Location iptables config file

freakin'me · 08-12-2005, 02:51 AM

Hi,

I just installed debian, and want to configure iptables. Where can I find the configuratio file?

Regards,

Freakin'me

Ephracis · 08-12-2005, 02:54 AM

I do not think that Debian has one itself. You can make your own script and put it into the rc.d-folder to make it start on boot.

freakin'me · 08-12-2005, 02:57 AM

I suppose you mean /etc/rc.d/ but that's exactly the tricky thing, I don't have that dir. I do have rc0.d up to rc6.d so I still do not know which one I should have.

I installed iptables using apt-get, maybe that does matter?

Ephracis · 08-12-2005, 03:20 AM

Yes, debian has rcX.d

The number X stands for different runlevels. You should put your script in init.d and then make a symlink to the rcX.d for which runlevel you want your script to run at.

Here's a good guide on the subject: http://www.tldp.org/HOWTO/From-Power...t-HOWTO-6.html

EDIT: via apt-get? I thought iptables came with Debian by default. Anyway, it should not matter. As long as you can handle iptables you will be fine making your own script.

If you are having troubles remembering everything you can always check the man pages. if you do not want to write your own iptables script you can google for some examples.

freakin'me · 08-12-2005, 03:35 AM

If I put that script in init.d, how does iptables know that it is intended for iptables?

For me being a linux noob, I've got one question left, how do I make an symlink?

Thanks for your help.

Ephracis · 08-12-2005, 03:54 AM

Quote:

If I put that script in init.d, how does iptables know that it is intended for iptables?

The script is actually a shell script, it just issues some iptables commands.

Quote:

For me being a linux noob, I've got one question left, how do I make an symlink?

ln -s /from/where /to/destination
man ln for more info.

EDIT:
Here you have my script:

Code:

#!/bin/sh

# flush the tables
iptables -F
iptables -Z

# drop everything by default
iptables -P INPUT DROP


# EXTERNAL

# ssh
iptables -A INPUT -s 0/0 -p tcp --dport 841 -j ACCEPT
# msn
iptables -A INPUT -s 0/0 -p tcp --dport 6891:6900 -j ACCEPT
# torrent
iptables -A INPUT -s 0/0 -p tcp --dport 6881:6889 -j ACCEPT
iptables -A INPUT -s 0/0 -p udp --dport 6881:6889 -j ACCEPT


# LOCAL

# kismet
iptables -A INPUT -i lo -p tcp --dport 2501 -j ACCEPT
# mysql
iptables -A INPUT -i lo -p tcp --dport 3306 -j ACCEPT


# accept already established connections
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

/bin/bash · 08-12-2005, 05:43 AM

Save yourself alot of time:

apt-get install guarddog

FYI, in debian all the startup scripts are located in /etc/init.d. The directories /etc/rc?.d are runlevel directories which contain symlinks to the scripts in /etc/init.d. The symlink will cause the script to start or stop depending on weather the symlink starts with an S or a K, e.g.
/etc/rc3.d/S20guarddog -> ../init.d/guarddog
The above symlink would cause guarddog to start when you enter runlevel 3 (/sbin/init 3.)
/etc/rc0.d/K20guarddog -> ../init.d/guarddog
If you do a shutdown the above symlink would cause guarddog to stop, the K stands for kill.

If you have an iptables script you really want to use, go ahead and install guarddog then put your iptables script here:
/etc/rc.firewall
Make sure it's executable. Then guarddog will start your script instead of its own.

DarkNeo · 08-13-2005, 02:26 PM

Why you must use a firewall for the normal pc the firewall is unuseful try to close the service by #.
If you are sure to use the firewall in slackware you must created one file "rc.firewall" chmod 755 in /etc/rc.d/ and here u can put all rules.
ByE

fouldsy · 08-14-2005, 07:30 AM

An alternative using a full script is simply call

Code:

iptables-save > /path/to/save

to save your current rules to disk, then at boot simply execute

Code:

iptables-restore < /path/to/save

That way, if you make any adjustments to your filtering rules, you simply execute iptables-save again to update your saved ruleset, and the new rules will be loaded at next boot.

harken · 08-14-2005, 07:57 AM

Quote:

Originally posted by DarkNeo
Why you must use a firewall for the normal pc the firewall is unuseful

Yeah, sure...you can't be serious, right?

Quote:

Originally posted by freakin'me
If I put that script in init.d, how does iptables know that it is intended for iptables?

When the computer enters one of the runlevels which correspond to a certain rcX.d, it will read, line by line, and execute the scripts having an 'S' at the beginning of their name. And while the script contains commands that invoke /sbin/iptables, it's all taken care of.

freakin'me · 08-14-2005, 08:01 AM

I've planned to use my server as a gateway as well, and I can't do anything about it, but then you need to configure some sort of firewall.........