iptablesrocks.org - Preparation
home
|
syntax & structure
|
examples
|
faq
|
contact
|
links
The iptablesrocks.org iptables firewall setup guide
System Requirements/Installation:
Iptables is geared for Linux type operating systems. This setup guide is geared for Redhat Linux and Redhat Enterprise Linux. However you can
probably apply this to any other Linux distro that Iptables will run on. In order to run this setup, you will obviously need to have iptables installed on
your server.
On a Redhat server, you can usually find out if you have the iptables RPM package installed by running the following commnand:
rpm -q iptables
If iptables is installed, you should get an output like this:
iptables-1.2.8-12
If iptables is not installed on your server, you can either download the RPM from Redhat's site or, if your server is registered with Redhat Network's
update service, you can install iptables directly from Redhat with the following command:
up2date -i iptables
Pre-configuration:
As part of the preparation for our new iptables firewall, we're going to adjust the kernel logging configuration so that the firewall will log its activites to a
custom logfile. Here's how you do it...
vi /etc/syslog.conf
Add the following to the syslog.conf file:
#IPTables logging
# kernel messages.
kern.debug;kern.info /var/log/firewall
Save and exit the file.
Now let's activate the changes...
/etc/rc.d/init.d/syslog restart
Your kernel should now log the activity of the soon to be firewall to /var/log/firewall. Once we start up the iptables firewall, the /var/log/firewall file will be
the location of the logging output of the firewall. This output will, in turn, be analyzed by the "Iptables Log Analyzer" tool and put in to a web accesible
and user friendly format. Woohoo!
The last thing you will want to do is to add a module to your kernel. The "ip_conntrack_ftp" module will need to be added so that FTP sessions can
function correctly. If you don't add this module, the firewall will prevent proper FTP sessions. Fortunately, adding the module is easy. Jus run the
following command:
insmod ip_conntrack_ftp
Viola! The module is added. You may want to add that line to your server's /etc/rc.local file to ensure that the module loads on boot. We'll cover that
later in the guide.
http://www.iptablesrocks.org/guide/preparation.php (1 of 2) [2/13/2004 8:04:52 PM]
