O'Reilly logo

Building Secure Servers with Linux by Michael D. Bauer

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Appendix A. Two Complete Iptables Startup Scripts

These two scripts use iptables to configure netfilter on a DMZ’ed server and on the firewall that protects it, assuming a simple inside-DMZ-outside architecture as described in Chapter 2 and Chapter 3. For the full example scenario to which these scripts apply, refer to Section 3.1.8.

The first script is for the bastion host “Woofgang,” a public FTP/HTTP server, shown in Example A-1.

Example A-1. iptables script for a bastion host running FTP and HTTP services

#! /bin/sh # init.d/localfw # # System startup script for local packet filters on a bastion server # in a DMZ (NOT for an actual firewall) # # Functionally the same as Example 3-10, but with SuSE-isms restored and # with many more comments. # # Structurally based on SuSE 7.1's /etc/init.d/skeleton, by Kurt Garloff # # The following 9 lines are SuSE-specific # ### BEGIN INIT INFO # Provides: localfw # Required-Start: $network $syslog # Required-Stop: $network $syslog # Default-Start: 2 3 5 # Default-Stop: 0 1 2 6 # Description: Start localfw to protect local heinie ### END INIT INFO # /End SuSE-specific stuff (for now) # Let's save typing & confusion with a couple of variables. # These are NOT SuSE-specific in any way. IP_LOCAL=208.13.201.2 IPTABLES=/usr/sbin/iptables test -x $IPTABLES || exit 5 # The following 42 lines are SuSE-specific # Source SuSE config # (file containing system configuration variables, though in SuSE 8.0 this # has been split into a number of files in ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required