I'm behind a router. In router config, I blocked:
- all (inbound and outbound) UDP
- inbound ICMP
Local iptables are configures with Firestarter wizard:
- block all incoming connections
- allow all outgoing connections
- filter ICMP except ping
- block broadcast from external netword
Now, Firestarter still complaints about blocked TCP and ICMP connections to my internal IP (192.168.0.*), on different ports. There are no UDP complaints, but only because router blocks them all. Formerly, with inbound (but not outbound) UDP-s blocked I was also getting tons of blocked UDP connections (especially with Skype launched).
I don't get how it is possible that Firestarter complaints about blocked TCP connections. My understanding is that behind the router I'm not reachable from the outside world (due to NAT translation), and router passes only those inbound packets that match outbound packets. Now, iptables should work in the same way - it should accept inbound response packets matching former outbound ones. So, if TCP packet manages to get from my computer to the outside server, then the response should never be blocked.
Also, I don't understand how ICMP packets might get thru the router and crash on my iptables - they all should be be blocked in the router (note, however that all ICMPs that arrive at my iptables are on port 80, maybe this is a clue)
Could someone point me in the right direction either about how to fix those problems (if there are any, maybe I'm uninformed).