Re: [rock-user] Firewall Rules and System Startup

On Sun, Nov 06, 2005 at 07:53:47PM +0100, Bernd Petrovitsch wrote:
> On Sun, 2005-11-06 at 19:43 +0100, Benjamin Schieder wrote:
> [...]
> > Bernd Petrovitsch wrote:
> > > How and where is one supposed to put the firewall rules into?
> > > 
> > > In theory I want:
> > > 1) configure interfaces, but do not `ip set link eth<x> up` them.
> > > 2) possibly add and/or delete routes
> > > 3) add firewall rules
> > > 4) ip set link eth<x> up
> > > 
> > > 1) is configured with stone and started somewhere and somehow.
> > > And 2)-4)?
> > 
> > Theres rudimentary support for 3) in /etc/network/modules/iptables.sh
> 
> Hmm, that's by far too less. I think I will stick with my self-written
> script full of `iptables` calls.
There is a hook called run-up, which executes a script at interface setup time.
I recommend creating a firewall script using fwbuilder, and then executing the generated script from there. That's how I do it (almost ;)

> While I'm on it: I have an openvpn tunnel. Do I configure the thing in
> stone as a normale device (with name tap1) and how?
 
As I have my openvpn continuously, it is run by daemontools. But you could again
use the run-up facility to run some script that starts openvpn. Anyway, openvpn
will setup the interface itself. You could add firewall rules here.

Ciao

Andreas