Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

494

|

Appendix : Two Complete iptables Startup Scripts

The second script is, according to my own assertions in Chapter 3, actually beyond

the scope of this book: it’s for a multihomed firewall system. But even though this

book is about bastion hosts, and even though many of the things in this script are

not described elsewhere in the book, I wanted to at least show a sample firewall con-

figuration.

Like the previous script, it’s copiously commented, but if you really want to learn

how to build Linux firewalls, you’d be well advised to read the official Netfilter doc-

umentation, the iptables(8) manpage, or a book dedicated to Linux firewalls.

Again, the example scenario used in Example A-2 is the one described in Chapter 3

under “Every System Can Be Its Own Firewall: Using iptables for Local Security.”

This example is admittedly somewhat unrealistic: the DMZ contains no DNS or

SMTP servers, so all internal hosts are allowed to send email outward, and I haven’t

addressed the issue of inbound email at all (if I did, there would be an SMTP gate-

way in the DMZ, and only that host would receive SMTP traffic from the Internet).

The services that are illustrated in Example A-2 should be enough to help you figure

out how to accommodate others that are not.

;;

esac

Example A-2. iptables script for ...