Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In /etc/NetworkManager/dispatcher.d/01ifupdown somewhere at the end:

case "$2" in
    up)
 export MODE="start"
 export PHASE="up"

 if [ -d /var/run/network/ ] ; then
  tmpfile=`mktemp -t`
  if [ -e /var/run/network/ifstate ] ; then
   cat /var/run/network/ifstate | grep -v ^$IFACE= > $tmpfile || true
  fi
  echo $IFACE=$IFACE >> $tmpfile
  mv $tmpfile /var/run/network/ifstate
 fi

 exec run-parts /etc/network/if-up.d
 exec /etc/iptables.rules
 ;;

I run iptables.rules script, which is shell script containing something like this:

#!/bin/sh
...
echo "restoring iptables..."
/sbin/iptables-restore -v <<-EOF;
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A INPUT -i $EXTIF -p ICMP -s $UNIVERSE -d $EXTIP -j ACCEPT

COMMIT
EOF

If I run this script from shell then I can see the rule is added. However, after startup the rule is not there. /var/log/messages doesn't show anything, I'm not even sure if the echo from script should be visible there or somewhere else.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

There are basically two ways to get your firewall configured with such a script.

One of them is to copy the skeleton script in /etc/init.d and modify it to your needs, then create the necessary links (using update-rc.d). This creates a "service" that is started and stopped when runlevels are changed, depending on your settings.

How well this will work with your machine is a different question. NetworkManager only starts interfaces when a user logs on, whereas the runlevel scripts are executed at boot time. Since your network interface(s) don't have IP addresses until NetworkManager has configured them, any iptables rules with IP addresses connected to local interfaces will probably fail.

The other option is to start your firewall scripts from within the /etc/network/interfaces file. In that file there are stanzas that tell the OS how to configure the interfaces. Each interface that should be configured by NetworkManager starts with "allow-hotplug". Usually these stanzas only have that line, as everything else is normally handled by DHCP. HOwever, you can add lines in the format of

up script-with-parameters

or

down script-with-parameters

which get executed when this particular interface goes up or down (which in fact also happens if somebody pulls the network cable). That should do the trick for you. Read the man page for interfaces(man interfaces).

share|improve this answer
add comment

exec causes control to be passed to it's parameter in such a manner that it does not return so anything after exec run-parts /etc/network/if-up.d will not be run.

You will have to find somewhere else to run your iptables.rules script from

share|improve this answer
    
I also tried to put my script in /etc/network/if-up.d/ and can't see the rule added. –  Michael Sep 5 '10 at 1:30
    
To manage iptables on Ubuntu use the ufw command –  Iain Sep 5 '10 at 8:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.