Why want my iptables scripts run in cron

Why want my iptables scripts run in cron

[david]

I have a simple script called routup.sh to start the routing at a certain 
time, it is excutable. It runs fine at the command line but not cron. here is 
what my cron entry looks like:                0 9 * * * root   /etc/routup.sh
#routup.sh
#!/bin/bash

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE 

I even went as far to add a path to the crontab file like this:
vi crontab   

/sbin/iptables.  
where am i going wrong. 
The o.s. is linux mandrake 9.0

thanks for any help,

david 

Re: Why want my iptables scripts run in cron

[Ales Stibal]

david wrote:

 >I have a simple script called routup.sh to start the routing at a certain
 >time, it is excutable. It runs fine at the command line but not cron. 
here is
 >what my cron entry looks like:                0 9 * * * root   
/etc/routup.sh

What is the reason to run this script in cron? ;-)

 >#routup.sh
 >#!/bin/bash
 >
 >echo 1 > /proc/sys/net/ipv4/ip_forward
 >iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

At first look: remove the first line. Let the #!/bin/bash
be at the first instead of #routup.sh.

BTW: why do you run bash? Run sh. It's not error
in fact, but the sh usage is something like idiom.
AFAIK sh is link to your default shell, probably bash.

 >I even went as far to add a path to the crontab file like this:
 >vi crontab   
 >/sbin/iptables.

This looks strange to me. Could you send  more info if
the stuff above wont help?

 >where am i going wrong.
 >The o.s. is linux mandrake 9.0
 >
 >thanks for any help,

Hope this helps,
      Astib();

-- 
A l e s  S t i b a l, Wintel free, powered by AthlonXP and Gentoo Linux.
<astib@giganet.cz> Giganet.cz community network, Litomerice, Czech Republic

Getting Netfilter to play nice.

[Rowan Reid]

I'm setting up a freeswan vpn, or well trying. One important step is to
get freeswan to play nice.

Here are the free swan req.
<SNIPPET>
IKE uses the UDP protocol and port 500. 
Unless you are using only (less secure, not recommended) manual keying,
you need IKE to negotiate connection parameters, acceptable algorithms,
key sizes and key setup. IKE handles everything required to set up,
rekey, repair or tear down IPsec connections. 
ESP is protocol number 50 
This is required for encrypted connections. 
AH is protocol number 51 
This can be used where only authentication, not encryption, is required.

</SNIpPET>
It also mentions not masquarading packates destined to the vpn network.
My rulesets that apply arre posted below

<snippet>
# VPN - Enable the following lines to allow incomming VPN connections
#
echo -e "      - Allowing EXTERNAL access for VPN traffic"
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p
udp -s $INGLEWOOD -d $EXTIP --dport 500 -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p
esp -s $INGLEWOOD -d $EXTIP -j ACCEPT
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p
ah -s $INGLEWOOD -d $EXTIP -j ACCEPT

echo "     - FWD: Allow all connections OUT and only existing/related
IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state
NEW,ESTABLISHED,RELATED -s $INGLEWOOD -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT

$IPTABLES -t nat -A POSTROUTING -o $EXTIF ! -d 10.0.0.0/24 -j SNAT --to
$EXTIP
</snippet>

Where 10.0.0.0 is the net of the private address of the other end of the
vpn.
Have I covered all my bases ?