LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices



Reply
 
Search this Thread
Old 10-11-2013, 05:22 PM   #1
austinramsay
Member
 
Registered: Jul 2007
Distribution: Solaris 10/09
Posts: 260

Rep: Reputation: 30
How to permanently set iptables rules


How do I save my iptables rules? I used iptables-save but after reboot they were gone. Can I just add everything to my /etc/rc.d/rc.local so it sets on boot?
 
Old 10-11-2013, 05:39 PM   #2
sebre
LQ Newbie
 
Registered: Jun 2013
Location: France
Distribution: Slackware
Posts: 9

Rep: Reputation: Disabled
You just have to write your iptables rules in /etc/rc.d/rc.firewall (create the file if it does not exist) and make it executable.

Paragraph "Setup a Firewall" of http://docs.slackware.com/howtos:sec...basic_security
 
2 members found this post helpful.
Old 10-11-2013, 07:55 PM   #3
manwichmakesameal
Member
 
Registered: Aug 2006
Distribution: Slackware
Posts: 800

Rep: Reputation: 100Reputation: 100
You can use iptables-save, but you'll have to use iptables-restore after you reboot to put your rules into effect again. I would/do use an /etc/rc.d/rc.firewall script. AlienBob has an excellent script generator here.

Last edited by manwichmakesameal; 10-11-2013 at 07:56 PM. Reason: Forgot a space......
 
1 members found this post helpful.
Old 10-11-2013, 08:05 PM   #4
Woodsman
Senior Member
 
Registered: Oct 2005
Distribution: Slackware 14.1
Posts: 3,482

Rep: Reputation: 534Reputation: 534Reputation: 534Reputation: 534Reputation: 534Reputation: 534
Quote:
I would/do use an /etc/rc.d/rc.firewall script. AlienBob has an excellent script generator here.
Pat, Eric, how about in Current adding an "empty" rc.firewall script container and in the script provide a link to Eric's iptables generator? Here, like this:

Code:
#!/bin/sh
# /etc/rc.d/rc.firewall

# Start/Stop/Restart iptables firewall rules.

# Generate a custom rc.firewall script for Slackware:
# http://www.slackware.com/~alien/efg/
 
3 members found this post helpful.
Old 10-12-2013, 02:28 AM   #5
kikinovak
Senior Member
 
Registered: Jun 2011
Location: Montpezat (South France)
Distribution: Slackware, Slackware64
Posts: 1,949

Rep: Reputation: 971Reputation: 971Reputation: 971Reputation: 971Reputation: 971Reputation: 971Reputation: 971Reputation: 971
Quote:
Originally Posted by Woodsman View Post
Pat, Eric, how about in Current adding an "empty" rc.firewall script container and in the script provide a link to Eric's iptables generator? Here, like this:

Code:
#!/bin/sh
# /etc/rc.d/rc.firewall

# Start/Stop/Restart iptables firewall rules.

# Generate a custom rc.firewall script for Slackware:
# http://www.slackware.com/~alien/efg/
Excellent idea. And still in the KISS spirit.
 
Old 10-12-2013, 05:10 AM   #6
sebre
LQ Newbie
 
Registered: Jun 2013
Location: France
Distribution: Slackware
Posts: 9

Rep: Reputation: Disabled
Quote:
Originally Posted by Woodsman View Post
Pat, Eric, how about in Current adding an "empty" rc.firewall script container and in the script provide a link to Eric's iptables generator?
Why not build a curses "firewall-config" from Eric's web generator and add it to slack wizards (netconfig, ...) ? The tool is already so good and KISS that such a standalone converted generator would seem natural in a Slack release.

Just to keep Slackware CD/DVD install self sufficient.
 
1 members found this post helpful.
Old 10-12-2013, 12:32 PM   #7
austinramsay
Member
 
Registered: Jul 2007
Distribution: Solaris 10/09
Posts: 260

Original Poster
Rep: Reputation: 30
I don't need anything complicated, just these 5 rules.

Can I just put this into rc.firewall:

#!/bin/sh

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat PREROUTING -p tcp -i wlan0 --dport 22 -j DNAT --to 192.168.200.100
iptables -t nat PREROUTING -p tcp -i wlan0 --dport 80 -j DNAT --to 192.168.200.100
iptables -A FORWARD -p tcp -d 192.168.200.100 --dport 22 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.200.100 --dport 80 -j ACCEPT
 
Old 10-12-2013, 12:46 PM   #8
willysr
Senior Member
 
Registered: Jul 2004
Location: Jogja, Indonesia
Distribution: Slackware-Current
Posts: 2,621

Rep: Reputation: 445Reputation: 445Reputation: 445Reputation: 445Reputation: 445
Why not in rc.local?
 
Old 10-12-2013, 10:48 PM   #9
MadMaverick9
Member
 
Registered: Aug 2010
Location: Here
Distribution: Slackware 14.0
Posts: 147

Rep: Reputation: Disabled
Quote:
Originally Posted by willysr View Post
Why not in rc.local?
Because ...

In "/etc/rc.d/rc.inet2":
Code:
# If there is a firewall script, run it before enabling packet forwarding.
# See the HOWTOs on http://www.netfilter.org/ for documentation on
# setting up a firewall or NAT on Linux.  In some cases this might need to
# be moved past the section below dealing with IP packet forwarding.
if [ -x /etc/rc.d/rc.firewall ]; then
  /etc/rc.d/rc.firewall start
fi
My "/etc/rc.d/rc.firewall":
Code:
#!/bin/sh

firewall_start() {
  if [ -f /etc/iptables.rules ]; then
    /usr/sbin/iptables-restore < /etc/iptables.rules
  fi
}

firewall_stop() {
  /usr/sbin/iptables --flush
}

firewall_restart() {
  /usr/sbin/iptables --flush
  if [ -f /etc/iptables.rules ]; then
    /usr/sbin/iptables-restore < /etc/iptables.rules
  fi
}

case "$1" in
'start')
  firewall_start
  ;;
'stop')
  firewall_stop
  ;;
'restart')
  firewall_restart
  ;;
*)
  echo "usage $0 start|stop|restart"
esac
 
2 members found this post helpful.
Old 10-12-2013, 11:44 PM   #10
willysr
Senior Member
 
Registered: Jul 2004
Location: Jogja, Indonesia
Distribution: Slackware-Current
Posts: 2,621

Rep: Reputation: 445Reputation: 445Reputation: 445Reputation: 445Reputation: 445
I used to put all the post configuration script to rc.local, thus i need to see one file only and it will contain all the changes and configuration on my system

But then, it's a matter of preference
 
Old 10-13-2013, 03:41 AM   #11
kikinovak
Senior Member
 
Registered: Jun 2011
Location: Montpezat (South France)
Distribution: Slackware, Slackware64
Posts: 1,949

Rep: Reputation: 971Reputation: 971Reputation: 971Reputation: 971Reputation: 971Reputation: 971Reputation: 971Reputation: 971
Quote:
Originally Posted by willysr View Post
I used to put all the post configuration script to rc.local, thus i need to see one file only and it will contain all the changes and configuration on my system

But then, it's a matter of preference
Here's my rc.local on a public server:
Code:
#!/bin/sh
#
# /etc/rc.d/rc.local:  Local system initialization script.
#
# Put any local startup commands in here.  Also, if you have
# anything that needs to be run at shutdown time you can
# make an /etc/rc.d/rc.local_shutdown script and put those
# commands in there.

# Start Icecast server
if [ -x /etc/rc.d/rc.icecast ]; then
  /etc/rc.d/rc.icecast start
fi

# Start MPD server
if [ -x /etc/rc.d/rc.mpd ]; then
  /etc/rc.d/rc.mpd start
fi

# Start Postgrey mail filter 
if [ -x /etc/rc.d/rc.postgrey ]; then
  /etc/rc.d/rc.postgrey start
fi

# Start Postfix mail server 
if [ -x /etc/rc.d/rc.postfix ]; then
  /etc/rc.d/rc.postfix start
fi

# Start Dovecot mail server 
if [ -x /etc/rc.d/rc.dovecot ]; then
  /etc/rc.d/rc.dovecot start
fi

# Chip drivers
/sbin/modprobe coretemp
/usr/bin/sensors -s
And here's rc.firewall on this same machine:

Code:
#!/bin/sh
#
# /etc/rc.d/rc.firewall

IPT=$(which iptables)
MOD=$(which modprobe)
IFACE_INET=eth0

function start {
  
  # Les connexions entrantes sont bloquées par défaut.
  $IPT -P INPUT DROP

  # Les connexions sortantes sont acceptées par défaut.
  $IPT -P OUTPUT ACCEPT

  # Pas de filtrage sur la boucle locale.
  $IPT -A INPUT -i lo -j ACCEPT

  # Accepter les messages ICMP importants.
  $IPT -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
  $IPT -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
  $IPT -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT

  # Accepter les paquets entrants relatifs à des connexions déjà établies. Cela
  # va plus vite que de devoir réexaminer toutes les règles pour chaque paquet.
  $IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

  # Accepter SSH avec une limite d'une tentative de connexion par minute
  $IPT -A INPUT -p tcp -i $IFACE_INET --dport 22 -m state --state NEW \
   -m recent --set --name SSH
  $IPT -A INPUT -p tcp -i $IFACE_INET --dport 22 -m state --state NEW \
   -m recent --update --seconds 60 --hitcount 2 --rttl --name SSH -j DROP
  $IPT -A INPUT -p tcp -i $IFACE_INET --dport 22 -j ACCEPT

  # Accepter les requêtes SMTP 
  $IPT -A INPUT -p tcp -i $IFACE_INET --dport 25 -j ACCEPT

  # Accepter les requêtes DNS
  $IPT -A INPUT -p tcp -i $IFACE_INET --dport 53 -j ACCEPT
  $IPT -A INPUT -p udp -i $IFACE_INET --dport 53 -j ACCEPT

  # Autoriser le serveur HTTP 
  $IPT -A INPUT -p tcp -i $IFACE_INET --dport 80 -j ACCEPT

  # Autoriser le serveur HTTPS
  $IPT -A INPUT -p tcp -i $IFACE_INET --dport 443 -j ACCEPT

  # Accepter les requêtes SMTP (Thunderbird)
  $IPT -A INPUT -p tcp -i $IFACE_INET --dport 587 -j ACCEPT

  # Accepter les requêtes IMAPS
  $IPT -A INPUT -p tcp -i $IFACE_INET --dport 993 -j ACCEPT

  # Autoriser le serveur Icecast 
  $IPT -A INPUT -p tcp -i $IFACE_INET --dport 8000 -j ACCEPT

  # Enregistrer la trace des paquets rejetés
  $IPT -A INPUT -j LOG --log-prefix "+++ IPv4 packet rejected +++"
  $IPT -A INPUT -j REJECT
  
}

function stop {
  $IPT -t filter -P INPUT ACCEPT
  $IPT -t filter -P OUTPUT ACCEPT
  $IPT -t filter -P FORWARD ACCEPT
  $IPT -t nat -P POSTROUTING ACCEPT
  $IPT -t nat -P PREROUTING ACCEPT
  $IPT -t nat -P OUTPUT ACCEPT
  $IPT -t filter -F
  $IPT -t nat -F
  $IPT -X
}

# Commandes : rc.firewall { start | restart | stop | status }
case $1 in 
  start)
          echo "Starting firewall."
          stop
          start
  ;;
  stop)
          echo "Stopping firewall."
          stop
  ;;
  restart)
          echo "Stopping firewall."
          stop
          echo "Starting firewall."
          start
  ;;
  status)
          $IPT -L -v -n
  ;;
  *)
  echo "Usage: $0 {start|stop|restart|status}"
esac
Mixing these two up would result in quite an unholy mess. YMMV, of course.

Cheers,

Niki
 
1 members found this post helpful.
Old 10-13-2013, 12:18 PM   #12
rg3
Member
 
Registered: Jul 2007
Distribution: Slackware Linux
Posts: 514

Rep: Reputation: Disabled
Quote:
Originally Posted by MadMaverick9 View Post
Code:
firewall_stop() {
  /usr/sbin/iptables --flush
}
Note this will work in most cases, but does not reset iptables to its default state, really. In particular, it won't delete non-builtin chains or restore default chain policies. This is my stop() function from rc.firewall, which otherwise is pretty similar to yours.

Code:
function stop()
{
        echo "Resetting all iptables chains."
        /usr/sbin/iptables -t filter -P INPUT ACCEPT
        /usr/sbin/iptables -t filter -P FORWARD ACCEPT
        /usr/sbin/iptables -t filter -P OUTPUT ACCEPT
        /usr/sbin/iptables -t nat -P PREROUTING ACCEPT
        /usr/sbin/iptables -t nat -P POSTROUTING ACCEPT
        /usr/sbin/iptables -t nat -P OUTPUT ACCEPT
        /usr/sbin/iptables -t mangle -P PREROUTING ACCEPT
        /usr/sbin/iptables -t mangle -P INPUT ACCEPT
        /usr/sbin/iptables -t mangle -P FORWARD ACCEPT
        /usr/sbin/iptables -t mangle -P OUTPUT ACCEPT
        /usr/sbin/iptables -t mangle -P POSTROUTING ACCEPT
        /usr/sbin/iptables -t filter -F
        /usr/sbin/iptables -t filter -X
        /usr/sbin/iptables -t nat -F
        /usr/sbin/iptables -t nat -X
        /usr/sbin/iptables -t mangle -F
        /usr/sbin/iptables -t mangle -X
}
 
1 members found this post helpful.
Old 10-13-2013, 12:29 PM   #13
Stuferus
Member
 
Registered: Jun 2013
Location: Germany
Distribution: Slackware
Posts: 144

Rep: Reputation: Disabled
if you want to save iptables rules and use ppp or pppoe on the system you want to save the rules, you could do it like me.. i have all my iptables stuff in /etc/ppp/firewall-masq thats a standard file pppoe-setup will ask if you want to use it.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Problems with iptables > Rules set but not working effektive tiuz Linux - Security 5 08-28-2013 03:55 PM
Set iptables rules from Kernel Module saurabhchokshi Programming 5 05-02-2009 12:10 AM
how to save iptables firewall rules permanently sunlinux Linux - Security 3 12-07-2006 12:53 PM
Permanently Adding iptable rules GUIPenguin Linux - Networking 2 10-13-2004 12:27 AM
startup script to set up iptables rules doesn't run alexfittyfives Debian 2 06-01-2004 08:21 PM


All times are GMT -5. The time now is 09:43 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration