Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having trouble modifying iptables configuration during a customized kickstart installation of CentOS 6. The kickstart process is installing several custom RPMs on top of a minimal ISO image. One of the rpms attempts to modify the iptables rules but after Anaconda completes the installation, the original default rules are still set in /etc/sysconfig/iptables.

I've tried using iptables (save|restore) but the iptables modules aren't available during the installation. iptables -L returns the error "can't initialize iptables 'filter': Table does not exist" and both save/restore commands fail to run.

After poking around I realized that the package system-config-firewall-base is installed and seems to be setting the default rules. Further, I see that my rules have been copied into /etc/sysconfig/iptables.old but I can't figure out what is causing that. I've tried adding Requires: system-config-firewall-base to my package in the hopes that I could change the rules in my %post after they've been set but that didn't work.

Installing this package after first boot sets up the rules correctly.

Any advice on how to correctly configure iptables during installation or else how to configure something to achieve this automatically on first boot?

Thanks.

share|improve this question

3 Answers 3

up vote 0 down vote accepted

You best bet is to edit the /etc/sysconfig/iptables file directly in a script in the %post section of your kickstart file. This will run after you have installed your packages.

share|improve this answer
    
Right, I've tried that and once installation completes, I switch over to VT2 to inspect the filesystem and /mnt/sysimage/etc/sysconfig/iptables contains the old, default settings. –  bfallik-bamboom Jan 13 '12 at 14:24
    
I retried this approach and it seems to work. Not sure why my first attempt failed, but copying the custom iptables rules in a %post --nochroot kickstart section seems to work. –  bfallik-bamboom Jan 13 '12 at 15:01
    
Ya I wondered if it had something to do with the root jail, good to know that it works without the root jail. –  Red Tux Jan 13 '12 at 15:29

What firewall mods are you trying to do?

You can make firewall mods with kickstart

Ex to enable ssh (tcp 22) and http (tcp 80) put the following line in your kickstart

firewall --enabled --http --ssh

share|improve this answer
    
Our edits require more complicated changes than enabling specific ports. –  bfallik-bamboom Jan 13 '12 at 2:11
    
What do they require? –  ckliborn Jan 13 '12 at 2:13
    
We need to deploy custom firewall configurations based on the host type. The individual configuration is more complicated than opening access for specific services. –  bfallik-bamboom Jan 13 '12 at 2:24

I'll point out that there is a programmatic API for editing the iptables config file

Here is an example:

iptables -I INPUT -p tcp --dport 8880 -j ACCEPT
iptables -I INPUT -p tcp --dport 8443 -j ACCEPT
iptables-save > /etc/sysconfig/iptables
service iptables restart
share|improve this answer
1  
This could suffer from a race condition if multiple users are running scripts like this. Better to change iptables-save >/etc/sysconfig/iptables to command service iptables save, and get rid of the restart. –  Mark Lakata Jul 29 at 23:01
    
@MarkLakata while kind of a corner case, still nice to know about the save command. I'm curious about your use of the command command. What is the purpose of doing it that way and not just service iptables save –  mlathe Jul 31 at 19:27
    
No good reason, it was just something I cut and paste from some other SO article :). I just learned what the purpose of the 'command' command is -- to prevent some alias called service to interfere. See ss64.com/bash/command.html –  Mark Lakata Jul 31 at 20:36
    
Yea... that was what i was thinking... Preventing someone from hijacking your service command somehow. –  mlathe Aug 5 at 0:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.