Differences between version 22 and previous revision of PerrysFirewallingScript.
Other diffs: Previous Major Revision, Previous Author, or view the Annotated Edit History
| Newer page: | version 22 | Last edited on Tuesday, April 4, 2006 2:47:36 pm | by JamieCurtis | Revert |
| Older page: | version 21 | Last edited on Tuesday, April 4, 2006 2:44:56 pm | by JamieCurtis | Revert |
@@ -74,9 +74,9 @@
if_feature rp_filter 1 # enable reverse path filtering for this interface
if_feature accept_redirects # accept ICMP redirects on this interface
etc...
-!!classes.d
+!!<tt>
classes.d</tt>
There are several example class files in CVS. There are several standard interface "types" (eg: "external", "internal", "dmz" etc) and then you symlink interfaces to these. eg:
ln -s external eth0.if
ln -s internal eth1.if
ln -s dmz eth2.if
@@ -89,9 +89,9 @@
;fw-ipup: This brings up only one interface and presumes that the main "firewall" script has been run to set everything up. It takes one or two parameters. The first parameter is the interface name (such as eth0, eth1) and the second is an optional name for the name of the interface definition to read. For instance a wireless interface might use "home" or "work", so you could type:
ifup eth0 home
;fw-ipdown: This removes all the firewalling rules to do with an interface. Dynamic rulesets that are loaded by that interface are __not__ removed, however won't be executed by packets so only a very slight memory overhead is kept.
-!!the ruleset.d directory
+!!the <tt>
ruleset.d</tt>
directory
This is used to store fragments of a firewall, each fragment does something simple and can be used by interface.d files. rulesets have the form of "''name''.rule". rulesets don't have much in the way of helper functions. The first line of them should be:
. support/ruleset.functions
the environmental variable ${RULE} will be set to the rule name (basically the name of the file less the ".rule" extension, and the environmental variable ${IPTABLES} will be set to the path to the iptables executable. There are also "polite_reject" and "polite_drop" which will be discussed later.
@@ -121,9 +121,11 @@
;__A__:You don't have a catch all rule for something in one of your class files. Look at the syslog messages carefully and see what interface they are dealing with and which rule you are missing.
!!Wishlist features
These are all wishlist features which may or may not get implemented :)
-;
Renaming interfaces based on their category : "External0" "External1" "Internal1" "Internal2" etc - thusly when an interface comes up it is named by it's purpose. Useful for those machines that have 10+ interfaces and you can never remember which is which, also important when you have multiple ppp0, or VPN interfaces that may come up in any order (do you set the permissive rule on ppp0 or ppp1?) %%%
1. Superceded by a program whose name I forget which has a file of MAC->interfacenames and when run renames interfaces as required. Rather nifty. %%%
2. With ppp interfaces, bring them up with 'unit N' in the command line, and they will take on that number. Solves the problem nicely. You might need pppd 2.4.2.
-;
Some saner defaults : A simple default so if you run the script straight out of CVS it probably does what you want. Go get the deb if you need this.
-;
Use iptables-save and restore to speed shutdown/startup of script? : Not really worth the effort...
-;
Transparent support of ipv6 : Needs investigating
-;
Automatically load ip_nat_* modules :
+*
Renaming interfaces based on their category : "External0" "External1" "Internal1" "Internal2" etc - thusly when an interface comes up it is named by it's purpose. Useful for those machines that have 10+ interfaces and you can never remember which is which, also important when you have multiple ppp0, or VPN interfaces that may come up in any order (do you set the permissive rule on ppp0 or ppp1?)
+**
1. Superceded by a program whose name I forget which has a file of MAC->interfacenames and when run renames interfaces as required. Rather nifty.
+**
2. With ppp interfaces, bring them up with 'unit N' in the command line, and they will take on that number. Solves the problem nicely. You might need pppd 2.4.2.
+*
Some saner defaults : A simple default so if you run the script straight out of CVS it probably does what you want. Go get the deb if you need this.
+*
Use iptables-save and restore to speed shutdown/startup of script? : Not really worth the effort...
+*
Transparent support of ipv6 : Needs investigating
+*
Automatically load ip_nat_* modules : done
