Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On CentOS 6, is it possible to prepend custom rules with system-config-firewall?

My file looks like:

# Configuration file for system-config-firewall

--enabled
--port=8080:tcp
--custom-rules=ipv4:filter:/etc/sysconfig/iptables.munin
--service=ssh
--service=http
--service=https
--forward-port=if=eth0:port=80:proto=tcp:toport=8080
--forward-port=if=lo:port=80:proto=tcp:toport=8080

but this puts the custom rules after all the other iptables rules have been put in. The resulting iptables file is:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i eth0 -p tcp --dport 80 -j MARK --set-mark 0x64
-A PREROUTING -i lo -p tcp --dport 80 -j MARK --set-mark 0x65
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i eth0 -p tcp --dport 80 -m mark --mark 0x64 -j DNAT --to-destination :8080
-A PREROUTING -i lo -p tcp --dport 80 -m mark --mark 0x65 -j DNAT --to-destination :8080
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -m state --state NEW -m tcp -p tcp --dport 8080 -m mark --mark 0x64 -j ACCEPT
-A INPUT -i lo -m state --state NEW -m tcp -p tcp --dport 8080 -m mark --mark 0x65 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
 ###custom rules here###
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.