Re: Starting a fw

[/dev/rob0 <rob0@gmx.co.uk>]

Visham Ramsurrun wrote:
> I was once told that in order to start a firewall automatically when a
> machine boots, we must make sure that the init process calls the
> script by making a symbolic link to that file in the /etc/rc.d/rcX.d
> directories.

This is not an iptables / netfilter issue. Different distros do this in 
different ways. Take this up in your distro's documentation or an 
appropriate forum.

That said ... I agree with what Robert told you.

> Let's say I have a firewall script called fw.sh with the following rules in it:

This IS a netfilter issue.

> $IPT -F
> $IPT -X
> $IPT -P INPUT DROP
> $IPT -P OUTPUT DROP
> $IPT -P FORWARD DROP
> 
> $IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
> -m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
> request -j ACCEPT
> 
> $IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
> -m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
> reply -j ACCEPT

You are only planning to relay pings on your eth0 subnet, 
192.168.10.0/24. All INPUT and OUTPUT packets are dropped, including 
loopback.

This machine won't be performing any useful network service. I strongly 
suspect that your FORWARD rules will never be hit. Are other machines on 
192.168.10.0/24 (eth0) routing through this one somehow?
-- 
     mail to this address is discarded unless "/dev/rob0"
     or "not-spam" is in Subject: header