LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 08-28-2004, 02:57 AM   #1
tentolga
LQ Newbie
 
Registered: Aug 2004
Posts: 22

Rep: Reputation: 15
Question Where to put iptables script?


I created an iptables script by using an iptables script generator.

I'm using FC2 and don't know where to put this file.
Can anybody tell me where to put this file and under which name? I don't know the name of the file either. One more question...how can I enable this file? Do I need to restart my computer? I'm using a cable modem and I don't have a static ip...

thank you for any help...
 
Old 08-28-2004, 03:49 AM   #2
tentolga
LQ Newbie
 
Registered: Aug 2004
Posts: 22

Original Poster
Rep: Reputation: 15
I put the iptables script under the name of /etc/rc.local and tried to reboot my computer but I didn't get my computer to open correctly, kde didn't start...then I removed the content of the rc.local file and restart the computer. I don't know what to do now.
 
Old 08-28-2004, 03:53 AM   #3
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
save it. it doesnt matter what the name of file is.
and set the permision of that file executable

#chmod +x iptables-file

and edit /etc/rc.d/rc.local file.
add the following line and of this file
/path/to/file/iptables-file

thats all.
 
Old 08-28-2004, 03:55 AM   #4
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
does your iptables scritp allows loopback??

add the following lines into your script
iptables -A INPUT -d 127.0.0.1 -j ACCEPT
iptables -A INPUT -s 127.0.0.1 -j ACCEPT
 
Old 08-28-2004, 04:20 AM   #5
tentolga
LQ Newbie
 
Registered: Aug 2004
Posts: 22

Original Poster
Rep: Reputation: 15
I did as you said and tried to reboot my computer. It opened without any problems but nothing has changed. I think it's getting worse. I can't even ping the gateway from other computers in the LAN. Before that I was able to ping the gateway from the computers in my LAN. Is it so hard to set up a gateway? anyway, I'm still a newbie...
 
Old 08-28-2004, 04:39 AM   #6
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
never give up! im still newbie too :-)

it is so easy to setup gateway.
1-
the following makes your linux a router.
#echo 1 > /proc/sys/net/ipv4/ip_forward
2-
and the following makes nat:
#iptables -t nat -A POSTROUTING -j MASQUERADE

thats all.

but your script is better because it has also firewall rules. it blocks unwanted net activity and secure your local network.

expalin more about your network and post your firewall script here. let me check them. so i will be able to help.
 
Old 08-28-2004, 05:10 AM   #7
tentolga
LQ Newbie
 
Registered: Aug 2004
Posts: 22

Original Poster
Rep: Reputation: 15
Code:
#!/bin/sh

# iptables script generator: V0.1-2002
# Comes with no warranty!
# e-mail: michael@1go.dk

# Diable forwarding
echo 0 > /proc/sys/net/ipv4/ip_forward

LAN_IP_NET='192.168.0.1/24'
LAN_NIC='eth1'
WAN_IP='194.54.33.108'
WAN_NIC='eth0'

# load some modules (if needed)

# Flush
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -t nat -F OUTPUT
iptables -F

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# enable Masquerade and forwarding
iptables -t nat -A POSTROUTING -s $LAN_IP_NET -j MASQUERADE
iptables -A FORWARD -j ACCEPT -i $LAN_NIC -s $LAN_IP_NET
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# STATE RELATED for router
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
This is the firewall script. I've a cable modem and everytime I restart my computer I'm getting an IP from the DHCP server. The cable modem is connected via USB and it's eth0 (WAN). I'm using an ethernet card which is eth1 (LAN). I'm able to ping the gateway but I want more. I would like to be able to surf the net. I don't know what the problem is. I followed the instructions that you gave, unfortunately nothing has changed.

Thanks for the replies...
 
Old 08-28-2004, 05:24 AM   #8
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
Quote:
Originally posted by tentolga
Code:
#!/bin/sh

# iptables script generator: V0.1-2002
# Comes with no warranty!
# e-mail: michael@1go.dk

# Diable forwarding
echo 0 > /proc/sys/net/ipv4/ip_forward

LAN_IP_NET='192.168.0.1/24'  ## !! this is a wrong expression. it should be 192.168.0.0/24
LAN_NIC='eth1' 
WAN_IP='194.54.33.108' 
WAN_NIC='eth0'

# load some modules (if needed) ## !! u can add the followings.
modprobe ip_conntrack_ftp ## passive ftp modules
modprobe ip_nat_ftp

# Flush
iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -t nat -F OUTPUT
iptables -F

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# enable Masquerade and forwarding
iptables -t nat -A POSTROUTING -s $LAN_IP_NET -j MASQUERADE
iptables -A FORWARD -j ACCEPT -i $LAN_NIC -s $LAN_IP_NET
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# STATE RELATED for router
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
## !! u could add the following to allow connections from local network
iptables -A INPUT -s $LAN_IP_NET -j ACCEPT

## !! if some services will work on this computer, uncommend the foloowings :
#iptables -A INPUT -s 127.0.0.1 -j ACCEPT
#iptables -A INPUT -d 127.0.0.1 -j ACCEPT

# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
 
Old 08-28-2004, 06:10 AM   #9
tentolga
LQ Newbie
 
Registered: Aug 2004
Posts: 22

Original Poster
Rep: Reputation: 15
Thanks a lot maxut!

I didn't know that I had to set dns to dns of my ISP on my other linux box. Everything is fine now.
Thanks....
 
Old 08-28-2004, 08:39 AM   #10
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
glad to hear that!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Bash put script jnusa Programming 3 09-07-2004 03:31 AM
Where to put iptables rules from Red Hat in Debian aubrey Debian 2 03-03-2004 07:36 PM
PPPD how do I know what to put in the script? jimdaworm Slackware 4 02-29-2004 01:02 PM
Where to put program/script cmfarley19 Linux - General 5 02-26-2004 02:23 PM
How & where to put script? snakedriver Linux - Newbie 2 01-21-2004 08:11 PM


All times are GMT -5. The time now is 12:16 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration