Linux Networking Cookbook

3.9. Starting iptables at Boot, and Manually Bringing Your Firewall Up and Down

Problem

Your three new iptables scripts (see previous recipes) are tested and ready to be put to work—you have fw_nat,a fw_status script, and the fw_flush script. You want your firewall to start automatically at boot, and you want to start, stop, and check iptables status manually like any other service. How do you do this?

Solution

First, get rid of any existing firewall scripts, including any that came with your Linux distribution. On Fedora Linux and all of its relatives, also remove the iptables-save and iptables-restore scripts to prevent conflicts and accidental changes.

The different Linux distributions manage starting and stopping iptables in all sorts of different ways. This init script, called firewall, is as simple as it gets, and it works on any Linux. It calls the scripts used in the previous three recipes, so be sure you already have those tested and ready to use:

 #!/bin/sh ##/etc.init.d/firewall # simple start-stop init script for iptables # start builds the firewall, stop flushes # all rules and resets default policies to ACCEPT # restart runs the start and stop commands # status displays all active rules, and packet and byte counters # chkconfig: 2345 01 99 startfile="/usr/local/bin/fw_nat" stopfile="/usr/local/bin/fw_flush" statusfile="/usr/local/bin/fw_status" case "$1" in start) echo "Starting $startfile: iptables is now starting up" /bin/sh $startfile start ;; stop) echo "Stopping $stopfile: ...