Recipe 2.20 Loading a Firewall Configuration

2.20.1 Problem

You want to load your firewall rules, e.g., at boot time.

2.20.2 Solution

Use ipchains-restore or iptables-restore. Assuming you've saved your firewall configuration in /etc/sysconfig: [Recipe 2.19]

For iptables:

#!/bin/sh
echo 1 > /proc/sys/net/ipv4/ip_forward       (optional)
iptables-restore < /etc/sysconfig/iptables

For ipchains:

#!/bin/sh
echo 1 > /proc/sys/net/ipv4/ip_forward       (optional)
ipchains-restore < /etc/sysconfig/ipchains

To tell Red Hat Linux that firewall rules should be loaded at boot time:

# chkconfig iptables on

# chkconfig ipchains on

2.20.3 Discussion

Place the load commands in one of your system rc files. Red Hat Linux already has rc files "iptables" and "ipchains" in /etc/init.d that you can simply enable using chkconfig. SuSE Linux, in contrast, has a script /sbin/SuSEpersonal-firewall that invokes iptables or ipchains rules, and it's optionally started by /etc/init.d/personal-firewall.initial and /etc/init.d/personal-firewall.final at boot time.

To roll your own solution, you can write a script like the following and invoke it from an rc file of your choice:

#!/bin/sh
# Uncomment either iptables or ipchains
PROGRAM=/usr/sbin/iptables
#PROGRAM=/sbin/ipchains

FIREWALL=`/bin/basename $PROGRAM`
RULES_FILE=/etc/sysconfig/${FIREWALL}
LOADER=${PROGRAM}-restore
FORWARD_BIT=/proc/sys/net/ipv4/ip_forward

if [ ! -f ${RULES_FILE} ]
then
        echo "$0: Cannot find ${RULES_FILE}" 1>&2
        exit 1
fi

case "$1" in
        start)
                echo 1 > ${FORWARD_BIT}
                ${LOADER} < ${RULES_FILE} || exit 1
                ;;
        stop)
                ${PROGRAM} -F                   # Flush all rules
                ${PROGRAM} -X                   # Delete user-defined chains
                echo 0 > ${FORWARD_BIT}
                ;;
        *)
                echo "Usage: $0 start|stop" 1>&2
                exit 1
                ;;
esac

Make sure you load your firewall rules for all appropriate runlevels where networking is enabled. On most systems this includes runlevels 2 (multiuser without NFS), 3 (full multiuser), and 5 (X11). Check /etc/inittab to confirm this, and use chkconfig to list the status of the networking service at each runlevel:

$ chkconfig --list network
network         0:off   1:off   2:on    3:on    4:on    5:on    6:off

2.20.4 See Also

iptables-load(8), ipchains-load(8), iptables(8), ipchains(8).