Re: clarification on firewalling

Hi Gary,

Le mardi 14 novembre 2006 19:44, vous avez écrit :
> I understand that "...the script /etc/rc.d/rc.inet2 calls 
> /etc/rc.d/rc.firewall if it is executable (provided that rc.inet2 is 
> itself executable, of course." However, the firewall still worked when 
> it was located in the /etc directory. Only when I moved the rc.firewall 
> script out of this directory did the firewall fail to work.
> 
> Am I correct in believing that as long as a firewall script is located 
> in the /etc folder it will still work? Apparently it does.
> 
In short : no.

First, let me remind you some basics about firewalling on linux.

At startup, the kernel doesn't do any packet filtering.

The program iptables is used to set up rules for packet filtering ; these rules are then applied by the kernel to packets send and/or received.

When you shutdown the computer, these rules are lost. You'll have to set it up again at startup.

This is rc.firewall's job : when executed, it set up the firewalling rules. Thus it should be executed at every startup.

You can see rc.firewall as a file which contains the rules to apply ; this file is first written by guarddog, and updated by guarddog whenever you change the rules.

In short : for the firewall to be effective, the rc.firewall script have to be executed at startup.

This can be done several ways :
- by guarddog (when you click "OK" after updating rules)
- by yourself at any time ; become root and issue the command :
<path>rc.firewall
- by rc.inet2 which issue the same command at startup.

Most of the time you'll let rc.inet2 start the script rc.firewall at startup.

For this to work, rc.inet2 has to know the path of rc.firewall -- in other words, where rc.firewall is located.

Now if you open rc.inet2 with your favorite text editor you'll see these lines :
# If there is a firewall script, run it before enabling packet forwarding.
# See the HOWTOs on http://www.netfilter.org/ for documentation on
# setting up a firewall or NAT on Linux.  In some cases this might need to
# be moved past the section below dealing with IP packet forwarding.
if [ -x /etc/rc.d/rc.firewall ]; then
  /etc/rc.d/rc.firewall start
fi

It means "if the file /etc/rc.d/rc.firewall is executable, then launch (or execute) it".

So, inet2.rc assume that rc.firewall is in the /etc/rc.d directory.

This is not the case, because guarddog write this file in the /etc directory.

So we put in /etc/rc.d a symbolic link to /etc/firewall ; you know the command : 
ln -s /etc/rc.firewall /etc/rc.d/rc.firewall
and you can check te result with the "ls -l /etc/rc.d/rc.firewall" command.

When excuted, rc.inet2 will find the symink /etc/rc.d/rc.firewall, which will drive it to /etc/rc.firewall, which will be executed.

Remember : the location of rc.firewall is not important by itself ; what is important is that whoever need it can find it - whoever beeing either :
- yourself (to execute it if you whish)
- guarddog (to write it and execute it)
- rc.inet2 (to execute it -- normally at startup when it is itself executed).

Sorry for my bad English - French is my mother tongue.

HTH,

Didier

PS Please address your questions to the list so that everybody can hear it and benefit from the answers.


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV