LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 03-31-2006, 01:05 PM   #1
lx3000
LQ Newbie
 
Registered: Mar 2006
Distribution: Red Hat Enterprise Linux 4, Fedora Core 7
Posts: 26

Rep: Reputation: 15
iptables firewall falls back to default after reboot


Hello everybody !!!
I'm somewhere between the novice and intermediate part in Linux. I'm having a bit of trouble with my iptables : I set up a firewall, block some ports I don't need and then when I list my written rules with iptables -L -v everything seems to work perfectly, but once I reboot my computer all the rules are changed to default ones, ports that were closed after I've created my firewall are now open. I would really appreciate some help !!!

P.S.: I suspect there is a command that saves all my iptables rules, but unfortunately I haven't found one yet :-(

Last edited by lx3000; 03-31-2006 at 01:06 PM.
 
Old 03-31-2006, 01:46 PM   #2
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD
Posts: 2,032

Rep: Reputation: 309Reputation: 309Reputation: 309Reputation: 309
There are a couple of ways. Here's what I did: Create a file, /etc/init.d/firewall, with the contents below. Do this as root, and make the file mode 700 for security (e.g., chmod 700 /etc/init.d/firewall)
Code:
#!/bin/sh
IPTABLES=/sbin/iptables
case "$1" in
start)
        echo -n "Starting IP Firewall ... "
        # Clear any existing rules, zero counters
        $IPTABLES -t nat    -F
        $IPTABLES -t mangle -F
        $IPTABLES -t filter -F
        $IPTABLES -Z
        # Set default policies
        $IPTABLES -P INPUT   DROP
        $IPTABLES -P FORWARD DROP
        $IPTABLES -P OUTPUT  ACCEPT
        # Allow loopback
        $IPTABLES -A INPUT -i lo -j ACCEPT
        # Allow packets from established or related connections
        # This rule affects all protocols (tcp, udp, icmp)
        $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
        # Allow incoming SSH
        $IPTABLES -A INPUT -p tcp --dport ssh -j ACCEPT
        echo "done"
        ;;
stop)
        echo -n "Stopping IP Firewall ... "
        # Clear any existing rules, zero counters
        $IPTABLES -t nat    -F
        $IPTABLES -t mangle -F
        $IPTABLES -t filter -F
        $IPTABLES -Z
        # Allow everything
        $IPTABLES -P INPUT   ACCEPT
        $IPTABLES -P FORWARD ACCEPT
        $IPTABLES -P OUTPUT  ACCEPT
        echo "done"
        ;;
restart)
        echo -n "Restarting IP Firewall ... "
        # Stop, then start
        $0 stop  > /dev/null
        sleep 1
        $0 start > /dev/null
        echo "done"
        ;;
lock|lockdown|panic|shutdown|deny|denyall)
        echo -n "Locking down IP Firewall (disallow all network traffic) ... "
        # Clear any existing rules, zero counters
        $IPTABLES -t nat    -F
        $IPTABLES -t mangle -F
        $IPTABLES -t filter -F
        $IPTABLES -Z
        # Shut everything down
        $IPTABLES -P INPUT   DROP
        $IPTABLES -P FORWARD DROP
        $IPTABLES -P OUTPUT  DROP
        # Allow loopback (LOCALHOST, 127.0.0.1)
        $IPTABLES -A INPUT -i lo -j ACCEPT
        echo "done"
        ;;
*)
        echo "Usage: $0 {start|stop|restart|panic}"
        ;;
esac
Then I executed the following commands (as root):
Code:
# ln -s /etc/init.d/firewall /etc/rc2.d/S20firewall
# ln -s /etc/init.d/firewall /etc/rc3.d/S20firewall
# ln -s /etc/init.d/firewall /etc/rc4.d/S20firewall
# ln -s /etc/init.d/firewall /etc/rc5.d/S20firewall
# /etc/init.d/firewall start
 
Old 03-31-2006, 01:49 PM   #3
lx3000
LQ Newbie
 
Registered: Mar 2006
Distribution: Red Hat Enterprise Linux 4, Fedora Core 7
Posts: 26

Original Poster
Rep: Reputation: 15
Solution Found

Ok, I found the missing command : it was iptables-save > /etc/sysconfig/iptables. This command really did save all my rules, but if you have a better solution I will always be glad to hear it !!!
 
Old 03-31-2006, 01:57 PM   #4
lx3000
LQ Newbie
 
Registered: Mar 2006
Distribution: Red Hat Enterprise Linux 4, Fedora Core 7
Posts: 26

Original Poster
Rep: Reputation: 15
thanks haertig

Thanks, that script really did work !!! .And One more thing what do you think, should I close the 111 port (it's used by rpcbind) ? I've done a bit of researching on the web on this topic, well some say you have to block it others say you must now - so right now I've left it open and am waiting for some definite advice !!!

P.S.: I know that it has nothing to do with the topic but........:-)
 
Old 03-31-2006, 02:33 PM   #5
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD
Posts: 2,032

Rep: Reputation: 309Reputation: 309Reputation: 309Reputation: 309
Quote:
Originally Posted by lx3000
...should I close the 111 port (it's used by rpcbind) ?
portmap uses this port. I think this may be needed by desktop environments like Gnome or KDE (I'm not 100% sure about this though).

I limited mine to only LISTEN on the local adapter, allowing Gnome/KDE to connect if required, but stopping other systems from connecting. On my Debian system this was done by editing /etc/default/portmap and adding:
Code:
OPTIONS="-i 127.0.0.1"
...then running "/etc/init.d/portmap restart". I then verified things were good, like this:
Code:
# netstat -anp | grep 111
tcp  0  0 127.0.0.1:111   0.0.0.0:*   LISTEN   4583/portmap
udp  0  0 127.0.0.1:111   0.0.0.0:*            4583/portmap

Last edited by haertig; 03-31-2006 at 02:35 PM.
 
Old 03-31-2006, 02:41 PM   #6
JakeX
Member
 
Registered: Aug 2004
Location: Windsor Ontario
Distribution: Ubuntu, Debian, Redhat
Posts: 44

Rep: Reputation: 15
thanks for the script too
Very usefull, and easy to modify to your own needs. Saves me some legwork.
 
Old 03-31-2006, 03:17 PM   #7
dopehouse
Member
 
Registered: May 2004
Location: Hildesheim(Germany)
Distribution: Debian Etch with Kernel 2.6.x (latest vanila)
Posts: 62

Rep: Reputation: 15
I think it's a good idea, if you ACCEPT all traffic on the loopback device, because many services use that to communicate with other services or just with themself. So doing an
Code:
#LOOPBACK
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
at the head of your script is an very good idea.

If you want to use iptables-save, than you have to use iptables-restore to load that saved table. I have an script with all my rules, where I can experiment with some rules to test some new things (and some old ). Than I added this to my /etc/network/interfaces
Code:
iface ra0 inet dhcp
        pre-up iptables-restore < /etc/iptables/only_ssh.iptable
        pre-down iptables-restore < /etc/iptables/clear_table.iptable
/etc/iptables/ is made by myself and only_ssh.iptable is the outputfile from iptables-save after I loaded my rulescript. clear_table.iptable is also created by iptables-save with no rules loaded into the iptables. ra0 is my wlan-device.
 
Old 03-31-2006, 03:54 PM   #8
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD
Posts: 2,032

Rep: Reputation: 309Reputation: 309Reputation: 309Reputation: 309
I just noticed a bug in the "lockdown" section of my script:
Code:
        # Shut everything down
        $IPTABLES -P INPUT   DROP
        $IPTABLES -P FORWARD DROP
        $IPTABLES -P OUTPUT  DROP
        # Allow loopback (LOCALHOST, 127.0.0.1)
        $IPTABLES -A INPUT -i lo -j ACCEPT
...because I set the default policy for OUTPUT to DROP when in lockdown, adding only an INPUT rule to allow loopback probably won't work. You should add an OUTPUT rule as well. I've never actually paniced and attempted firewall lockdown before. Thanks for pointing this out, dopehouse. Everywhere else in the script (the "start" and "stop" sections) the default policy for OUTPUT is ACCEPT, so you don't need a specific OUTPUT rule for loopback.

e.g., (note the addition of the OUTPUT rule just prior to the echo "done" statement)
Code:
lock|lockdown|panic|shutdown|deny|denyall)
        echo -n "Locking down IP Firewall (disallow all network traffic) ... "
        # Clear any existing rules, zero counters
        $IPTABLES -t nat    -F
        $IPTABLES -t mangle -F
        $IPTABLES -t filter -F
        $IPTABLES -Z
        # Shut everything down
        $IPTABLES -P INPUT   DROP
        $IPTABLES -P FORWARD DROP
        $IPTABLES -P OUTPUT  DROP
        # Allow loopback (LOCALHOST, 127.0.0.1)
        $IPTABLES -A INPUT -i lo -j ACCEPT
        $IPTABLES -A OUTPUT -i lo -j ACCEPT
        echo "done"
        ;;$
 
Old 03-31-2006, 05:02 PM   #9
dopehouse
Member
 
Registered: May 2004
Location: Hildesheim(Germany)
Distribution: Debian Etch with Kernel 2.6.x (latest vanila)
Posts: 62

Rep: Reputation: 15
Wink

Quote:
Originally Posted by haertig
Everywhere else in the script (the "start" and "stop" sections) the default policy for OUTPUT is ACCEPT, so you don't need a specific OUTPUT rule for loopback.
Better twice than not at all
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
gnome-volume-manager falls back to read-only on write error galeru Linux - Software 1 01-23-2006 10:28 AM
Improve on default FC2 iptables firewall? Simon Bridge Linux - Security 1 05-26-2005 01:09 AM
Venting : Back From ReBoot-HELL.... Megamieuwsel General 7 10-02-2004 07:19 AM
Problem with pkgtool. Falls back to main menu PurpleMotion Slackware 5 05-12-2004 10:48 AM
iptables firewall rules not surviving reboot BurceB7 Linux - Newbie 3 03-11-2004 12:45 PM


All times are GMT -5. The time now is 10:28 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration