Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

What is the proper place to start/stop iptables script? Currently I have placed it into /etc/init.d and it has start/stop options. However I don't think it is the best place. The other two according to my research are

  • /etc/network/interface -> pre-up

  • /etc/network/if-*.d (will this one call my script with start/stop argument?)

So where is the proper place?

share|improve this question
    
IMHO, /etc/network/if-up.d/iptables and /etc/network/if-down.d/iptables start to become confusing, I'd rather place it at /etc/init.d as you initially pointed out. Again, just my opinion. –  Evandro Silva Oct 30 '12 at 0:20
    
Placing script into init.d will not restart iptables script when on interface restart(eg new IP address from DHCP). –  Pablo Oct 30 '12 at 13:14

1 Answer 1

up vote 0 down vote accepted

/etc/init.d is deprecated for this because there is then a race condition - for a few moments on restart, you have network up but do not have your firewall up. don't do it.

typically what you want to do is get your firewall set up to your liking, then do iptables-save > /etc/network/iptables. Now create /etc/network/if-pre-up.d/iptables.sh as follows:

#!/bin/sh
/sbin/iptables-restore < /etc/network/iptables

Be sure to remember to make both files owned by root, and chmod 400 /etc/network/iptables ; chmod 755 /etc/network/if-pre-up.d/iptables.sh to set permissions appropriately - unprivileged users should not be able to read your actual firewall ruleset, much less change it, but your script in if-pre-up.d must be executable. (You might optionally chmod it 700 if you're feeling frisky; but I don't see that it'll really keep anything any more secure.)

You do not need a down script for this, just a pre-up. You specifically want pre-up because that keeps you from ever having your network interface online without your firewall up.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.