Starting a fw

Starting a fw

[Visham Ramsurrun]

Hi to all,

I was once told that in order to start a firewall automatically when a
machine boots, we must make sure that the init process calls the
script by making a symbolic link to that file in the /etc/rc.d/rcX.d
directories.

I have found that there is a file called S08iptables (kernel 2.4.20-8)
containing startup commands for iptables service. Do i delete it and
then put the symbolic link to my script there or just leave it?

Let's say I have a firewall script called fw.sh with the following rules in it:

#!/bin/bash
IPT=/sbin/iptables

$IPT -F
$IPT -X
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP

$IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
-m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
request -j ACCEPT

$IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
-m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
reply -j ACCEPT

What steps (where to create symbolic links, at which runlevel, etc)
should I take in order to have this script be started automatically
when PC boots up. How can I make sure that it is this firewall script
that is running and all packets are being checked against these rules?

Thx in advance..

Warm regards,
Visham

Re: Starting a fw

[Robert Vangel]

[-- Attachment #1: Type: text/plain, Size: 2016 bytes --]

Visham Ramsurrun wrote:
> Hi to all,
> 
> I was once told that in order to start a firewall automatically when a
> machine boots, we must make sure that the init process calls the
> script by making a symbolic link to that file in the /etc/rc.d/rcX.d
> directories.
> 
> I have found that there is a file called S08iptables (kernel 2.4.20-8)
> containing startup commands for iptables service. Do i delete it and
> then put the symbolic link to my script there or just leave it?

Leave that. You can use this to do your firewalling.

> 
> Let's say I have a firewall script called fw.sh with the following rules in it:
> 
> #!/bin/bash
> IPT=/sbin/iptables
> 
> $IPT -F
> $IPT -X
> $IPT -P INPUT DROP
> $IPT -P OUTPUT DROP
> $IPT -P FORWARD DROP
> 
> $IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
> -m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
> request -j ACCEPT
> 
> $IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
> -m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
> reply -j ACCEPT
> 
> What steps (where to create symbolic links, at which runlevel, etc)
> should I take in order to have this script be started automatically
> when PC boots up. How can I make sure that it is this firewall script
> that is running and all packets are being checked against these rules?
> 
> Thx in advance..
> 
> Warm regards,
> Visham
> 


What distro? I am going to take a stab at it and choose RH/Fedora. I am also going to take a stab at it (I don't use Fedora) and say that default runlevel is 4?

If my memory serves me well (I hope it does), the file we need to look at is /etc/sysconfig/iptables. The contents of this file match the output of a `iptables-save'. Basically what the init script does is `iptables-restore < /etc/sysconfig/iptables'.

All you need to do is edit the /etc/sysconfig/iptables file to match your needs and then restart the iptables service.

That said, if you aren't using RH or Fedora... I'm probably way off

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/x-pkcs7-signature, Size: 3166 bytes --]

Re: Starting a fw

[Venkata Narayana]

>Visham Ramsurrun wrote:
> Hi to all,
> > 
> > I was once told that in order to start a firewall
> automatically when a
> > machine boots, we must make sure that the init
> process calls the
> > script by making a symbolic link to that file in
> the /etc/rc.d/rcX.d
> > directories.
> > 
> > I have found that there is a file called
> S08iptables (kernel 2.4.20-8)
> > containing startup commands for iptables service.
> Do i delete it and
> > then put the symbolic link to my script there or
> just leave it?
> 
> Leave that. You can use this to do your firewalling.
> 
> > 
> > Let's say I have a firewall script called fw.sh
> with the following rules in it:
> > 
> > #!/bin/bash
> > IPT=/sbin/iptables
> > 
> > $IPT -F
> > $IPT -X
> > $IPT -P INPUT DROP
> > $IPT -P OUTPUT DROP
> > $IPT -P FORWARD DROP
> > 
> > $IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24
> -d 192.168.10.0/24
> > -m state --state NEW,ESTABLISHED,RELATED -p icmp
> --icmp-type echo
> > request -j ACCEPT
> > 
> > $IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24
> -d 192.168.10.0/24
> > -m state --state NEW,ESTABLISHED,RELATED -p icmp
> --icmp-type echo
> > reply -j ACCEPT
> > 
> > What steps (where to create symbolic links, at
> which runlevel, etc)
> > should I take in order to have this script be
> started automatically
> > when PC boots up. How can I make sure that it is
> this firewall script
> > that is running and all packets are being checked
> against these rules?
> > 
> > Thx in advance..
> > 
> > Warm regards,
> > Visham
> > 

Option 1: You can do by adding the stuff to rc.local
script in your redhat based distributions. There you
just call your fw.sh file. 
Option 2: Use chkconfig tool to make it as init
script.
option 3: creats SXXXXXXX link to the fw.sh file in
appropriate run-levels. Mostly for runlevel 3.

Thanks,
Venkat.




__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

Re: Starting a fw

[/dev/rob0]

Visham Ramsurrun wrote:
> I was once told that in order to start a firewall automatically when a
> machine boots, we must make sure that the init process calls the
> script by making a symbolic link to that file in the /etc/rc.d/rcX.d
> directories.

This is not an iptables / netfilter issue. Different distros do this in 
different ways. Take this up in your distro's documentation or an 
appropriate forum.

That said ... I agree with what Robert told you.

> Let's say I have a firewall script called fw.sh with the following rules in it:

This IS a netfilter issue.

> $IPT -F
> $IPT -X
> $IPT -P INPUT DROP
> $IPT -P OUTPUT DROP
> $IPT -P FORWARD DROP
> 
> $IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
> -m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
> request -j ACCEPT
> 
> $IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
> -m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
> reply -j ACCEPT

You are only planning to relay pings on your eth0 subnet, 
192.168.10.0/24. All INPUT and OUTPUT packets are dropped, including 
loopback.

This machine won't be performing any useful network service. I strongly 
suspect that your FORWARD rules will never be hit. Are other machines on 
192.168.10.0/24 (eth0) routing through this one somehow?
-- 
     mail to this address is discarded unless "/dev/rob0"
     or "not-spam" is in Subject: header

Re: Starting a fw

[Robert Vangel]

[-- Attachment #1: Type: text/plain, Size: 1492 bytes --]

Please try to keep the discussion on-list. Thanks.

Visham Ramsurrun wrote:
> Hi Robert,
> 
> First of, many thx for the reply..
> 
> 
>>What distro? I am going to take a stab at it and choose RH/Fedora. I am also going to take a stab at it (I don't use Fedora) and say that default runlevel is 4?
> 
> 
> Yes, i'm using Red Hat 9 with an upgraded kernel of 2.6.11.7
> 
> 
>>If my memory serves me well (I hope it does), the file we need to look at is /etc/sysconfig/iptables. The contents of this file match the output of a `iptables-save'. Basically what the init script does is `iptables-restore < /etc/sysconfig/iptables'.
> 
> 
>>All you need to do is edit the /etc/sysconfig/iptables file to match your needs and then restart the iptables service.
> 
> 
> Do I delete the lines that are written inthe file and then paste the
> contents of my fiewall script?

You don't just paste the contents line for line. It needs to be changed a little.

Take a look at

http://zilla.id.au/netfilter/iptables & http://zilla.id.au/netfilter/shell

The first file is what I call `iptables syntax'. It is the file outputted by running `iptables-save' and can be read by using `iptables-restore < file'

The second is simply a shell script, executing iptables each time and appending each rule.

Hopefully the two files above will help you in converting your shell script into the iptables syntax one to put in /etc/sysconfig/iptables.

> 
> Hope to hear from you soon..
> 
> Warm regards,
> Visham
> 


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/x-pkcs7-signature, Size: 3166 bytes --]