Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a lot of rules for my iptables setup (routing, ssh bans etc) I also picked up a list of IP's to ban from here http://blacklist.linuxadmin.org and now its getting really complicated.

My /etc/sysconfig/iptables is really long. Is there a way to manage the rules by including rules from external files?

For example:

#include "pre_routing_rules"
#include "ssh_bans"

This will include the rules added in the files "pre_routing_rules" and "ssh_bans" This way I can easily manage my rules without hunting around in cat /etc/sysconfig/iptables.

share|improve this question

migrated from stackoverflow.com Jan 27 '10 at 4:04

This question came from our site for professional and enthusiast programmers.

5 Answers 5

Try iptables' ipsets. ipsets are configured separately, and these are also faster if you have enough ip addresses to manage.

iptables rule can refer to ipset like this:

iptables -A FORWARD -m set --set blocklist src,dst -j DROP

share|improve this answer
    
My biggest problem is with IP-address so I can use this. –  Rushi Sep 16 '08 at 7:45
    
I'm using this feature. My blacklist/white list IPs are the largest, so they can go in an ipset. I think the pre-routing stuff can stay in the main config list –  Rushi Sep 16 '08 at 7:51
    
This forum thread has a few examples of scripts using ipsets: forums.gentoo.org/viewtopic-t-863121.html –  mivk Nov 16 '13 at 12:49

iptables does not read the file directly, that is done by a program called iptables-restore. This is usually called from one of your init scripts.

You could add extra input files to your iptables-restore line. You'll have to find where this line is on your system but on my Debain box, it is in /etc/init.d/nat

The line currently reads like this:

/sbin/iptables-restore < /etc/network/iptables

Perhaps it could be changed to something like this:

cat /etc/network/iptables \
    /etc/network/pre_routing_tables \
    /etc/network/ssh_bans | /sbin/iptables-restore
share|improve this answer

One simple solution is to use multiple bash scripts for each section something like:

iptables-routing.sh
iptables-ssh-bans.sh
iptables-blacklist.sh

And run this files from a master script.

share|improve this answer
    
Well yeah that's what I do. But if I have to view the list of iptables rules (eg. cat /etc/sysconfig/iptables), it will show me all of the rules which were added via iptables-routing.sh iptables-blacklist.sh –  Rushi Sep 16 '08 at 7:48

I tend to use one of the many on-top-of-iptables firewalling scripts/tools, like Firestarter or Shorewall, they come with many files, separated by purpose, add interesting rules to protect against certain types of bogus packets and they usually work well.

share|improve this answer
    
Are these usable via command line ? My server is a remote one and i really dont prefer todo X over SSH –  Rushi Sep 16 '08 at 7:49
    
Shorewall is a set of flat text files that generate iptables rules. It is very usable from the command line and has great documentation and diagnostic tools. –  Paul Gear Feb 21 at 8:43

I'm not sure which distro you're running, since mine doesn't posses the file you refer to - but typically files which contain iptables rules are just shell scripts - so you should be able to do what you want by having a line such as :

. /etc/sysconfig/pre_routing_rules

or such like at the top of the iptables file you refer to.

share|improve this answer
    
I am running Fedora and CentOS –  Rushi Sep 16 '08 at 7:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.