Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an /etc/init.d/iptables start|stop|restart script on different ubuntu servers (which is a normal shell script)

For each new service I have to edit and insert a line to open a port. This leads to many different versions of the init.d script on different machines.

Is it possible to automatically include let's say all files in /etc/iptables/include.d/ ?

The target is that there should only a line in the start function of /etc/init.d/iptables like

include /etc/iptables/include.d/*

And after an additional file in /etc/iptables/include.d/ I'd simply say

/etc/init.d/iptables restart

Edit: As Saurabh pointed out this can lead to problems when commands need a certain order. An advanced setup could have different directories like:

/etc/iptables/include01.d/
/etc/iptables/include02.d/
/etc/iptables/include03.d/

and including them like this:

    include /etc/iptables/include01.d/*
    ... maybe some code goes here in the main file...
    include /etc/iptables/include02.d/*
    include /etc/iptables/include03.d/*
share|improve this question
add comment

5 Answers

up vote 9 down vote accepted

Add the following line to your init.d script.

run-parts --report /etc/iptables/include.d

It will run everything in the directory as a shell script (need to be executable).

If you you only want to execute files that ends with .port you could use something like:

run-parts --regex '\.port$' /etc/iptables/include.d/

If you want to make sure the order is correct you can name the files:

10_web.port
20_ssh.port
etc..
share|improve this answer
add comment
for f in /etc/iptables/include.d/*
 . $f
done

note space between dot and %f

Saurabh is right - this will not necessary work as you intend, but use some naming convention eg 10-xxx, 20-yyy and so on and it might be manageable.

share|improve this answer
    
i think this is great, because i do not rely on an external command (run-parts) –  user12096 Jul 16 '09 at 20:39
    
will the order of the files when numbered 10-xxx, 20-yyy be respected automatically by the for f in ? –  user12096 Jul 18 '09 at 10:49
    
@matnagel - should be. if you have any doubts, replace /etc/iptables/include.d/* with ls -1 /etc/iptables/include.d/*.extension - with ls you can control sorting criteria, default one is by name. notice special quote symbol. –  pQd Jul 18 '09 at 11:48
add comment

You may also consider building the iptables script from template files, one of which would be the original iptables script. create a script which will read your template files in the relevant directories and create a new iptables script from them. That way when you need to make changes you do so in the templates and just rerun your script generator.

Using this method you could even get fancy and place markers in the base template which can be used to signal when to include files from specific directories in your template tree.

share|improve this answer
add comment

You can define simple function in bash:

function include() {
    for FILE in $( find "$1" -type f -print | sort )
    do
        source $FILE
    done
}

and then:

include some_dir/*

or even:

include some_dir/*.conf
share|improve this answer
    
this is even better than pQd's solution. –  user12096 Jul 16 '09 at 20:40
add comment

I do not think you can include files in iptables configuration. The choice makes sense as firewall rules depend a lot on order in which they are written. If we just include files in folder, iptables wont know which rules to put first and which later.

share|improve this answer
    
this is a good point. thank you for pointing this out. i am updating the question to use several include.d directories, so I can give them an order. I have many services that do not depend on each other and the setup would still make sense in these cases. –  user12096 Jul 16 '09 at 10:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.