high level firewall seems ineffective

[andre]

installed RH7.2
I selected the minimal security through the
anaconda instalation process,
I changed my mind and red through some redhat docs, and it says to use gnome-lokkit to edit the firewall...I don't seem to have gnome-lokkit, but I did notice I had lokkit...specified the maximum security , ok, and rebooted. and was still able to surf, ftp and use a file sharing kazaa(morpheus) withought problem,,,, this shouldn't be happening right? is using lokkit wrong? what can I do to reconfigure and check my firewall(default rh 7.2 iptables ipchains I don't know much about it) :(

[Choozo]

Nothing wrong about that. A firewall should basically block incoming requests on ports below 1024 - that you don't want to have open - since these are known, standardised port assignments. When you surf, ftp, Kazaa, etc., all incoming traffic (return traffic) are basically requested by yourself and uses high ports (above 1024), and are thus allowed. If you block those, you basically disable any use of the machine for surfing, etc.

Cheers :)

[andre]

thanks Chooso,
It makes me feel a bit better, I didn't know that a firewall could discern from trafic requested by me that trafic that is not.

Although, better safe than sorry, do you know
where I could verify that lokkit(firewall config) actually changed the ipchains or iptables rules, I never can remember wich (chains or rules) RH7.2 uses.

If I could see the changes made, I would feel pretty confident, and perhaps I would start to learn about them.

How about it? :D

[Choozo]

I have no idea how RedHat (or lokkit) have done this, but a quick look through your '/etc/rc.d/init.d/firewall.up' script (or whatever the script is called, and wherever its located) should give you a clue.

Cheers :)