Ok, ive read everything, got a good few rules working and saved them using iptables-save > /iptrules

i know i can load it again with
cat /iptrules | iptables-restore

but how can i set it up so that iptables load that on bootup ?

everythime i restart, iptables is using the default Accept policy on everything and minimal rules.

thanX.

You can put the command in /etc/rc.d/rc.local and they will execute on startup. If you want to be really paranoid, you can find the script that sets up and starts your ethernet connection and put the lines there (on my system that is /etc/rc.d/rc.inet1) before the ethernet connection is set up.

rather than cloggin up files with iptables rules, make it its own script (some use rc.firewall, mine is firewall.sh) and rather than fill up a file that can be used for other things, you can just call your firewall script.

in my rc.local i have:

sh /etc/firewall.sh

as an example.

its only a 1 liner....
cat /iptables | iptables-restore

so i might aswell just slap it in

when ip booting, (just before the loopback interface is brough up)
i get messages that iptables is being flushed and restored...

so when does this rc.local scrip execute ?
if its before the loopback comes online, its just going to flush iptables anyway.

and since iptables always has some simple rules in it when ive booted, there myst be an existing rule file somwhere ?????

id prefere to directly change that if its possible, any ideas ??

I guess I've always worked off of separate iptables script files like Robert suggested rather than messing around with iptables-save and iptables-restore. I've got about 4 scripts for various purposes (usually opening and closing specific ports that I don't want open all the time). If I'm reading the iptables-save and -restore man pages correctly, they are just reading from either a file or standard input/output. There doesn't seem to be a default file that it is reading from. That said, you may want to go wandering through the scripts it /etc/rc.d and look for where iptables is being called. That should clear up why you're seeing the messages you are during boot up.

Finally, rc.local is the last thing run during the boot. That's why I suggested looking in the rc.inet1 file and putting your line in there. I see no reason why you should have a live connection that doesn't have a firewall, even if only for a few seconds.

I always use a custom script aswell. Then you only have to worry about one file.

I call my script iptables, put it in /etc/init.d/ and make sym links to it in /etc/rc.d/rc3.d

I make sure it loads before the network script loads, that way the firewall is in place before the network comes up.

Check my sig for the script, feel free to give it a try. You get much better control of what's going on in your system, also, if you need to make changes remotely, you have much better acces to a simple script than some RH interface.

my 2 cents