Vecina ljudi skuzi kako napraviti iptables i slicno, ali ima jedna poteskoca u svemu tome sto iptables se gubi prilikom restarta stroja ili gasenja.
Iptables se primjenjuje na nivou
kernela (jezgre) samog operatinog sustava. Prilikom bootanja stroja potrebno je iptables postaviti za automatsko podizanje.
Ove upute se odnose na Debian i Ubuntu distirbucije, na drugim distribucijama je promjenjena lokacija datoteke
interfaces.
Kako to postici:
U datoteci
/etc/network/interfaces treba dodati redak:
post-up iptables-restore < /etc/iptables.up.rules
gdje
/etc/iptables.up.rules je putanja do skripte koja podize firewall.
Izgled interfaces datoteke je:
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo eth0 eth1
iface lo inet loopback
# The primary network interface
iface eth0 inet static
address 192.168.2.5
netmask 255.255.255.0
network 192.168.2.0
brodcast 192.168.2.255
gateway 192.168.2.1
post-up iptables-restore < /etc/iptables.up.rules
iface eth1 inet static
address 172.16.0.1
netmask 255.255.0.0
broadcast 172.16.255.255
network 172.16.0.0
Izgled
iptables.up.rules datoteke:
# Generated by iptables-save v1.3.6 on Tue May 27 18:17:28 2008
*filter
:INPUT ACCEPT [38725:4186870]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [41704:3636788]
:SSH_WHITELIST - [0:0]
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --rsource
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j SSH_WHITELIST
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --rsource -m limit --limit 2/sec -j LOG --log-prefix "SSH_brute_force:"
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH --rsource -j DROP
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -s 192.168.1.0/255.255.255.0 -i eth1 -o eth0 -m state --state NEW -j ACCEPT
-A FORWARD -s 192.168.2.0/255.255.255.0 -i eth0 -o eth1 -m state --state NEW -j ACCEPT
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -i eth1 -j ACCEPT
-A OUTPUT -m state --state INVALID -j DROP
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A SSH_WHITELIST -s 0.0.0.0 -m recent --remove --name SSH --rsource -j ACCEPT
COMMIT
# Completed on Tue May 27 18:17:28 2008
# Generated by iptables-save v1.3.6 on Tue May 27 18:17:28 2008
*nat
:PREROUTING ACCEPT [36084:3553453]
:POSTROUTING ACCEPT [1093:112681]
:OUTPUT ACCEPT [37973:3320426]
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Tue May 27 18:17:28 2008
