| View previous topic :: View next topic |
| Author |
Message |
Rylan
n00b
Joined: 08 May 2002
Posts: 41
|
 Posted: Thu Jun 06, 2002 3:30 pm Post subject: Bringing up the iptables /etc/init.d script *before* eth0 |
 |
|
I just started playing around with init scripts. So if I do something boneheaded in this tip, I'd like to know. With that in mind, here's how I got my iptables ruleset to load before bringing up my external interface.
In my box I have eth0 connected to my cablemodem (uses dhcp) and eth1 connected to my internal network (which is NAT'd).
First, setup whatever iptables rules you need. I modified this script to suite my needs. http://www.linuxguruz.org/iptables/scripts/rc.DHCP.firewall.txt. Make sure you modfie the | Code: | | $IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT |
rule, because $INET_IP isn't defined by default.
When you have a working set of rules | Code: | mkdir /var/lib/iptables
iptables-save > /var/lib/iptables/rules-save
rc-update add iptables default |
I had to make the /var/lib/iptables directory because it didn't exist, and the /etc/conf.d/iptables automatically looks there. Alternatively, you could just change where the /etc/conf.d/iptables file looks for saved rulesets.
Next, in /etc/init.d/net.eth0, change the depend section so that | Code: | depend() {
use pcmcia
}
|
looks like | Code: | depend() {
need iptables
use pcmcia
}
|
After a reboot eth0 came up after iptables, but eth1 was still coming up before both of them!
I tried many things with net.eth1 to make it come up *after* eth0 but nothing worked ("need net.eth0" "need iptables" "after net.eth0" etc). Now maybe I'm anal-retentive (note the use of the hypen  ), but I wanted eth1 to come up after eth0. Here's how I fixed it.
In /etc/init.d/iptables it has this depend section | Code: | depend() {
need net logger
} |
Aha! So it was starting net.eth1 because it needed net! It doesn't really so just remove net from there and it works.
I also added my echo "1" > /proc/sys/net/ipv4/ip_forward command to the iptables runscript, just so I didn't have to use it in /etc/conf.d/local.start.
I felt this was more gentoo-ish than the rc.local firewall method I was using  . |
|
| Back to top |
|
 |
james
n00b
Joined: 24 Apr 2002
Posts: 56
Location: Middle Smithfield, PA
|
| Posted: Thu Jun 06, 2002 7:52 pm Post subject: |
|
|
Nice.
I renamed iptables to biptables.
Now it starts before E
J
_________________
17 Opps It's 19 now Gentoo's and counting |
|
| Back to top |
|
|
headly
n00b
Joined: 21 Jun 2002
Posts: 46
|
| Posted: Thu Jul 04, 2002 10:17 pm Post subject: ip_forward |
|
|
it is also possible to use /etc/sysctl.conf to set ip_forward.
it is parsed by some script in boot runlevel. |
|
| Back to top |
|
|
cbrese
Tux's lil' helper
Joined: 12 Jul 2002
Posts: 126
Location: San Diego, CA
|
| Posted: Thu Dec 19, 2002 7:51 pm Post subject: |
|
|
What I did was modify /etc/init.d/iptables to remove
and then in /etc/init.d/net.eth0 I added
I wonder why it wasn't setup that way to begin with, did I do something wrong? |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Documentation, Tips & Tricks
