Firestarter's hit list stays blank when portscanned locally

Question

I have no real understanding of Iptables and just realized that after switching to AL I needed to set up some sort of firewall on my desktop. 
So I pacman'd firestarted, found it in /opt/gnome/bin and ran the gui app
I set up everything according to how I wanted it to act and then dropped it down into KDE's tray. 
I hopped over to one of my other local computers and scanned it with nmap and Xscan and both turned up blanks.  Thats great... but Firestarter's hitlist is staying blank.  Not a single notification has popped up as it should, the home LAN has numerous M$ and *nix boxes.... and our public IP is scanned quite regularly by kiddies out there....
Is there some configuration I need to carry out?  I've read the manual at Firestarter's homepage and drew a blank. 
Anyone seen this behavior with firestarter?  It will stay running on the comp as its keeping my desktop slightly less vulnerable but I'd really like to gain full functionality from the program. 
If ya'll need any more information please don't hesitate to ask...  Or a URL to go read at... I've drawn a blank on google and linuxquestions.org....
Appreciate any replies,
James

Answer 1

longhornxtreme wrote:I would still like to be able to monitor my firewall without digging through log files but I appreciate the help anyways!
I use normal iptables logging (the LOG chain) [from gShield (PKGBUILD  available on the forums)] and I redirect all my kernel output to vc12 from within syslog-ng. I could create a filter for those messages in syslog-ng to show, for example, the firewall messages on vc11, but haven't looked in the configs yet.
Or, now I've thought of something else. You can create a FIFO with mkfifo and pipe all the firewall messages to that (also using a filter in syslog-ng). Let's assume you've created it with
mkfifo /var/log/iptables_pipe
Config your syslog-ng (I don't know if syslog is so flexible) to redirect iptables messages to /var/log/iptables_pipe (I can't tell you how to do this, because I haven't tried it yet).
Do (in a console)
while read line; do echo $line; done < /var/log/iptables_pipe
and you'll have live report from iptables.
^ I think this should work, but haven't tested it yet (as I've said).
Good luck.
IceRAM
P.S.1. There are some more advanced programs (as far as I remember) for detecting intrusions on Linux. I don't remember these advanced programs having a GUI, probably because they're enough complicated on the inside to create an interface for them. They just put the output in a log, you follow it whatever you want. You won't see much interactivity from the Linux firewalls, mostly because they were supposed to just sit on a machine and do their work.
P.S.2. I haven't seen on linux a GUI firewall on linux doing popups and so on. This is probably because the components are well defined, the firewall runs as root and you probably log in as a normal user. Allowing a normal user to modify live the firewall rules creates a security hole.