Iptables Tutorial 1.2.2

ОглавлениеДобавить в закладки К обложке

work3:~# ./test.sh

+ iptables=/sbin/iptables

+ /sbin/iptables -N output_int_iface

+ cat /etc/configs/machines

+ read host

+ /sbin/iptables -N output-sto-as-101

+ /sbin/iptables -A output_int_iface -p tcp -d sto-as-101 -j output-sto-as-101

+ cat /etc/configs/sto-as-101/ports

+ read row2

+ /sbin/iptables -A output-sto-as-101 -p tcp --dport 21 -d sto-as-101 -j ACCEPT

+ read row2

+ /sbin/iptables -A output-sto-as-101 -p tcp --dport 22 -d sto-as-101 -j ACCEPT

+ read row2

+ /sbin/iptables -A output-sto-as-101 -p tcp --dport 23 -d sto-as-101 -j ACCEPT

+ read row2

+ read host

+ /sbin/iptables -N output-sto-as-102

+ /sbin/iptables -A output_int_iface -p tcp -d sto-as-102 -j output-sto-as-102

+ cat /etc/configs/sto-as-102/ports

+ read row2

+ /sbin/iptables -A output-sto-as-102 -p tcp --dport 21 -d sto-as-102 -j ACCEPT

+ read row2

+ /sbin/iptables -A output-sto-as-102 -p tcp --dport 22 -d sto-as-102 -j ACCEPT

+ read row2

+ /sbin/iptables -A output-sto-as-102 -p tcp --dport 23 -d sto-as-102 -j ACCEPT

+ read row2

+ read host

+ /sbin/iptables -N output-sto-as-103

+ /sbin/iptables -A output_int_iface -p tcp -d sto-as-103 -j output-sto-as-103

+ cat /etc/configs/sto-as-103/ports

+ read row2

+ /sbin/iptables -A output-sto-as-103 -p tcp --dport 21 -d sto-as-103 -j ACCEPT

+ read row2

+ /sbin/iptables -A output-sto-as-103 -p tcp --dport 22 -d sto-as-103 -j ACCEPT

+ read row2

+ /sbin/iptables -A output-sto-as-103 -p tcp --dport 23 -d sto-as-103 -j ACCEPT

+ read row2

+ read host

+ /sbin/iptables -N output-

+ /sbin/iptables -A output_int_iface -p tcp -d -j output-

Bad argument `output-'

Try `iptables -h' or 'iptables --help' for more information.

+ cat /etc/configs//ports

cat: /etc/configs//ports: No such file or directory

+ read row2

+ read host

The third and final problem you run into that can be partially solved with the help of the -x option is if you are executing the firewall script via SSH, and the console hangs in the middle of executing the script, and the console simply won't come back, nor are you able to connect via SSH again. In 99.9% of the cases, this means there is some kind of problem inside the script with a couple of the rules. By turning on the -x option, you will see exactly at which line the script locks dead, hopefully at least. There are a couple of circumstances where this is not true, unfortunately. For example, what if the script sets up a rule that blocks incoming traffic, but since the ssh/telnet server sends the echo first as outgoing traffic, netfilter will remember the connection, and hence allow the incoming traffic anyways if you have a rule above that handles connection states.

As you can see, it can become quite complex to debug your ruleset to its full extent in the end. However, it is not impossible at all. You may also have noticed, if you have worked remotely on your firewalls via SSH, for example, that the firewall may hang when you load bad rulesets. There is one more thing that can be done to save the day in these circumstances. Cron is an excellent way of saving your day. For example, say you are working on a firewall 50 kilometers away, you add some rules, delete some others, and then delete and insert the new updated ruleset. The firewall locks dead, and you can't reach it. The only way of fixing this is to go to the firewall's physical location and fix the problem from there, unless you have taken precautions that is!


-= 193 =-
Регистрация.
Забыли пароль?
Логин
Пароль
Запомнить меня