[gentoo-user] Re: iptables wiki

[James <wireless@tampabay.rr.com>]

Richard Fish <bigfish <at> asmallpond.org> writes:


> > Where do I put a scirpt of iptables command, so it is read the
> > rule sets generated and then saved into /var/lib/iptables/rules-save?

> Anywhere you like.  All that matters is that you run it so your
> iptables are setup like you want, then run "/etc/init.d/iptables save"
> followed by "rc-update -a iptables default".

> > After that if I want to modify the rules, I edit my script, run
> > my script manually, then issue:
> > "iptables-save > /var/lib/iptables/rules-save"

> No, "/etc/init.d/iptables save" is the better choice.  The file might
> move, or the format change, or something similar.

> You probably want
> your script to have the following at the top:

> iptables -F
> iptables -P INPUT ACCEPT
> iptables -P OUTPUT ACCEPT
> iptables -P FORWARD DROP

Yes I've seen these.

Should I start the script with the typical shebang?
#! /bin/sh

or I've seen this:
#!/sbin/runscript

???

> This flushes all rules, and resets the default policies, so that only
> the rules that you specify later take effect.  Very useful for
> clearing out old artifacts of stuff...

> > What I'm looking for is the series of steps to
> > 1. Where best to locate my script?

> Mine is in ~/bin/.
not /bin/ ? 
interesting choice, under a user's dir.
/usr/local/bin/ might be appropriate too?

> > 2. Insert (new) commands into the script.
> $EDITOR

> > 3. convert new scrited commands into rulesets
> > 4. Load rulesets into the /var/lib/iptables/rules-save

> Don't do this. Run your script, and let "/etc/init.d/iptables save" do
> the work for you.

So my (edited) scipt  issues new iptables commands
and the gentoo script converts these commands
into rulesets and stores them in /var/lib/iptables/rules-save?

> > 5.  Restart the iptables/netfilter firewall

> If you flush/reset like I describe above, this is not necessary, just
> run your script.

Yes those (4) lines go into my scipt, at the beginning.

Modified  series of steps to use my own script
1. Put the my-firewall.sh scipt in /usr/local/bin/ with '700' permissions.
2. "rc-update -a iptables default" (issue once )
3. Insert (new) commands into the script then run  my-firewall.sh.
4. run "/etc/init.d/iptables save" convert (new) script based
   commands into rulesets and load .   
5. Test the (new) scipt {rulesets}.
6. Go to step 3 and repeat until a wonderful firewall results.

Note, step 4 can be added to the end of my-firewall.sh to 
combine steps 3 and 4?


correct if I missing anyting?


thanks,

James




-- 
gentoo-user@gentoo.org mailing list