[SOLVED] Firewall tutorial?

[Sephiroth]

I've been toying with KMyFirewall and have an interesting problem. I wrote a simple firewall using KMyFirewall and created an input rule that checked to see whether or not the connection is related and established, that the interface is wlan0, and to accept the connection if that's the case. The problem is that when I enable this rule, the laptop doesn't work properly. Windows don't pop up, etc. It's like it filters against lo and maybe even eth0 as well. Can anybody offer me some guidance on this?

*EDIT*

[Sephiroth]

I wasn't thinking. I added two more rules. One filters wlan0, one filters eth0, and one accepts everything destined for lo. Below is a screenshot. So far this seems to be working. My only concern is that all input for lo is accepted, as I believe it has to be for X/KDE/whatever to function properly. Is this correct, or should I somehow filter input for lo?

[telemachus]

There's a good introductory tutorial for raw iptables commands on the other forum: http://forums.debian.net/viewtopic.php?t=16166. (Note that it says part one of three, but the other two were never written. Sadly, the author stopped posting altogether long ago. He was a funny, knowledgeable guy.)

In any case, yes, I believe you must let lo accept everything. Once upon a time, when I was first trying to learn iptables, I wrote a set of rules without anything about lo, and I put the machine into a state where it couldn't even shut down. Ouch. I'm not sure I'm reading that wonky-ass KDE gui correctly, but it looks like anything not explicitly accepted is DROPPED. That would explain your earlier problem.

[Sephiroth]

You are correct, Tele. In my second picture, you see what I run now. It works fine, but I have not yet had the chance to plop the laptop into a wireless or wired DMZ and test it with "Shields Up!" or the like. I was only curious about allowing everything into lo because technically all data will eventually hit lo, right? I mean this web-page came in through wlan0, but Iceweasel runs on the local machine!

I'm marking this as solved because it works now. The solution was to drop everything incoming by default, and specify a set of rules for each interface manually. The only rule for the lo interface should be to accept. You can specify any rules you want for your other interfaces though.