Richard Fish <bigfish <at> asmallpond.org> writes:
> > Where do I put a scirpt of iptables command, so it is read the
> > rule sets generated and then saved into /var/lib/iptables/rules-save?
> Anywhere you like. All that matters is that you run it so your
> iptables are setup like you want, then run "/etc/init.d/iptables save"
> followed by "rc-update -a iptables default".
> > After that if I want to modify the rules, I edit my script, run
> > my script manually, then issue:
> > "iptables-save > /var/lib/iptables/rules-save"
> No, "/etc/init.d/iptables save" is the better choice. The file might
> move, or the format change, or something similar.
> You probably want
> your script to have the following at the top:
> iptables -F
> iptables -P INPUT ACCEPT
> iptables -P OUTPUT ACCEPT
> iptables -P FORWARD DROP
Yes I've seen these.
Should I start the script with the typical shebang?
#! /bin/sh
or I've seen this:
#!/sbin/runscript
???
> This flushes all rules, and resets the default policies, so that only
> the rules that you specify later take effect. Very useful for
> clearing out old artifacts of stuff...
> > What I'm looking for is the series of steps to
> > 1. Where best to locate my script?
> Mine is in ~/bin/.
not /bin/ ?
interesting choice, under a user's dir.
/usr/local/bin/ might be appropriate too?
> > 2. Insert (new) commands into the script.
> $EDITOR
> > 3. convert new scrited commands into rulesets
> > 4. Load rulesets into the /var/lib/iptables/rules-save
> Don't do this. Run your script, and let "/etc/init.d/iptables save" do
> the work for you.
So my (edited) scipt issues new iptables commands
and the gentoo script converts these commands
into rulesets and stores them in /var/lib/iptables/rules-save?
> > 5. Restart the iptables/netfilter firewall
> If you flush/reset like I describe above, this is not necessary, just
> run your script.
Yes those (4) lines go into my scipt, at the beginning.
Modified series of steps to use my own script
1. Put the my-firewall.sh scipt in /usr/local/bin/ with '700' permissions.
2. "rc-update -a iptables default" (issue once )
3. Insert (new) commands into the script then run my-firewall.sh.
4. run "/etc/init.d/iptables save" convert (new) script based
commands into rulesets and load .
5. Test the (new) scipt {rulesets}.
6. Go to step 3 and repeat until a wonderful firewall results.
Note, step 4 can be added to the end of my-firewall.sh to
combine steps 3 and 4?
correct if I missing anyting?
thanks,
James
--
[email protected] mailing list
