Re: iptables as a stateful firewall

[joe <joe@xxxxxxxxxx>]

Justin Zygmont wrote:

> > > > Are the ip_conntrack_ftp and ip_nat_ftp
> > > > modules loaded?
> > > >        
> > > ahh, I didn't have ip_nat_ftp, now it does work.  thanks!  
> > >      
> > I was wondering where most people place "modprobe" statements so they start 
> > up during a reboot.  Is /etc/rc.d/rc.local okay or is there a "better" place?
> >
> > What about the above iptables addition?  The file /etc/sysconfig/iptables 
> > recommends against manual entry. 
> >    
>
> First I thought maybe /etc/modules.conf, but I put "insmod ip_nat_ftp" in 
> rc.local as you mentioned, and it works well.
Here are some lines from the beginning of
the netfilter script we call from rc.local -

<snip>

# all other modules will autoload -
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp

<snip>

Joe