when to start IPTables in RH9

From: Erik (et57)
Date: 07/25/04 

Date: Sun, 25 Jul 2004 14:52:00 +0200

I have an RH9 Linux system running as Router/FW.
IPTables 1.2.9 on it and running happily.

Would the following be a sound idea, as to maintainablility of the
IPTables rules and the effectiveness and security of the FW:

Immediately after the running of a script in /etc/rc3.d a partial
IPTables script must run, to open up the FW for any necessary
ports/protocols/etc. related to that /etc/rc3.d script.

example and problem:

just after running the /etc/rc.d/init.d/named script, the FW must be
opened for protocol UDP/port 53.
If it is not opened, the subsequent ntpd script would not work, for it
opens the FW for a few timeservers, not given by IP number, but by
FQN. And it would log a few packet refusals, if not opened
immediately.

same goes for other servers, that need specific ports open. (Or, more
general, need specific IPTables rules effective): samba, apache,
sendmail...

For this, I would make a parallel directory for the partial IPTables
scripts (eg. /etc/rc.d/iptables/S08named), which would be controlled
by a mechanism incorporated in the /etc/rc.d mechanism (S08named
things)

Question is, how would I incorporate this parallel mechanism in the
startup scripts and where ?

fr gr
Erik

Relevant Pages

  • Re: Help with Iptables on with RH linux
    ... iptables -P OUTPUT DROP ... INPUT only when packets have a destination IP of your firewall. ... the FORWARD chain contains rules that affect packets passing through ... Yes I flushed the rules before calling the script... ...
    (RedHat)
  • Re: some reality about iptables, please
    ... >>the script which can only be run by a root user. ... but it could re-inforce the fact that maybe running your iptables ... "I'm a packet filtering interface not a firewall tool." ... Generally Debian systems run at init runlevel 3 (this is a change if ...
    (Debian-User)
  • How to sensibly start IPtables ?
    ... I have an RH9 Linux system running as Router/FW. ... IPTables rules and the effectiveness and security of the FW: ... IPTables script must run, to open up the FW for any necessary ... opens the FW for a few timeservers, not given by IP number, but by ...
    (comp.security.firewalls)
  • Re: IPTABLES Beginner Example Needed!
    ... after i runned this script nothing works on my computer. ... > I think i just need the translation to iptables. ... $MODPROBE ip_conntrack ... # FORWARD chain rules ...
    (linux.redhat)
  • Re: Setting Up NTP for Time Sync
    ... > I've made no changes to the script file that I know of. ... called iptables after the command "iptables" that manipulates the ... The /etc/init.d/ntpd script is the one run when ntpd is started. ... [enter root password] ...
    (comp.os.linux.networking)