From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1FyCXU-00077q-Ix for garchives@archives.gentoo.org; Wed, 05 Jul 2006 18:55:57 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.13.7/8.13.6) with SMTP id k65IrIoa028040; Wed, 5 Jul 2006 18:53:18 GMT Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) by robin.gentoo.org (8.13.7/8.13.6) with ESMTP id k65Iguxf031519 for ; Wed, 5 Jul 2006 18:42:57 GMT Received: from localhost (localhost [127.0.0.1]) by smtp.gentoo.org (Postfix) with ESMTP id 8916C6462C for ; Wed, 5 Jul 2006 18:42:56 +0000 (UTC) Received: from smtp.gentoo.org ([127.0.0.1]) by localhost (smtp.gentoo.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 04518-09 for ; Wed, 5 Jul 2006 18:42:49 +0000 (UTC) Received: from robin.gentoo.org (mx2.gentoo.org [140.105.134.103]) by smtp.gentoo.org (Postfix) with ESMTP id EEDA464343 for ; Wed, 5 Jul 2006 18:42:44 +0000 (UTC) Received: from ciao.gmane.org (main.gmane.org [80.91.229.2]) by robin.gentoo.org (8.13.7/8.13.6) with ESMTP id k65IVFDW002200 for ; Wed, 5 Jul 2006 18:31:15 GMT Received: from list by ciao.gmane.org with local (Exim 4.43) id 1FyC9P-0004B6-7R for gentoo-user@gentoo.org; Wed, 05 Jul 2006 20:31:03 +0200 Received: from www.buffer.net ([24.73.161.102]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 05 Jul 2006 20:31:03 +0200 Received: from wireless by www.buffer.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Wed, 05 Jul 2006 20:31:03 +0200 X-Injected-Via-Gmane: http://gmane.org/ To: gentoo-user@lists.gentoo.org From: James Subject: [gentoo-user] Re: iptables wiki Date: Wed, 5 Jul 2006 18:30:41 +0000 (UTC) Message-ID: References: <44AB8E7E.1090005@ilievnet.com> <7573e9640607050922ra5f37a4j683a73e8f7e04d3a@mail.gmail.com> Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@gentoo.org Reply-to: gentoo-user@lists.gentoo.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@sea.gmane.org X-Gmane-NNTP-Posting-Host: main.gmane.org User-Agent: Loom/3.14 (http://gmane.org/) X-Loom-IP: 24.73.161.102 (Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.13) Gecko/20060616) Sender: news X-Virus-Scanned: amavisd-new at gentoo.org X-Spam-Status: No, score=-2.582 required=5.5 tests=[AWL=0.017, BAYES_00=-2.599] X-Spam-Score: -2.582 X-Spam-Level: X-Archives-Salt: 6f57ce5f-b91c-4e00-9d54-21af49080524 X-Archives-Hash: ccb0a3c6bf1cab36d86df68f3dd4df62 Richard Fish asmallpond.org> writes: > > Where do I put a scirpt of iptables command, so it is read the > > rule sets generated and then saved into /var/lib/iptables/rules-save? > Anywhere you like. All that matters is that you run it so your > iptables are setup like you want, then run "/etc/init.d/iptables save" > followed by "rc-update -a iptables default". > > After that if I want to modify the rules, I edit my script, run > > my script manually, then issue: > > "iptables-save > /var/lib/iptables/rules-save" > No, "/etc/init.d/iptables save" is the better choice. The file might > move, or the format change, or something similar. > You probably want > your script to have the following at the top: > iptables -F > iptables -P INPUT ACCEPT > iptables -P OUTPUT ACCEPT > iptables -P FORWARD DROP Yes I've seen these. Should I start the script with the typical shebang? #! /bin/sh or I've seen this: #!/sbin/runscript ??? > This flushes all rules, and resets the default policies, so that only > the rules that you specify later take effect. Very useful for > clearing out old artifacts of stuff... > > What I'm looking for is the series of steps to > > 1. Where best to locate my script? > Mine is in ~/bin/. not /bin/ ? interesting choice, under a user's dir. /usr/local/bin/ might be appropriate too? > > 2. Insert (new) commands into the script. > $EDITOR > > 3. convert new scrited commands into rulesets > > 4. Load rulesets into the /var/lib/iptables/rules-save > Don't do this. Run your script, and let "/etc/init.d/iptables save" do > the work for you. So my (edited) scipt issues new iptables commands and the gentoo script converts these commands into rulesets and stores them in /var/lib/iptables/rules-save? > > 5. Restart the iptables/netfilter firewall > If you flush/reset like I describe above, this is not necessary, just > run your script. Yes those (4) lines go into my scipt, at the beginning. Modified series of steps to use my own script 1. Put the my-firewall.sh scipt in /usr/local/bin/ with '700' permissions. 2. "rc-update -a iptables default" (issue once ) 3. Insert (new) commands into the script then run my-firewall.sh. 4. run "/etc/init.d/iptables save" convert (new) script based commands into rulesets and load . 5. Test the (new) scipt {rulesets}. 6. Go to step 3 and repeat until a wonderful firewall results. Note, step 4 can be added to the end of my-firewall.sh to combine steps 3 and 4? correct if I missing anyting? thanks, James -- gentoo-user@gentoo.org mailing list