LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 12-13-2003, 08:06 AM   #1
immer
LQ Newbie
 
Registered: Oct 2003
Location: Somewhere in Europe :-)
Distribution: Linux Mint
Posts: 29

Rep: Reputation: 15
iptables & rc.local starting script = applications are slowing down.


Hello everybody!

Aurox 9.1 (based on RedHat 9.0).

my /etc/rc.firewall:
Code:
#!/bin/bash

/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_conntrack_ftp

/sbin/iptables -F
/sbin/iptables -P INPUT DROP

/sbin/iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 20:21 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
my /etc/rc.local:
Code:
#!/bin/sh

touch /var/lock/subsys/local
/etc/rc.firewall
After system startup some applications don't want to start - for example wine or Gnome (fluxbox starts OK). Some applications start perfectly (ex. Mozilla), but after while i can't do anything with them.

If i remove line:
Code:
/sbin/iptables -P INPUT DROP
from /etc/rc.firewall file everything is OK.

I don't want to use
Code:
service iptables save
I would like to start script with firewall configuration at system startup. How should i do it properly?
 
Old 12-13-2003, 08:28 AM   #2
g-rod
Member
 
Registered: Dec 2003
Location: Long Island, NY USA
Distribution: RedHat, SUSE
Posts: 336

Rep: Reputation: 30
Change your input policy to drop.
iptables -I INPUT -i eth1 -j ACCEPT
iptables -I INPUT -i lo -j ACCEPT
iptables -P INPUT DROP

I ASSUME that eth1 is your INTERNAL interface and you want to connect to the box from inside you network. If you only want to connect to it from the local terminal remove the first entry.

The second line allows local connections.
If you still have trouble add login before dropping.
iptables -A INPUT -j LOG --log-prefix IPTABLES-INPUT
cat /var/log/messages | grep IPTABLES-INPUT
 
Old 12-13-2003, 08:39 AM   #3
david_ross
Moderator
 
Registered: Mar 2003
Location: Scotland
Distribution: Slackware, RedHat, Debian
Posts: 12,047

Rep: Reputation: 64
I have also had this problem the way I get round it is to allow connections to the machine from itself - ie:
iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCPET
 
Old 12-13-2003, 09:11 AM   #4
immer
LQ Newbie
 
Registered: Oct 2003
Location: Somewhere in Europe :-)
Distribution: Linux Mint
Posts: 29

Original Poster
Rep: Reputation: 15
Allowing traffic to loopback resolve problem!

Big thx! I didn't realised that iptables control traffic on lo.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Starting a Script from rc.local dazz Linux - Newbie 9 07-03-2005 05:03 AM
Applications not starting pconrad Fedora 2 10-04-2004 01:43 AM
Starting applications at login in GNOME janisj Linux - Software 1 08-07-2004 06:40 AM
starting applications corbis_demon Linux - Newbie 3 06-28-2004 03:19 AM
starting applications at boot time jogurt666 Debian 4 01-21-2004 03:39 AM


All times are GMT -5. The time now is 07:17 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration