Re: Starting a fw

[Robert Vangel <vangelr@rfgt.net>]

[-- Attachment #1: Type: text/plain, Size: 2016 bytes --]

Visham Ramsurrun wrote:
> Hi to all,
> 
> I was once told that in order to start a firewall automatically when a
> machine boots, we must make sure that the init process calls the
> script by making a symbolic link to that file in the /etc/rc.d/rcX.d
> directories.
> 
> I have found that there is a file called S08iptables (kernel 2.4.20-8)
> containing startup commands for iptables service. Do i delete it and
> then put the symbolic link to my script there or just leave it?

Leave that. You can use this to do your firewalling.

> 
> Let's say I have a firewall script called fw.sh with the following rules in it:
> 
> #!/bin/bash
> IPT=/sbin/iptables
> 
> $IPT -F
> $IPT -X
> $IPT -P INPUT DROP
> $IPT -P OUTPUT DROP
> $IPT -P FORWARD DROP
> 
> $IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
> -m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
> request -j ACCEPT
> 
> $IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
> -m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
> reply -j ACCEPT
> 
> What steps (where to create symbolic links, at which runlevel, etc)
> should I take in order to have this script be started automatically
> when PC boots up. How can I make sure that it is this firewall script
> that is running and all packets are being checked against these rules?
> 
> Thx in advance..
> 
> Warm regards,
> Visham
> 


What distro? I am going to take a stab at it and choose RH/Fedora. I am also going to take a stab at it (I don't use Fedora) and say that default runlevel is 4?

If my memory serves me well (I hope it does), the file we need to look at is /etc/sysconfig/iptables. The contents of this file match the output of a `iptables-save'. Basically what the init script does is `iptables-restore < /etc/sysconfig/iptables'.

All you need to do is edit the /etc/sysconfig/iptables file to match your needs and then restart the iptables service.

That said, if you aren't using RH or Fedora... I'm probably way off

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/x-pkcs7-signature, Size: 3166 bytes --]