Building a Transparent Firewall with Linux, Part V

As you may be aware, Ubuntu has adopted a new startup script system. The old one, the init system, still works, and if you prefer, you can enable the script in Listing 2 the old-school way by making it executable and creating rc.d links by running this command:

bash-$ sudo update-rc.d iptables_custom start 36 2 3 4 5 . 
 ↪stop 98 0 1 6

However, I recommend you take the plunge into the world of the newer “upstart” system by skipping update-rc.d and instead adding the following script, iptables_custom.conf (Listing 3), to /etc/init (not /etc/init.d).

# iptables_custom

description	"iptables_custom"
author		"Mick Bauer <mick@wiremonkeys.org>"

start on (starting network-interface
	  or starting network-manager
	  or starting networking)

stop on runlevel [!023456]

console output

pre-start exec /etc/init.d/iptables_custom start
post-stop exec /etc/init.d/iptables_custom stop

Rather than requiring you to figure out which start/stop number to assign to your “rc.” links, upstart lets you just specify what needs to start beforehand (in this example: network-interface, network-manager or networking). As you can see, this iptables_custom.conf file then invokes /etc/init.d/iptables_custom, as listed in Listing 2, to do the actual work of loading or unloading rules. For that reason, /etc/init.d/iptables_custom must be executable whether you use it as an init script or an upstart job.

After saving your /etc/init/iptables_custom.conf file, you must enable it with this command:

bash-$ sudo initctl reload-configuration

Now you either can reboot or enter this command to load the firewall rules:

bash-$ sudo initctl start iptables_custom

And that, in one easy procedure, is how to create a bridging firewall using a Linux PC! I hope I've explained all of this clearly enough for you to figure out how to make it meet your specific needs. I also hope you found the previous few months' foray into OpenWrt to be worthwhile.

The Paranoid Penguin will return in a couple months, after I've had a short break. In the meantime, go forth and secure things!