Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

489

Appendix

APPENDIX

Two Complete iptables Startup

Scripts

These two scripts use iptables to configure netfilter on a DMZed server and on the

firewall that protects it, assuming a simple inside-DMZ-outside architecture as

described in Chapters 2 and 3. For the full example scenario to which these scripts

apply, refer to the section “Every System Can Be Its Own Firewall: Using iptables for

Local Security” in Chapter 3.

Both of the examples in this appendix are available online at http://examples.oreilly.

com/linuxss2/. Please remember that they are just models to use for developing your

own firewall rules; they should never be dropped blindly onto a system.

The first script is for the bastion host Woofgang, a public FTP/HTTP server, shown

in Example A-1.

Example A-1. iptables script for a bastion host running FTP and HTTP services

#! /bin/sh

# init.d/localfw

#

# System startup script for local packet filters on a bastion server

# in a DMZ (NOT for an actual firewall)

#

# Functionally the same as Example 3-10, but with SuSE-isms restored and

# with many more comments.

#

# Structurally based on SuSE 7.1's /etc/init.d/skeleton, by Kurt Garloff

#

# The following 9 lines are SuSE-specific

#

### BEGIN INIT INFO

# Provides: localfw

# Required-Start: $network $syslog

# Required-Stop: $network $syslog

# Default-Start: ...