Firewall

2006-11-08T23:05:51Z

85.206.198.14:

<center>'''English''' | [[Firewall-es|Español]] | [[Firewall-de|Deutsche]] </center>

== Firewalls ==

=== SuSE ===

'''[http://www.suse.com SuSE Linux]''' users try [[Firewall_SuSE|this HowTo]].

=== RedHat / Fedora Core ===

'''[http://fedora.redhat.com RedHat / Fedora Core]''' users try [[Firewall_Fedora|this HowTo]].

=== IPTables Configuration ===

If you set [http://www.ietf.org/rfc/rfc793.txt TCP] port in [[aMule]] to XX and [http://www.faqs.org/rfcs/rfc768.html UDP] port to YY then you have to set your firewall like this:

''iptables -A INPUT -p tcp --dport '''XX''' -j ACCEPT'' 
''iptables -A INPUT -p udp --dport '''XX+3''' -j ACCEPT'' 
''iptables -A INPUT -p udp --dport '''YY''' -j ACCEPT'' 

If you are building your iptables-rules from scratch, you also need to allow ''ESTABLISHED'' and ''RELATED'' traffic to come through your firewall:

''iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT''

And you must enable traffic to leave your machine aswell, by either allowing all outgoing traffic:

''iptables -P OUTPUT ACCEPT''

or specifying special rules.

'''NOTE:''' for [http://www.mandrake.com Mandrake] 10.0 Official and [http://www.iptables.org iptables] you may have to change the multi-port entry to ''iptables -A INPUT -p udp --dport '''XX:ZZ''' -j ACCEPT'' where ''XX'' is the same [http://www.ietf.org/rfc/rfc793.txt TCP] port number used in first line and ''ZZ'' is that number plus 3 (eg: ''4662:4665'')

If you want to setup [[aMule]] behind a NAT gateway, you should add these lines to your [http://www.netfilter.org iptables] configuration script, on the gateway :

''EXTIF'' is your external interface

''EMULEPORT='''4662''''' 
''EMULEUDP='''4672''''' 
''EMULEUDP2=`expr $EMULEPORT + 3`'' 
''EMULEHOST='''10.0.0.2''''' 
''iptables -t nat -A PREROUTING -i $EXTIF -p tcp --destination-port $EMULEPORT -j DNAT --to-destination $EMULEHOST:$EMULEPORT'' 
''iptables -t nat -A PREROUTING -i $EXTIF -p udp --destination-port $EMULEUDP -j DNAT --to-destination $EMULEHOST:$EMULEUDP'' 
''iptables -t nat -A PREROUTING -i $EXTIF -p udp --destination-port $EMULEUDP2 -j DNAT --to-destination $EMULEHOST:$EMULEUDP2''

You also should make sure that your FORWARD-string is set up correctly. Usually, you will have an entry like this:

''iptables -A FORWARD -i $EXTIF -o $INTIF -d $EMULEHOST -m state --state ESTABLISHED,RELATED -j ACCEPT''

where ''INTIF'' is your internal interface and ''EMULEHOST'' is the host running the [[FAQ_eD2k-Kademlia#What_is_ED2K?|eD2k]] [[server]] on your internal network.

This will prevent new connections. So, you should allow all forwarding for [[aMule]]-related ports:

''iptables -A FORWARD -i $EXTIF -o $INTIF -p tcp --dport $EMULEPORT -d $EMULEHOST -j ACCEPT'' 
''iptables -A FORWARD -i $EXTIF -o $INTIF -p udp --dport $EMULEUDP -d $EMULEHOST -j ACCEPT'' 
''iptables -A FORWARD -i $EXTIF -o $INTIF -p udp --dport $EMULEUDP2 -d $EMULEHOST -j ACCEPT'' 

Once everything is set, you can check [http://www.amule.org/testport.php here] if your ports are now open.

== Routers ==

Here is a list of routers and how to set them up to forward their ports to [[aMule]].

In the descriptions below, examples are using the default ports (that is, ''4662'' for the [[Standard client TCP port]], ''4672'' for the [[Extended client UDP port]] and ''4665'' for the [[Extended server requests UDP port]].

=== Linksys WRT54GSV4 ===

#Open your web browser, ''http://192.168.1.1'' and log into it
#Go under ''Gaming applications''
#Now forward the ports to your computer:
##[[Standard client TCP port]]
###Change both ''Ports start'' and ''End'' to ''4662''
###In the next field set ''TCP''
###In the field, the last 3 digits of your LAN [[IP]]
##[[Extended client UDP port]]
###Change both ''Ports start'' and ''End'' to ''4672''
###In the next field set ''UDP''
###In the field, the last 3 digits of your LAN [[IP]]
##[[Extended server requests UDP port]]
###Change both ''Ports start'' and ''End'' to ''4665''
###In the next field set ''UDP''
###In the field, the last 3 digits of your LAN [[IP]]
#Now check ''Enable''
#And click ''Save settings''
#Then restart aMule :)

''--by '''Diablo69'''''

=== [http://www.linksys.com Linksys] Router configuration ===

This portion of the wiki applies only to stock versions of the [http://www.linksys.com Linksys] firmware. If you are using a [http://www.linksys.com Linksys] router running a variant of the [[GPL]] code, please follow the guides directly above as you are most likely using iptables.

Log into your [http://www.linksys.com Linksys] router. After successfully logging in, click on the main menu link labeled '''Applications & Gaming''' after which you should see an additional submenu list for this section. Make sure you are under the correct submenu by clicking '''Port Range Forwarding'''.

At this point, you should see a table with 6 columns. The columns are: ''Application'', ''Start to'', ''End'', ''Protocol'', ''IP Address'', ''Enable''.

'''The Application column''' 
Friendly name for the service. Put anything you want here, [[aMule]] being suggested.

'''The Start to -> End column''' 
Start and end ports. '''Start to''' should be ''4662'' but, in the end, this should reflect whatever port you have defined in [[aMule]] ''Preferences'' -> ''Connection'' -> ''Client TCP Port''. '''End''' should be ''4672'' but, in the end, this should reflect whatever port you have defined in [[aMule]] ''Preferences'' -> ''Connection'' -> ''eMule extended UDP Port''.

I suggest using 2 separate entries for each port unless this is not possible.

'''The Protocol column''' 
Protocol to listen for. If you use one line to open your [[aMule]] ports, set this option to '''Both'''. If you use a separate entry line for each, select option '''TCP''' for [[FAQ_ed2k#What_does_each_port_do?|Client TCP Port]] and option '''UDP''' for [[eMule]] [[FAQ_ed2k#What_does_each_port_do?|extended UDP Port]].

'''The IP Address column''' 
Internal [[IP|IP address]] to forward requests to. This is typically the internal (private) [[IP|IP address]] of the computer that will use [[aMule]].

'''The Enable column''' 
Enable rule. You'll need to check this in order to enable your [[aMule]] rules.

After adding your rule, make sure you save your settings. You can verify whether your rules work by [http://www.amule.org/testport.php testing your ports].

=== [http://www.dlink.com DLink] Router configuration ===

Log in to your [http://www.dlink.com DLink] router. There are three steps to take to enable your [[aMule]] [[port]]s.

'''IP Address setup'''

In the Home tab, click the DHCP button. This page displays the current [[IP address]]es assigned by the router, both static and dynamic. Look for the name or MAC address of the computer you'll be running [[aMule]] on. If your computer is receiving dynamically assigned [[IP address]]es, you will have to change your settings every so often if your [[IP address]] changes. To avoid this, use the Static DHCP section, and perform the following steps:

*'''Name''': Type in the name of your computer here, could be anything
*'''IP''': The [[IP address]] you want the router to always assign to your computer
*'''MAC Address''': The MAC address of your computer. You should be already connected to the router, so you can find your computer in the ''DHCP Client'' drop-down menu, and click clone, to populate this number
*Click ''Apply''

Now your computer will always receive the same [[IP address]].

Now click on the ''Advanced'' tab, and there are two areas that need to be updated:

'''Virtual Server'''
*Click the ''Virtual Server'' button. This page forwards external requests to a specific internal [[IP address]] in your network
*Click ''Enabled''
*Enter a name in the ''Name'' entry box, eg ''aMule TCP''
*Enter your static [[IP address]] in the ''Private IP'' box
*Select [http://www.ietf.org/rfc/rfc793.txt TCP] in ''Protocol type''
*Private [[port]] is the [[port]] that the router will forward the requests to on your computer. This can be anything, a good value is the default [[aMule]] [http://www.ietf.org/rfc/rfc793.txt TCP] [[port]], ''4662''
*Public [[port]] is the [[port]] that the router will receive requests on. Again, a good value is the [[aMule]] [http://www.ietf.org/rfc/rfc793.txt TCP] [[port]] of ''4662''
*Schedule is the times at which the port is open. Select ''Always'', or whatever times you wish
*Click ''Apply''

'''Applications'''
*Click the ''Applications'' button. This page allows you to enter a range of [[port]]s to open for application usage
*Click ''Enabled''
*Enter the [http://www.ietf.org/rfc/rfc793.txt TCP] [[port]] in the first ''Trigger Port'' box, a good value being ''4662''
*Select ''Trigger Type'' as [http://www.ietf.org/rfc/rfc793.txt TCP]
*In ''Public Port'', enter the range from your [[aMule]] [http://www.ietf.org/rfc/rfc793.txt TCP] [[port]] to your [[aMule]] [http://www.faqs.org/rfcs/rfc768.html UDP] [[port]], usually ''4662''-''4672''
*Select ''UDP'' as the ''Public Type''
*Click ''Apply''

You should now be all set, assuming that your computer firewall is setup to allow access on the selected [[port]]s.

=== Netgear router ===

First, go to your router control page, locate at [http://routerlogin.net/start.htm http://routerlogin.net/start.htm]. Then, on the left side of the screen, under the Advanced group of options, click "Port Forwarding/Port Triggering." Click the "Add Custom Service" button, name it aMule1 (or whatever), set it as a TCP-only forwarding, with the starting and ending port being 4662 and the server IP address being whatever local address you're using (probably 192.168.1.2, if you're the only one connected to the router, but check), and click Apply. Repeat the process with aMule2 and aMule 3, using UDP-only ports for both and starting and ending ports of 4665 and 4672, respectively. (That is, the same starting and ending port within aMule2 and aMule3, but aMule2=4665 and aMule3=4672.) Make sure that iptables is properly set up on the machine which will run aMule (as above), and you're done.

=== TRENDnet router TW100 ===

First connect to your router: usually open a browser and type directly the router IP address: such as 192.168.0.1 (or 192.168.1.1), then the login box should appear ( depending on your router config) - if so answer the message log message with ‘admin’ as username and nothing as password (or you password if
you did set one).

Then On the left side Menu, Select Internet and thenselect Advanced Setup (Advanced Internet). Then click/select, [Special Applications]:

Add or replace 2 lines in the Special Applications list:
(Try not to remove something which you are using and which is already enabled)
(just add the new application for amule at the end in position Nr. 5 or Nr.6 in the list for example):

Create the entries as follows:

amuleU4665 TCP-4665-4665 UDP-4665-4665

amuleU4672 TCP-4672-4672 UDP-4672-4672 )

(In my Application List the “amuleU4665” and “amule4672” are in Nr1 and Nr2 but it can be in any position in your list).

->Click on the small box [ ] on the left for both lines of your amuleUxxxx applications to enable the special applications to work!

Then click on [Save], then click on [Close]

Then click on [Save] again on the page – Advanced Internet .

The next and last step is to click on the “Virtual Servers” menu on the left side, then the “Virtual Server page will appear”:

Add a new virtual server named like: AmuleTCP

Select your computer* IP Address: in the DropDown Menu

Select: TCP

Write the 4662 Port and 4662 port (both fields the same port)

Then [Add as new server]

Then you are set to have High ID and Kad ON. Finished with the Low-ID, yellow arrows and Kad Firewalled. Now all you arrows should be green and you should have access to Kad and ed2K.

''Important Note:''
*Be careful in the case that your computer is using the DHCP protocol (ie to obtain IP address from the router).
The router might not give all the time the same IP address to your computer.
(normally it does so... but sometimes it can change).
You have two solutions if you see that you have a low- ID then: (2 solutions)

1) log back to the router go back to the virtual server, select the amuleTCP virtual server that you created and just reselect you computer in the “PC(server)” entry box. And select [Update this server] and log out. It should do the job.

Or an alternative solution :

2)You can Set-up your computer with a fixed IP address if you want. If this problem of low-ID happens too often because you DHCP router gives different IP address to your computer, then you can put your computer in static mode or DHCP reserved address. But you need to know your DNS server(s) before to do that – so check with your ISP which are your DNS servers. Then configure your computer to run with a fixed DHCP/ Static address / Manual Address (name depends what OS you are running). For that go to your network settings and put the P address you want, and the gateway (you router IP address) and the DNS from your ISP – All this to be done ion the Other / PC Database (Admin) page of the router.

'''In the case that your TRENDNet router crashes or stop forwarding any''' traffic from/to your aMule computer . (it happened to me), then :

- reduce the Connection limit (in Preferences->Connection) to 100 (or to 50)
- reduce the "Max new connections / 5 secs" (in Preferences->Core Tweaks) to 10 (or to 5)
Stop amule and restart aMule so that configuration will be validated.

Make some tests to find your best config. It should give more stability to your router and avoid your router to crash ( ie you would have to reset and/or turn it on and off). This might be true for other routers as well(?).

''(TRENDnet Firewall from RFV - --[[User:Robert364|Robert364]] 17:05, 5 Nov 2006 (CET))
''

AMule Project FAQ - User contributions [en]

Firewall