Normally iptables is automatically placed in /sbin. if you change this, update jts-firewall accordingly as well.from console wrote:# emerge iptables <enter>
To get these files simply grab the text off the screen and paste into your text editor, then save each as a file with the appropriate name. (Don't add the .txt extension to the file.) Put jts-firewall in your /sbin directory. Make sure you make it executable by root. Right-click on the file and select 'properties'. Then click on the permissions tab. and allow 'execute'. Do this for both files. Edit the jts-firewall script as needed. I have a bunch of rules commented out for allowing connections on different ports so you can see examples of how things are done.
Put firewall-init in your /etc/init.d folder, again Make sure you make it executable by root. Right-click on the file and select 'properties'. Then click on the permissions tab. and allow 'execute'. Do this for both files. Adding firewall-init to your initscripts will get your firewall up and running on each boot. To do this, drop into a commandline and execute the following line:jts-firewall wrote:#!/bin/sh
#IPTABLES=/sbin/iptables is where iptables files are normally placed. Change as needed:
IPTABLES=/sbin/iptables
case "$1" in
start|reload|restart)
#flush existing rules
${IPTABLES} -F INPUT
#Allow replies to all data that has been sent out meant for this machine
${IPTABLES} -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p icmp
${IPTABLES} -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p tcp
${IPTABLES} -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p udp
#Allow incoming SSH requests
#${IPTABLES} -A INPUT -p tcp --dport ssh -j ACCEPT
#Allow incoming Samba connetions
#${IPTABLES} -A INPUT -p tcp --dport netbios-ssn -j ACCEPT
#${IPTABLES} -A INPUT -p tcp --dport microsoft-ds -j ACCEPT
#${IPTABLES} -A INPUT -p tcp --dport swats -j ACCEPT
#${IPTABLES} -A INPUT -p udp --dport netbios-ns -j ACCEPT
#${IPTABLES} -A INPUT -p udp --dport netbios-dgm -j ACCEPT
#Allow incoming ipp for network printing -- We don't have a printer.
#${IPTABLES} -A INPUT -p tcp --dport ipp -j ACCEPT
#${IPTABLES} -A INPUT -p udp --dport ipp -j ACCEPT
#Allow incoming https/www for web.
#${IPTABLES} -A INPUT -p tcp --dport https -j ACCEPT
#${IPTABLES} -A INPUT -p tcp --dport www -j ACCEPT
#${IPTABLES} -A INPUT -p tcp --dport 8080 -j ACCEPT
#Allow incoming smtp connections.
#${IPTABLES} -A INPUT -p tcp --dport smtp -j ACCEPT
#Allow incoming spamd connections:
# We don't need to let others connect to spamd for any reason.
#${IPTABLES} -A INPUT -p tcp --dport spamd -j ACCEPT
#Drop and log all other data: set log so if >5 packets/sec are dropped
# they will be ignored. This helps to prevent a DOS attack crashing the computer.
${IPTABLES} -A INPUT -m limit --limit 3/second --limit-burst 5 -i ! lo -j LOG --log-level 4 --log-prefix "[iptables] "
${IPTABLES} -A INPUT -i ! lo -j DROP
;;
stop)
#flush existing rules
${IPTABLES} -F INPUT
;;
status)
${IPTABLES} -L -v -n
;;
*)
echo "Usage: $0 {start|restart|reload|stop|status}"
exit 1
esac
exit 0
# rc-update add firewall-init default <enter>
To make sure your firewall is working and your computer is in 'stealth' mode, you can go to one of the test sites, like GRC.COM and see if your ports are properly closed.firewall-init wrote:#!/sbin/runscript
# Copyright 1999-2004 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/app-admin/bastille/files/bastille-2.1.1-firewall.init,v 1.2 2004/07/14 21:09:15 agriffis Exp $
opts="start stop"
REALSCRIPT=/sbin/jts-firewall
depend() {
need logger net
}
start() {
ebegin "Starting jts-firewall"
exec $REALSCRIPT start
eend $? "Failed to start jts-firewall"
}
stop() {
ebegin "Stopping jts-firewall"
$REALSCRIPT stop
eend $? "Failed to stop jts-firewall"
}
Switching Linux from Master to Slave
GRUB boot Repair
Hardware Fixes
CUPS Printer Install
