Visham Ramsurrun wrote:
I was once told that in order to start a firewall automatically when a
machine boots, we must make sure that the init process calls the
script by making a symbolic link to that file in the /etc/rc.d/rcX.d
directories.
This is not an iptables / netfilter issue. Different distros do this in
different ways. Take this up in your distro's documentation or an
appropriate forum.
That said ... I agree with what Robert told you.
Let's say I have a firewall script called fw.sh with the following rules in it:
This IS a netfilter issue.
$IPT -F
$IPT -X
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP
$IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
-m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
request -j ACCEPT
$IPT -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d 192.168.10.0/24
-m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
reply -j ACCEPT
You are only planning to relay pings on your eth0 subnet,
192.168.10.0/24. All INPUT and OUTPUT packets are dropped, including
loopback.
This machine won't be performing any useful network service. I strongly
suspect that your FORWARD rules will never be hit. Are other machines on
192.168.10.0/24 (eth0) routing through this one somehow?
--
mail to this address is discarded unless "/dev/rob0"
or "not-spam" is in Subject: header
