iptablesrocks.org - Maintaining, modifying and more...
home
|
syntax & structure
|
examples
|
faq
|
contact
|
links
The iptablesrocks.org iptables firewall setup guide
Maintaining & modifying your firewall and starting it on boot:
Maintenance
Maintaining your iptables firewall is pretty easy. The only thing you will want to keep an eye on is the logs at /var/log/firewall. The logs can let you know
when your server is being probed or when an attack is being attempted, this allowing you to take appropriate action. Once you start viewing your logs,
you are going to notice that almost every hour of every day someone is going to be trying to gain access to your server, find an exploit on your server
or attack your server. This is normal. Attackers simply scan entire networks for vulnerable servers, so don't take scans and attempted intrusions
personally. Every publicly available server out there gets probed and scanned all the time, so don't think you are special and that you need to call the
FBI or something rash like that. The fact is that anytime your see unsuccessful attempts to break into your server or attack it, that's a good thing
because it means that the attackers were not able to succeed. It means your server is secure and your firewall is working. In other words, failures that
are logged are a sign of a secure server.
You may also want to make sure that you have a log rotation schedule set up for the firewall logs. The logs can get quite large, so you will want to
keep them in check by rotating them out on a regular basis.
Modifications
OK, so you've got your firewall up and running. But what if you need to make a change to the rules? What if you need to open up another port? What if
you want to close a certain unused port? What if you want to block someone from your server? Get the answers right here.
What if I want to open another port?
While it is possible to append rules to your live iptables configuration, I find that the best way to make changes is to change the firewall script itself and
then re-import the script back into the iptables configuration. In terms of this site's setup, this means that you will want to edit the /root/primary_firewall
file. Within this config file you can add rules or remove rules and then import the new firewall into the iptables ruleset.
So, let's take an example
Example:
I want to allow inbound "tcp" traffic to port 139
To do this you would add the following line to the "INPUT" section of the /root/primary_firewall script:
-A INPUT -p tcp -m tcp --dport 139 -j ACCEPT
Let's go over what this line does...
-A
- this tells iptables to "append" the new rule to the current iptables ruleset.
INPUT
- The new rule will be appended to the "INPUT" portion of the ruleset, which controls inbound server traffic.
-p -
Indicates what protocol the rule applies to. Popular protocols are "tcp", "udp", "icmp" and several others.
-m
- Indicates a matching protocal value. Usually, this is set to the same value as the -p flag.
--dport
- Specifies the destination port to which the traffic will be directed. In this case, it's port 139.
-j
- Instructs the firewall to "jump" to specified state. In this case, request to TCP port 139 "jump" to "ACCEPT" and are threfore accepted and allowed
to pass through the firewall.
ACCEPT
- As denoted above, this is the state that the rule "jumps" to. In the example above, any inbound traffic to TCP port 139 will "jump" to an
"ACCEPT" state, and thus will be able to pass through the firewall.
So the breakdown above should tell you that the rule we are adding is going to allow all inbound traffic to TCP port 139. Once you add that line to the
http://www.iptablesrocks.org/guide/maintain.php (1 of 3) [2/13/2004 8:04:47 PM]
