rc.firewall not implementing at boot up

Jukas · 05-02-2005, 03:18 PM

For some reason my rc.firewall isn't implementing automatically at boot up anymore.

I'm running Debian (sarge) and I can watch the services and the eth0 int come up at a restart, at that point it should have executed my firewall, but I can still ping the box from my lan, and my friend on an outside connection can ping and map the services.

If I manually go in and bash the rc.firewall neither of us can ping it, and he can only map the services I've allowed through the firewall.

Any ideas as to why it's not executing at bootup anymore and how I fix it?

HappyTux · 05-02-2005, 03:26 PM

Quote:

Originally posted by Jukas
For some reason my rc.firewall isn't implementing automatically at boot up anymore.

I'm running Debian (sarge) and I can watch the services and the eth0 int come up at a restart, at that point it should have executed my firewall, but I can still ping the box from my lan, and my friend on an outside connection can ping and map the services.

If I manually go in and bash the rc.firewall neither of us can ping it, and he can only map the services I've allowed through the firewall.

Any ideas as to why it's not executing at bootup anymore and how I fix it?

Assuming you have the script in the /etc/init.d/ directory then update-rc.d rc.firewall defaults and it should create the startup and shutdown links for you.

Jukas · 05-02-2005, 04:34 PM

Quote:

Originally posted by HappyTux
Assuming you have the script in the /etc/init.d/ directory then update-rc.d rc.firewall defaults and it should create the startup and shutdown links for you.

Stephen,

I did that, and it re-added the symlink which wasn't there, however it doesn't seem to be processing the firewall still. On a fresh reboot I can ping the box from an outside source (which I shouldn't be able to) however if I ssh in or from the terminal bash the rc.firewall it processes correctly and I can't ping the box anymore.

HappyTux · 05-02-2005, 04:48 PM

Quote:

Originally posted by Jukas
Stephen,

I did that, and it re-added the symlink which wasn't there, however it doesn't seem to be processing the firewall still. On a fresh reboot I can ping the box from an outside source (which I shouldn't be able to) however if I ssh in or from the terminal bash the rc.firewall it processes correctly and I can't ping the box anymore.

And you have checked to make sure the rc.firewall is executable? What does the file look like anyways can you post it?

Jukas · 05-02-2005, 05:03 PM

Quote:

Originally posted by HappyTux
And you have checked to make sure the rc.firewall is executable? What does the file look like anyways can you post it?

It has (I believe) 655 permissions but here's a snip

nix:/etc/init.d# ls -l rc.firewall
-rw-r-xr-x 1 root root 897 2005-05-02 12:07 rc.firewall

The firewall itself is just a quick and dirty designed to open only a couple ports, block incoming ICMP requests and allow the box to use ping, trace, nmap etc.

Code:

#Change the part after the = to the where you IPTABLES is on your system
IPTABLES=/sbin/iptables

#flush existing rules
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p icmp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p tcp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p udp
$IPTABLES -A INPUT -p tcp --dport 20 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 216.229.107.32 --dport 3306 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 20 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 21 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 22 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 80 -j ACCEPT
$IPTABLES -A INPUT -p tcp -j REJECT
$IPTABLES -A INPUT -p ICMP -j DROP

I'm open to any opinions about what it's lacking btw

HappyTux · 05-02-2005, 05:25 PM

Quote:

Originally posted by Jukas
It has (I believe) 655 permissions but here's a snip

nix:/etc/init.d# ls -l rc.firewall
-rw-r-xr-x 1 root root 897 2005-05-02 12:07 rc.firewall

The firewall itself is just a quick and dirty designed to open only a couple ports, block incoming ICMP requests and allow the box to use ping, trace, nmap etc.

Code:

#Change the part after the = to the where you IPTABLES is on your system IPTABLES=/sbin/iptables #flush existing rules $IPTABLES -F INPUT $IPTABLES -F OUTPUT $IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p icmp $IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p tcp $IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p udp $IPTABLES -A INPUT -p tcp --dport 20 -j ACCEPT $IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT $IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT $IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT $IPTABLES -A INPUT -p tcp -s 216.229.107.32 --dport 3306 -j ACCEPT $IPTABLES -A OUTPUT -p tcp --dport 20 -j ACCEPT $IPTABLES -A OUTPUT -p tcp --dport 21 -j ACCEPT $IPTABLES -A OUTPUT -p tcp --dport 22 -j ACCEPT $IPTABLES -A OUTPUT -p tcp --dport 80 -j ACCEPT $IPTABLES -A INPUT -p tcp -j REJECT $IPTABLES -A INPUT -p ICMP -j DROP

I'm open to any opinions about what it's lacking btw

Well if that is the entire file the #!/bin/bash at the top of the file to tell bash it should be executing the commands.

TigerOC · 05-03-2005, 01:59 AM

The basics are covered in this article but the link to the page doesn't always work for some reason. I will summarise the steps in the article;

1. Place the rc.firewall script in /etc
2. make sure it's exectable (chmod 700 /etc/rc.firewall)
3. symlink to the runlevels to make the script initate during the boot process by doing;
ln -s /etc/rc.firewall /etc/rc2.d/S89rc.firewall
ln -s /etc/rc.firewall /etc/rc3.d/S89rc.firewall
ln -s /etc/rc.firewall /etc/rc4.d/S89rc.firewall
ln -s /etc/rc.firewall /etc/rc5.d/S89rc.firewall
(Tip here; after entering the first line, press tab and move back to rcX with the back arrow key and change to the next # and then move forward to the end of the line and press return which saves typing the command in all the time).

The script should be executed during boot.

abcampa · 05-03-2005, 07:49 AM

yeah i was going to say it may need to be: chmod 700 rc.firewall

for it to be executable.

Jukas · 05-03-2005, 11:58 AM

Thanks for the tips, the firewall is now executing at boot correctly.

Give that this was just a quick and dirty firewall I put together, is there anything you normall put in yours that I'm missing that you would recommend?

TigerOC · 05-04-2005, 01:22 AM

Personally I use MonMotha's firewall script which basically has everything I need but I use it on a server that has other boxes behind it. You'll find good basics on firewall scripting here .