IP address]] of the computer that will use [[aMule]].

'''The Enable column''' 
Enable rule. You'll need to check this in order to enable your [[aMule]] rules.

After adding your rule, make sure you save your settings. You can verify whether your rules work by [http://www.amule.org/testport.php testing your ports].

== [http://www.dlink.com DLink] Router configuration ==

Log in to your [http://www.dlink.com DLink] router. There are three steps to take to enable your aMule ports.

'''IP Address setup'''

In the Home tab, click the DHCP button. This page displays the current IP addresses assigned by the router, both static and dynamic. Look for the name or MAC address of the computer you'll be running aMule on. If your computer is receiving dynamically assigned IP addresses, you will have to change your settings every so often if your IP address changes. To avoid this, use the Static DHCP section, and perform the following steps:

- Name: Type in the name of your computer here, could be anything 
- IP: The IP address you want the router to always assign to your computer 
- MAC Address: The MAC address of your computer. You should be already connected to the router, so you can find your computer in the DHCP Client drop-down menu, and click clone, to populate this number. 
- Click Apply 

Now your computer will always receive the same IP address.

Now click on the Advanced tab, and there are two areas that need to be updated:

'''Virtual Server''' 
Click the Virtual Server button. This page forwards external requests to a specific internal IP address in your network.

- Click 'Enabled' 
- Enter a name in the Name entry box, eg 'aMule TCP' 
- Enter your static IP address in the Private IP box 
- Select TCP in Protocol type 
- Private port is the port that the router will forward the requests to on your computer. This can be anything, a good value is the default aMule TCP port, 4662. 
- Public port is the port that the router will receive requests on. Again, a good value is the aMule TCP port of 4662. 
- Schedule is the times at which the port is open. Select Always, or whatever times you wish. 
- Click Apply 

'''Applications''' 
Click the Applications button. This page allows you to enter a range of ports to open for application usage.

- Click 'Enabled' 
- Enter the TCP port in the first Trigger Port box, a good value being 4662. 
- Select Trigger Type as TCP 
- In Public Port, enter the range from your aMule TCP port to your aMule UDP port, usually 4662-4672. 
- Select UDP as the Public Type. 
- Click Apply.

You should now be all set, assuming that your computer firewall is setup to allow access on the selected ports.

Firewall

2005-06-16T23:49:50Z

24.215.161.51:

<center>'''English''' | [[Firewall-es|Español]] | [[Firewall-de|Deutsche]] </center>

== Distro specific guides ==

*'''[http://www.suse.com SuSE Linux]''' users try [[Firewall_SuSE|this HowTo]] first.
*'''[http://fedora.redhat.com Fedora Core]''' users try [[Firewall_Fedora|this HowTo]] first.

== IPTables Configuration ==

If you set [http://www.ietf.org/rfc/rfc793.txt TCP] port in [[aMule]] to XX and [http://www.faqs.org/rfcs/rfc768.html UDP] port to YY then you have to set your firewall like this:

''iptables -A INPUT -p tcp --dport '''XX''' -j ACCEPT'' 
''iptables -A INPUT -p udp --dport '''XX+3''' -j ACCEPT'' 
''iptables -A INPUT -p udp --dport '''YY''' -j ACCEPT'' 

If you are building your iptables-rules from scratch, you also need to allow ''ESTABLISHED'' and ''RELATED'' traffic to come through your firewall:

''iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT''

And you must enable traffic to leave your machine aswell, by either allowing all outgoing traffic:

''iptables -P OUTPUT ACCEPT''

or specifying special rules.

'''NOTE:''' for [http://www.mandrake.com Mandrake] 10.0 Official and [http://www.iptables.org iptables] you may have to change the multi-port entry to ''iptables -A INPUT -p udp --dport '''XX:ZZ''' -j ACCEPT'' where ''XX'' is the same [http://www.ietf.org/rfc/rfc793.txt TCP] port number used in first line and ''ZZ'' is that number plus 3 (eg: ''4662:4665'')

If you want to setup [[aMule]] behind a NAT gateway, you should add these lines to your [http://www.netfilter.org iptables] configuration script, on the gateway :

''EXTIF'' is your external interface

''EMULEPORT='''4662''''' 
''EMULEUDP='''4672''''' 
''EMULEUDP2=`expr $EMULEPORT + 3`'' 
''EMULEHOST='''10.0.0.2''''' 
''iptables -t nat -A PREROUTING -i $EXTIF -p tcp --destination-port $EMULEPORT -j DNAT --to-destination $EMULEHOST:$EMULEPORT'' 
''iptables -t nat -A PREROUTING -i $EXTIF -p udp --destination-port $EMULEUDP -j DNAT --to-destination $EMULEHOST:$EMULEUDP'' 
''iptables -t nat -A PREROUTING -i $EXTIF -p udp --destination-port $EMULEUDP2 -j DNAT --to-destination $EMULEHOST:$EMULEUDP2''

You also should make sure that your FORWARD-string is set up correctly. Usually, you will have an entry like this:

''iptables -A FORWARD -i $EXTIF -o $INTIF -d $EMULEHOST -m state --state ESTABLISHED,RELATED -j ACCEPT''

where ''INTIF'' is your internal interface and ''EMULEHOST'' is the host running the [[FAQ_eD2k-Kademlia#What_is_ED2K?|eD2k]] [[server]] on your internal network.

This will prevent new connections. So, you should allow all forwarding for [[aMule]]-related ports:

''iptables -A FORWARD -i $EXTIF -o $INTIF -p tcp --dport $EMULEPORT -d $EMULEHOST -j ACCEPT'' 
''iptables -A FORWARD -i $EXTIF -o $INTIF -p udp --dport $EMULEUDP -d $EMULEHOST -j ACCEPT'' 
''iptables -A FORWARD -i $EXTIF -o $INTIF -p udp --dport $EMULEUDP2 -d $EMULEHOST -j ACCEPT'' 

Once everything is set, you can check [http://www.amule.org/testport.php here] if your ports are now open.

== [http://www.linksys.com Linksys] Router configuration ==

This portion of the wiki applies only to stock versions of the [http://www.linksys.com Linksys] firmware. If you are using a [http://www.linksys.com Linksys] router running a variant of the [http://www.linksys.com/support/gpl.asp GPL Code], please follow the guides directly above as you are most likely using iptables.

Log into your [http://www.linksys.com Linksys] router. After successfully logging in, click on the main menu link labeled '''Applications & Gaming''' after which you should see an additional submenu list for this section. Make sure you are under the correct submenu by clicking '''Port Range Forwarding'''.

At this point, you should see a table with 6 columns. The columns are: ''Application'', ''Start to'', ''End'', ''Protocol'', ''IP Address'', ''Enable''.

'''The Application column''' 
Friendly name for the service. Put anything you want here, [[aMule]] being suggested.

'''The Start to -> End column''' 
Start and end ports. '''Start to''' should be ''4662'' but, in the end, this should reflect whatever port you have defined in [[aMule]] ''Preferences'' -> ''Connection'' -> ''Client TCP Port''. '''End''' should be ''4672'' but, in the end, this should reflect whatever port you have defined in [[aMule]] ''Preferences'' -> ''Connection'' -> ''eMule extended UDP Port''.

I suggest using 2 separate entries for each port unless this is not possible.

'''The Protocol column''' 
Protocol to listen for. If you use one line to open your [[aMule]] ports, set this option to '''Both'''. If you use a separate entry line for each, select option '''TCP''' for [[FAQ_ed2k#What_does_each_port_do?|Client TCP Port]] and option '''UDP''' for [[eMule]] [[FAQ_ed2k#What_does_each_port_do?|extended UDP Port]].

'''The IP Address column''' 
Internal [[IP|IP address]] to forward requests to. This is typically the internal (private) [[IP|IP address]] of the computer that will use [[aMule]].

'''The Enable column''' 
Enable rule. You'll need to check this in order to enable your [[aMule]] rules.

After adding your rule, make sure you save your settings. You can verify whether your rules work by [http://www.amule.org/testport.php testing your ports].

== [http://www.dlink.com DLink] Router configuration ==

Information on configuring a [http://www.dlink.com DLink] router for [[aMule]] coming soon. Anyone with a [http://www.dlink.com DLink] router is encouraged to edit this article.

(These instructions are based on my DI-624 wireless router, I imagine most of the other recent D-Link routers are similar, but update if that's not true!)

Log in to your [http://www.dlink.com DLink] router. There are three steps to take to enable your aMule ports.

'''IP Address setup'''

In the Home tab, click the DHCP button. This page displays the current IP addresses assigned by the router, both static and dynamic. Look for the name or MAC address of the computer you'll be running aMule on. If your computer is receiving dynamically assigned IP addresses, you will have to change your settings every so often if your IP address changes. To avoid this, use the Static DHCP section, and perform the following steps:

- Name: Type in the name of your computer here, could be anything 
- IP: The IP address you want the router to always assign to your computer 
- MAC Address: The MAC address of your computer. You should be already connected to the router, so you can find your computer in the DHCP Client drop-down menu, and click clone, to populate this number. 
- Click Apply 

Now your computer will always receive the same IP address.

Now click on the Advanced tab, and there are two areas that need to be updated:

'''Virtual Server''' 
Click the Virtual Server button. This page forwards external requests to a specific internal IP address in your network.

- Click 'Enabled' 
- Enter a name in the Name entry box, eg 'aMule TCP' 
- Enter your static IP address in the Private IP box 
- Select TCP in Protocol type 
- Private port is the port that the router will forward the requests to on your computer. This can be anything, a good value is the default aMule TCP port, 4662. 
- Public port is the port that the router will receive requests on. Again, a good value is the aMule TCP port of 4662. 
- Schedule is the times at which the port is open. Select Always, or whatever times you wish. 
- Click Apply 

'''Applications''' 
Click the Applications button. This page allows you to enter a range of ports to open for application usage.

- Click 'Enabled' 
- Enter the TCP port in the first Trigger Port box, a good value being 4662. 
- Select Trigger Type as TCP 
- In Public Port, enter the range from your aMule TCP port to your aMule UDP port, usually 4662-4672. 
- Select UDP as the Public Type. 
- Click Apply.

You should now be all set, assuming that your computer firewall is setup to allow access on the selected ports.