Building a Transparent Firewall with Linux, Part V
As you may be aware, Ubuntu has adopted a new startup script system. The old one, the init system, still works, and if you prefer, you can enable the script in Listing 2 the old-school way by making it executable and creating rc.d links by running this command:
bash-$ sudo update-rc.d iptables_custom start 36 2 3 4 5 . ↪stop 98 0 1 6
However, I recommend you take the plunge into the world of the newer “upstart” system by skipping update-rc.d and instead adding the following script, iptables_custom.conf (Listing 3), to /etc/init (not /etc/init.d).
Listing 3. Upstart Configuration File for iptables_custom
# iptables_custom description "iptables_custom" author "Mick Bauer <firstname.lastname@example.org>" start on (starting network-interface or starting network-manager or starting networking) stop on runlevel [!023456] console output pre-start exec /etc/init.d/iptables_custom start post-stop exec /etc/init.d/iptables_custom stop
Rather than requiring you to figure out which start/stop number to assign to your “rc.” links, upstart lets you just specify what needs to start beforehand (in this example: network-interface, network-manager or networking). As you can see, this iptables_custom.conf file then invokes /etc/init.d/iptables_custom, as listed in Listing 2, to do the actual work of loading or unloading rules. For that reason, /etc/init.d/iptables_custom must be executable whether you use it as an init script or an upstart job.
After saving your /etc/init/iptables_custom.conf file, you must enable it with this command:
bash-$ sudo initctl reload-configuration
Now you either can reboot or enter this command to load the firewall rules:
bash-$ sudo initctl start iptables_custom
And that, in one easy procedure, is how to create a bridging firewall using a Linux PC! I hope I've explained all of this clearly enough for you to figure out how to make it meet your specific needs. I also hope you found the previous few months' foray into OpenWrt to be worthwhile.
The Paranoid Penguin will return in a couple months, after I've had a short break. In the meantime, go forth and secure things!
Peter de Jong's iptables script for the upstart init system is available at 4pdj.nl/2010/01/11/custom-firewall-under-ubuntu-karmic-koala-with-upstart.
See also my book: Bauer, Michael D. Linux Server Security, second edition. Sebastopol, California: O'Reilly Media, 2005. Chapter 3 explains iptables in detail, and Appendix A contains two complete iptables scripts. Although focused on “local” (“personal”) firewalls rather than Internet or LAN firewalls, this material nonetheless should be helpful to iptables beginners.
Mick Bauer (email@example.com) is Network Security Architect for one of the US's largest banks. He is the author of the O'Reilly book Linux Server Security, 2nd edition (formerly called Building Secure Servers With Linux), an occasional presenter at information security conferences and composer of the “Network Engineering Polka”.
Practical Task Scheduling Deployment
July 20, 2016 12:00 pm CDT
One of the best things about the UNIX environment (aside from being stable and efficient) is the vast array of software tools available to help you do your job. Traditionally, a UNIX tool does only one thing, but does that one thing very well. For example, grep is very easy to use and can search vast amounts of data quickly. The find tool can find a particular file or files based on all kinds of criteria. It's pretty easy to string these tools together to build even more powerful tools, such as a tool that finds all of the .log files in the /home directory and searches each one for a particular entry. This erector-set mentality allows UNIX system administrators to seem to always have the right tool for the job.
Cron traditionally has been considered another such a tool for job scheduling, but is it enough? This webinar considers that very question. The first part builds on a previous Geek Guide, Beyond Cron, and briefly describes how to know when it might be time to consider upgrading your job scheduling infrastructure. The second part presents an actual planning and implementation framework.
Join Linux Journal's Mike Diehl and Pat Cameron of Help Systems.
Free to Linux Journal readers.Register Now!
- SUSE LLC's SUSE Manager
- My +1 Sword of Productivity
- Murat Yener and Onur Dundar's Expert Android Studio (Wrox)
- Managing Linux Using Puppet
- Non-Linux FOSS: Caffeine!
- SuperTuxKart 0.9.2 Released
- Doing for User Space What We Did for Kernel Space
- Google's SwiftShader Released
- Parsing an RSS News Feed with a Bash Script
- Rogue Wave Software's Zend Server