0

At present I use the script generated by iptables-save to be loaded at boot up. This are the [partial] contents of /etc/iptables.rules:

# Generated by iptables-save v1.4.4 on Sat Mar 19 15:35:11 2011
*nat
:PREROUTING ACCEPT [218073:19652132]
:POSTROUTING ACCEPT [75792:5067692]
:OUTPUT ACCEPT [68177:4555584]
-A POSTROUTING -o eth2 -j MASQUERADE
COMMIT
# Completed on Sat Mar 19 15:35:11 2011

And I have this line in the etc/network/interfaces under the interface that should be firewalled:

pre-up iptables-restore < /etc/iptables.rules

This system has become tedious for me as I have to change the rules frequently, and whenever I change the rules I need to generate another iptables.rules file and do a system boot up to see if the the rules get applied or not. Can it be done as like conf files which load at whenever service firewall restart is done. And within the main iptables conf file another iptables rules file can be linked which can be made editable by users who have less privileges. I want iptables rules to be written directly in a text file which gets loaded at boot-up or when service firewall restart is done.

2
  • 1
    What distro do you run? Debian or RedHat based?
    – Sacx
    Mar 21, 2011 at 8:25
  • It is ubuntu 10.04
    – nixnotwin
    Mar 21, 2011 at 14:30

3 Answers 3

3

I presume you are on a DEBIAN based system, because RH/Centos distros are coming with init script included.

For Ubuntu install iptables-persistent

apt-get install iptables-persistent 

and should be enough.

For Debian you can get the script from where: http://www.ubuntucy.org/wiki/index.php/A_persistent_iptables_startup_script_for_Debian_based_systems

To add it at boot use update-rc.d. I presume you saved the script on /etc/init.d/iptables, run:

update-rc.d iptables defaults

and you are done.

Regards

2

Actually, I do have the question of why you have to change your iptables ruleset all the time.

However, if you just want to test-out some new rules, here's how:

  1. Do iptables-save > iptsave.sh (the .sh is to enable the nice vim highlighting)

  2. vi iptsave.sh and do your changes

  3. iptables-apply -t 600 iptsave.sh = 600 seconds of testing time, after which iptables-apply automatically reverts to the prior ruleset. Or, you can press y and the new ruleset becomes permanent. DO NOT USE < THERE!! iptables-apply accepts a file name as an argument, not as a STDIN.

  4. mv iptsave.sh /etc/iptables.rules


And within the main iptables conf file another iptables rules file can be linked which can be made editable by users who have less privileges.

But why??

The iptables ruleset is meant to be made once, and modified only every now and then. If you have to keep changing it all the time, I think you're not implementing iptables in the most efficient/effective way.


Customizable & Updatable MAC rules

First of all, ensure that MAC testing branches off to a different chain. I suggest also 'splitting' the INPUT chain (I drop the iptables command for brevity)

-N MAC_admins
-N MAC_users
-N INPUT_2
-A INPUT -j MAC_admins
-A INPUT -j MAC_users
-A INPUT -j DROP
... rest of -A INPUT is put into -A INPUT_2 ...

MAC_admins is for the admins' MAC addresses, so it won't get hosed (and thus locking you out):

-A MAC_admins -m mac --mac-source 11:11:11:11:11:11 -g INPUT_2
-A MAC_admins -m mac --mac-source 22:22:22:22:22:22 -g INPUT_2
-A MAC_admins -m mac --mac-source 33:33:33:33:33:33 -g INPUT_2

Users whose MAC does not match anything there will be returned to the INPUT chain, and endure the 2nd MAC-checking chain. Now, to populate this chain, let's make a script. Assume it's /etc/firewall/UpdateMAC.sh

#!/bin/bash
readonly CONFDIR="/etc/firewall/maclists"
readonly IPT="/sbin/iptables"
readonly WORKCHAIN="MAC_users"
readonly NEXTCHAIN="INPUT_2"

readonly MACPATTERN="^([a-f0-9]{2}:){5}[a-f0-9]{2}$"

# Flush the chain (i.e., remove all rules in the chain)
$IPT -F $WORKCHAIN

for f in $CONFDIR/*
do
  while read mac; do
    [[ -z $mac ]] && continue           # Skip empty lines
    [[ ${mac:0:1} == "#" ]] && continue # Skip comments (if any)
    # A regex check to ensure that $mac indeed contains a MAC address
    if [[ $mac =~ $MACPATTERN ]]; then
      $IPT -A $WORKCHAIN -m mac --mac-source $mac -g $NEXTCHAIN
    fi
  done < $f
done

exit 0
# Tested on bash v4

Now do some magic with chmod and chown. Have your subadmins edit one (or more) files under /etc/firewall/maclists/, and whenever they've edited their file(s), you just execute the script.

11
  • I use MAC ids in the iptables to restrict users. I have rules for my 500 users. So I want to use two scripts: One for securtiy and forwarding and another for user MAC ids. The first one should be accessible only for me (as it provides security) and the second one should be editable for my collegues who are helping me to add and remove users. And the most important thing I want is to be able to do service firewall restart which should load rules from both the scripts.
    – nixnotwin
    Mar 21, 2011 at 14:28
  • @nixnotwin ah, I see. The solution will depend on whether you want an 'absolute' filter against MAC (i.e., only certain MACs are allowed, the others are totally blocked), or not. For an absolute MAC filter, you can use arptables. For a non-absolute MAC filter, you should use ipset, especially the ipmacmap (for pre-5 version) or bitmap:ip,mac (version 5+) type. In both cases, you can make just a single iptables ruleset that does not change; only the contents of the arptables/ipset change.
    – pepoluan
    Mar 21, 2011 at 15:47
  • I have the macs which I want to allow in the script, and all others are blocked. I use this: iptables -A INPUT -i eth1 -m mac --mac-source 00:8c:c3:de:67:8a -j RETURN and iptables -A INPUT -i eth1 -j DROP With the first line repeated for each user. The arptables sounds better than mine. Are there any good howtos?
    – nixnotwin
    Mar 21, 2011 at 17:13
  • @nixnotwin well, the arptables is just like iptables, but much simpler. just read its man page. it has only 2 'chains', IN and OUT. you just add allowed MAC addresses in the IN chain, and then change the chain's policy to DROP. afterwards, just manipulate it using arptables -A IN and arptables -D IN. it also has arptables-save and arptables-restore. there is a slight drawback: as the name implies, it basically works on ARP. cunning users using static ARP entries may bypass its protection.
    – pepoluan
    Mar 22, 2011 at 0:02
  • @nixnotwin in the case of the cunning user, you'll have to either go the ipset way, or 'branch off' the set of MAC testing. then write a script that runs in the background and checks for changes to a file containing a list of MACs, and do a Flush-then-Repopulate against that single chain, e.g., -F MAClist followed by a scripted series of -A MAClists.
    – pepoluan
    Mar 22, 2011 at 0:12
2

I have a similar question, but its on this topic, so i figure I'll share my two cents and ask...

First off, on a server it is highly feasible to have an iptables ruleset that changes frequently. I don't know who would think not. If you run port scan detection software, or other types of IPS (intrusion prevention software), these programs can be configured to add deny rules for specific attacking hosts to your iptables configuration. If that is the case, you will likely want these deny rules committed to the save files when iptables stops, or restarts.

That being said, don't deplore him for wanting a way to dynamically update iptables. I'm fishing around for the same thing.

To answer this question, there is a package called iptables-persistent that can be installed via "apt-get iptables-persistent". It will commit the iptables rules loaded at the time and create files for them, then create a boot script to reload those rules at boot, or firewall restart.

I know that some sources say there is a config file for iptables-persistent that allows it to commit changes to the firewall rules, but I'm running Ubuntu Server v13, and I can't seen to find that file anywhere. I guess whoever can post a path to it answers both our questions. :p

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .