l i n u x - u s e r s - g r o u p - o f - d a v i s
L U G O D
 
Next Meeting:
November 4: Social gathering
Next Installfest:
TBD
Latest News:
Oct. 24: LUGOD election season has begun!
Page last updated:
2006 May 16 11:56

The following is an archive of a post made to our 'vox-tech mailing list' by one of its subscribers.

Report this post as spam:

(Enter your email address)
Re: [vox-tech] re: iptables questions
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [vox-tech] re: iptables questions




--- Cylar Z <cylarz@yahoo.com> wrote:

> I wrote a bash script as you suggested, one that
> inserts the rows into iptables. However, I still have
> to re-run that script every time the system reboots.
> 
> To get around the problem and make the rules
> permanent, I followed this advice:
> 
> "Use iptables-save and iptables-restore. You need to
> redirect the input/output, e.g. 'iptables-save >
> /root/iptables.conf', and put 'iptables-restore <
> /root/iptables.conf' in your rc.local."
> 
> Unfortunately, when I inserted the line
> "iptables-restore" in the rc.local file, the system
> hung during startup, and wouldn't start properly on
> its next reboot. I finally figured out that restoring
> rc.local to its original state would fix the problem,
> but now I'm back to square one. Ideas?
> 
> Also, is there any reason to think inserting that line
> would cause the system to mysteriously reboot on its
> own without my intervention? Because that is exactly
> what happened a few minutes after I edited rc.local.

There could be a few reasons why your machine hangs when you add these
lines to your /etc/rc.d/rc.local.  One reason is that maybe on bootup,
there is only a minimal environment, so there might be things missing
like things from $PATH or some other environment variables.

Did you try editing the /etc/sysconfig/iptables-config?

My suggestion is to try the /etc/sysconfig/iptables-config route
instead of putting scripts into /etc/rc.d/rc.local.

There are a couple of lines worth looking at:

IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"

Change these values to "yes", and things should be saved when you stop
iptables, or when you reboot (respectively).

And I always read ip addresses/network numbers from text files like
such:

#!/bin/bash

iptables -F
iptables -t nat -F

for i in `cat /root/allow_inbound`; do iptables -A INPUT -s $i -j
ACCEPT

for i in `cat /root/allow_forward`; do iptables -A FORWARD -s $i -j
ACCEPT

<etc>

Where /root/allow_inbound (and allow_forward) is a whitespace separated
list of ip addresses or networks.

Hope this helps out.  Post back if you need more help :)

--cheers

jan



<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><
I believe that unarmed truth and unconditional love will have the final word in reality. That is why right, temporarily defeated, is stronger than evil triumphant.
    Martin Luther King Jr., Accepting Nobel Peace Prize, Dec. 10, 1964
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
_______________________________________________
vox-tech mailing list
vox-tech@lists.lugod.org
http://lists.lugod.org/mailman/listinfo/vox-tech



LinkedIn
LUGOD Group on LinkedIn
Sign up for LUGOD event announcements
Your email address:
facebook
LUGOD Group on Facebook
'Like' LUGOD on Facebook:

Hosting provided by:
Sunset Systems
Sunset Systems offers preconfigured Linux systems, remote system administration and custom software development.

LUGOD: Linux Users' Group of Davis
PO Box 2082, Davis, CA 95617
Contact Us

LUGOD is a 501(c)7 non-profit organization
based in Davis, California
and serving the Sacramento area.
"Linux" is a trademark of Linus Torvalds.

Sponsored in part by:
O'Reilly and Associates
For numerous book donations.