On Wed, 2004-12-29 at 13:03, Jason Williams wrote: > Morning. > > Well, spent a better part of the night playing with IPTables. Tried out > some rules, tweaked this, broke that. Was a lot of fun. > > Anyway, as I am getting ready to make one of my servers go live, I realized > something that I completely overlooked. Very important thing I might add. > > Basically, once you put all your rules into IPTables via the command line, > how do you save your rules? I saw a command, iptables-save, but that just > outputs the rules in a readable format. > > I started thinking and came up with the following: > > 1) Does iptables read the init script in /etc/init.d/ upon bootup of a > server/box and use those rules for the system? > > or > > 2) Does it read a plain text file some where an use those rules instead? > > wasn't quite sure and since im going on 22 hours without sleep, im positive > I missed it some where. > > With that in mind, was hoping someone could fill in the details. > > IF it is the case the the system reads the iptables init script upon > bootup/restart, that means I need to work on my scripting. :) > > Anyways, hoping for a little clarity here. > > Cheers, > > > Jason The way I've typically seen it work is that the init.d/iptables script calls iptables-restore and passes it the /etc/sysconfig/iptables file. This file is written when you do init.d/iptables save. If you really want to get fancy, you can save separate files in the iptables-restore syntax (not particularly well documented) and adapt the iptables script. We do this in the ISCS network security management project (http://iscs.sourceforge.net) to first boot the gateway into a "safe" mode, i.e., almost nothing but DNS, NTP and SSH allowed. We then do things like set up specialized routing, enable the VPN and then load a series of shared and local configuration files using iptables-restore -n Hope this makes sense after you get some sleep :-( ) (big yawn) -- John A. Sullivan III Open Source Development Corporation Financially sustainable open source development http://www.opensourcedevel.com
