Warning: Function ereg() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 4

Warning: Function split() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 19

Warning: Function ereg() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 4

Warning: Function split() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 19

Warning: Function ereg() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 4

Warning: Function split() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 19

Warning: Function ereg() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 4

Warning: Function split() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 19

Warning: Function ereg() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 4

Warning: Function split() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 19

Warning: Function ereg() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 4

Warning: Function split() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 19

Warning: Function ereg() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 4

Warning: Function split() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 19

Warning: Function ereg() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 4

Warning: Function split() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 19

Warning: Function ereg() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 4

Warning: Function split() is deprecated in ..../includes/class_postbit.php(345) : eval()'d code on line 19
Firewall script in RHEL 4
Results 1 to 9 of 9

Thread: Firewall script in RHEL 4

Hybrid View

  1. #1

    Firewall script in RHEL 4

    I am using RHEL 4 and have created a custom Firewall script .
    The systems has 2 lan cards etho and eth1 configured with the respective internal and external ips .
    When i run the firewall script it runs perfectly without any errors ,but when i run the command
    service iptables status ,it seems to run the internal Iptables script .
    I have made the changes in the below files
    /etc/sysctl.conf
    /etc/rc.d/rc.local - added the path of the firewall script
    Have made the Firewall script executable
    added the command echo "1" > /proc/sys/net/ipv4/ip_forward in the firewall script
    I can Ping external websites from the linux server and also the clients can ping the DNS ,but cannot access the websites.

    Do i need to link the firewall script file so that it starts at boot up .
    Pl let me know where am i going wrong .Am i missing any pre-requisites before a custom made firewall script needs to be run.
    regds
    Sudarshan'

  2. #2
    check /etc/init.d/iptables
    That's the script that gets run when you do "service iptables"
    63,000 bugs in the code, 63,000 bugs,
    ya get 1 whacked with a service pack,
    now there's 63,005 bugs in the code!!

  3. #3
    when i run the command

    service iptables status

    it runs the script which is the default iptables script ,instead of the firewall script .

    Any ideas ???

  4. #4
    What are the contents of /etc/init.d/iptables? It probably contains something that calls certain scripts...
    63,000 bugs in the code, 63,000 bugs,
    ya get 1 whacked with a service pack,
    now there's 63,005 bugs in the code!!

  5. #5
    pl find below the contents of IPtables

    #!/bin/sh
    #
    # iptables Start iptables firewall
    #
    # chkconfig: 2345 08 92
    # description: Starts, stops and saves iptables firewall
    #
    # config: /etc/sysconfig/iptables
    # config: /etc/sysconfig/iptables-config
    # Source function library.
    . /etc/init.d/functions
    IPTABLES=iptables
    IPTABLES_DATA=/etc/sysconfig/$IPTABLES
    IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
    IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
    PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
    VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
    if [ ! -x /sbin/$IPTABLES ]; then
    echo -n $"/sbin/$IPTABLES does not exist."; warning; echo
    exit 0
    fi
    if lsmod 2>/dev/null | grep -q ipchains ; then
    echo -n $"ipchains and $IPTABLES can not be used together."; warning; echo
    exit 0
    fi
    # Old or new modutils
    /sbin/modprobe --version 2>&1 | grep -q module-init-tools \
    && NEW_MODUTILS=1 \
    || NEW_MODUTILS=0
    # Default firewall configuration:
    IPTABLES_MODULES=""
    IPTABLES_MODULES_UNLOAD="yes"
    IPTABLES_SAVE_ON_STOP="no"
    IPTABLES_SAVE_ON_RESTART="no"
    IPTABLES_SAVE_COUNTER="no"
    IPTABLES_STATUS_NUMERIC="yes"
    # Load firewall configuration.
    [ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
    rmmod_r() {
    # Unload module with all referring modules.
    # At first all referring modules will be unloaded, then the module itself.
    local mod=$1
    local ret=0
    local ref=
    # Get referring modules.
    # New modutils have another output format.
    [ $NEW_MODUTILS = 1 ] \
    && ref=`lsmod | awk "/^${mod}/ { print \\\$4; }" | tr ',' ' '` \
    || ref=`lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1`
    # recursive call for all referring modules
    for i in $ref; do
    rmmod_r $i
    let ret+=$?;
    done
    # Unload module.
    # The extra test is for 2.6: The module might have autocleaned,
    # after all referring modules are unloaded.
    if grep -q "^${mod}" /proc/modules ; then
    modprobe -r $mod > /dev/null 2>&1
    let ret+=$?;
    fi
    return $ret
    }
    flush_n_delete() {
    # Flush firewall rules and delete chains.
    [ -e "$PROC_IPTABLES_NAMES" ] || return 1
    # Check if firewall is configured (has tables)
    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
    [ -z "$tables" ] && return 1
    echo -n $"Flushing firewall rules: "
    ret=0
    # For all tables
    for i in $tables; do
    # Flush firewall rules.
    $IPTABLES -t $i -F;
    let ret+=$?;
    # Delete firewall chains.
    $IPTABLES -t $i -X;
    let ret+=$?;
    # Set counter to zero.
    $IPTABLES -t $i -Z;
    let ret+=$?;
    done
    [ $ret -eq 0 ] && success || failure
    echo
    return $ret
    }
    set_policy() {
    # Set policy for configured tables.
    policy=$1
    # Check if iptable module is loaded
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
    # Check if firewall is configured (has tables)
    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
    [ -z "$tables" ] && return 1
    echo -n $"Setting chains to policy $policy: "
    ret=0
    for i in $tables; do
    echo -n "$i "
    case "$i" in
    filter)
    $IPTABLES -t filter -P INPUT $policy \
    && $IPTABLES -t filter -P OUTPUT $policy \
    && $IPTABLES -t filter -P FORWARD $policy \
    || let ret+=1
    ;;
    nat)
    $IPTABLES -t nat -P PREROUTING $policy \
    && $IPTABLES -t nat -P POSTROUTING $policy \
    && $IPTABLES -t nat -P OUTPUT $policy \
    || let ret+=1
    ;;
    mangle)
    $IPTABLES -t mangle -P PREROUTING $policy \
    && $IPTABLES -t mangle -P POSTROUTING $policy \
    && $IPTABLES -t mangle -P INPUT $policy \
    && $IPTABLES -t mangle -P OUTPUT $policy \
    && $IPTABLES -t mangle -P FORWARD $policy \
    || let ret+=1
    ;;
    *)
    let ret+=1
    ;;
    esac
    done
    [ $ret -eq 0 ] && success || failure
    echo
    return $ret
    }
    start() {
    # Do not start if there is no config file.
    [ -f "$IPTABLES_DATA" ] || return 1
    echo -n $"Applying $IPTABLES firewall rules: "
    OPT=
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
    $IPTABLES-restore $OPT $IPTABLES_DATA
    if [ $? -eq 0 ]; then
    success; echo
    else
    failure; echo; return 1
    fi

    # Load additional modules (helpers)
    if [ -n "$IPTABLES_MODULES" ]; then
    echo -n $"Loading additional $IPTABLES modules: "
    ret=0
    for mod in $IPTABLES_MODULES; do
    echo -n "$mod "
    modprobe $mod > /dev/null 2>&1
    let ret+=$?;
    done
    [ $ret -eq 0 ] && success || failure
    echo
    fi

    touch $VAR_SUBSYS_IPTABLES
    return $ret
    }
    stop() {
    # Do not stop if iptables module is not loaded.
    [ -e "$PROC_IPTABLES_NAMES" ] || return 1
    flush_n_delete
    set_policy ACCEPT

    if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
    echo -n $"Unloading $IPTABLES modules: "
    ret=0
    rmmod_r ${IPV}_tables
    let ret+=$?;
    rmmod_r ${IPV}_conntrack
    let ret+=$?;
    [ $ret -eq 0 ] && success || failure
    echo
    fi

    rm -f $VAR_SUBSYS_IPTABLES
    return $ret
    }
    save() {
    # Check if iptable module is loaded
    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
    # Check if firewall is configured (has tables)
    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
    [ -z "$tables" ] && return 1
    echo -n $"Saving firewall rules to $IPTABLES_DATA: "
    OPT=
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
    ret=0
    TMP_FILE=`/bin/mktemp -q /tmp/$IPTABLES.XXXXXX` \
    && chmod 600 "$TMP_FILE" \
    && $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
    && size=`stat -c '%s' $TMP_FILE` && [ $size -gt 0 ] \
    || ret=1
    if [ $ret -eq 0 ]; then
    if [ -e $IPTABLES_DATA ]; then
    cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
    && chmod 600 $IPTABLES_DATA.save \
    || ret=1
    fi
    if [ $ret -eq 0 ]; then
    cp -f $TMP_FILE $IPTABLES_DATA \
    && chmod 600 $IPTABLES_DATA \
    || ret=1
    fi
    fi
    [ $ret -eq 0 ] && success || failure
    echo
    rm -f $TMP_FILE
    return $ret
    }
    status() {
    # Do not print status if lockfile is missing and iptables modules are not
    # loaded.
    # Check if iptable module is loaded
    if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
    echo $"Firewall is stopped."
    return 1
    fi
    # Check if firewall is configured (has tables)
    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
    echo $"Firewall is not configured. "
    return 1
    fi
    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
    if [ -z "$tables" ]; then
    echo $"Firewall is not configured. "
    return 1
    fi
    NUM=
    [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
    for table in $tables; do
    echo $"Table: $table"
    $IPTABLES -t $table --list $NUM && echo
    done
    return 0
    }
    restart() {
    [ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
    stop
    start
    }
    case "$1" in
    start)
    stop
    start
    RETVAL=$?
    ;;
    stop)
    [ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
    stop
    RETVAL=$?
    ;;
    restart)
    restart
    RETVAL=$?
    ;;
    condrestart)
    [ -e "$VAR_SUBSYS_IPTABLES" ] && restart
    ;;
    status)
    status
    RETVAL=$?
    ;;
    panic)
    flush_n_delete
    set_policy DROP
    RETVAL=$?
    ;;
    save)
    save
    RETVAL=$?
    ;;
    *)
    echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save} "
    exit 1
    ;;
    esac
    exit $RETVAL

  6. #6
    So it looks like you can copy your config to /etc/sysconfig/iptables-config or just change that one and then sysconfig (the software that manages RHEL services) will use that for iptables
    63,000 bugs in the code, 63,000 bugs,
    ya get 1 whacked with a service pack,
    now there's 63,005 bugs in the code!!

  7. #7
    When i ran the command iptables -L or Service iptables status ,i observerd that it ran the scripts mentioned in the custom
    created firewall script ,plus the script from the path /etc/sysconfig/iptables .I had logged into GUI mode and had configured
    the same.
    The script in the path is as below
    ================================================== ===============================
    # Firewall configuration written by system-config-securitylevel
    # Manual customization of this file is not recommended.
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    :RH-Firewall-1-INPUT - [0:0]
    -A INPUT -j RH-Firewall-1-INPUT
    -A FORWARD -j RH-Firewall-1-INPUT
    -A RH-Firewall-1-INPUT -i lo -j ACCEPT
    -A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
    -A RH-Firewall-1-INPUT -i eth1 -j ACCEPT
    -A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
    -A RH-Firewall-1-INPUT -p 50 -j ACCEPT
    -A RH-Firewall-1-INPUT -p 51 -j ACCEPT
    -A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
    -A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1935 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 111 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 1111 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5080 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 8443 -j ACCEPT
    #-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 23642 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 110 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 722 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2401 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 8080 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 1935 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 111 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 1111 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 5080 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 8443 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 443 -j ACCEPT
    #-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 23642 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 110 -j ACCEPT
    -A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 722 -j ACCEPT
    -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
    COMMIT
    ================================================== ==============================================
    In the /etc/init.d/sysconfig ,the IPTABLES_DATA=/etc/sysconfig/$IPTABLES ,
    can i change it to my path where the custom firewall is placed .
    Pl clarify me

  8. #8
    I am not going to lie... I don't know much about iptables, I just know RHEL's sysconfig. Have you changed anything in the init script (like IPTABLES_CONFIG)
    $IPTABLES_DATA gets overwritten in the script... I don't know if it would clobber your config file. I would recommend making IPTABLES_CONFIG point to your config file.
    63,000 bugs in the code, 63,000 bugs,
    ya get 1 whacked with a service pack,
    now there's 63,005 bugs in the code!!

  9. #9
    ok ,thks ,i will cllsoe this topic and am starting a new thread with the firewall script

Similar Threads

  1. Running cusom firewall script -iptables -RHEL 4
    By sud.tech in forum Programming
    Replies: 0
    Last Post: 06-12-2008, 01:09 PM
  2. C Program error when moved to 64-bit RHEL 4.0 from 32-bit RHEL 2.0
    By contact_vickey@yahoo.com in forum Redhat / Fedora
    Replies: 1
    Last Post: 02-19-2007, 03:57 PM
  3. Simple firewall script
    By modules in forum Security
    Replies: 2
    Last Post: 02-22-2006, 09:39 AM
  4. Does Monmotha's firewall script support logging?
    By 10Dedfish in forum Programming
    Replies: 1
    Last Post: 12-28-2003, 12:32 AM
  5. Apache Firewall Script
    By rhonneil in forum Programming
    Replies: 1
    Last Post: 11-12-2003, 03:59 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •