We are in the process of implementing a firewall based on iptables. Our basic implementation is laid out, and now we are searching for every scrap that might improve security. One thing I'd like is the ability to "lock" the iptables configuration so that no further changes can be made (without rebooting). I don't see that iptables supports that directly. I would be willing to put my effort into such a project, although it's at the limits of my expertise. I have been trying to think of a way to emulate this behavior. The only reasonable idea I've had is using Linux Capabilities: http://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.4/capfaq-0.2.txt However, I'm not even sure how I'd apply that to iptables to prevent changes to the iptables chains. Thoughts? Kelly
