You want to load your firewall rules, e.g., at boot time.
Use ipchains-restore or iptables-restore. Assuming you've saved your firewall configuration in /etc/sysconfig: [Recipe 2.19]
For iptables:
#!/bin/sh echo 1 > /proc/sys/net/ipv4/ip_forward (optional) iptables-restore < /etc/sysconfig/iptables
For ipchains:
#!/bin/sh echo 1 > /proc/sys/net/ipv4/ip_forward (optional) ipchains-restore < /etc/sysconfig/ipchains
To tell Red Hat Linux that firewall rules should be loaded at boot time:
# chkconfig iptables on # chkconfig ipchains on
Place the load commands in one of your system rc files. Red Hat Linux already has rc files "iptables" and "ipchains" in /etc/init.d that you can simply enable using chkconfig. SuSE Linux, in contrast, has a script /sbin/SuSEpersonal-firewall that invokes iptables or ipchains rules, and it's optionally started by /etc/init.d/personal-firewall.initial and /etc/init.d/personal-firewall.final at boot time.
To roll your own solution, you can write a script like the following and invoke it from an rc file of your choice:
#!/bin/sh
# Uncomment either iptables or ipchains
PROGRAM=/usr/sbin/iptables
#PROGRAM=/sbin/ipchains
FIREWALL=`/bin/basename $PROGRAM`
RULES_FILE=/etc/sysconfig/${FIREWALL}
LOADER=${PROGRAM}-restore
FORWARD_BIT=/proc/sys/net/ipv4/ip_forward
if [ ! -f ${RULES_FILE} ]
then
echo "$0: Cannot find ${RULES_FILE}" 1>&2
exit 1
fi
case "$1" in
start)
echo 1 > ${FORWARD_BIT}
${LOADER} < ${RULES_FILE} || exit 1
;;
stop)
${PROGRAM} -F # Flush all rules
${PROGRAM} -X # Delete user-defined chains
echo 0 > ${FORWARD_BIT}
;;
*)
echo "Usage: $0 start|stop" 1>&2
exit 1
;;
esac
Make sure you load your firewall rules for all appropriate runlevels where networking is enabled. On most systems this includes runlevels 2 (multiuser without NFS), 3 (full multiuser), and 5 (X11). Check /etc/inittab to confirm this, and use chkconfig to list the status of the networking service at each runlevel:
$ chkconfig --list network network 0:off 1:off 2:on 3:on 4:on 5:on 6:off
iptables-load(8), ipchains-load(8), iptables(8), ipchains(8).
 | Linux security |
Top
