Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

https://help.ubuntu.com/community/Router/Firewall

In the link above there is a firewall script described. How can I install this script in Ubuntu 10.0.4 desktop?

share|improve this question

3 Answers 3

up vote 0 down vote accepted

The “advanced” firewall script is a shell script that is supposed to be executed after both the internal and the external interface are up.

First, put the script somewhere, say /etc/init.d/local/my_firewall_script, make it executable, and add #!/bin/sh as the first line in the script file.

Next, you need to arrange for the script to run after both interfaces are up. You have two options:

  • through upstart. This has my preference because the script must run when both interfaces are up. Create a file /etc/init/my_firewall.conf containing something like this:

    description "My firewall script"
    start on (net-device-up IFACE=br0 and net-device-up IFACE=eth0)
    console output
    
    
    pre-start exec /etc/init.d/local/my_firewall_script
    

    This is completely untested, and I have zero upstart experience, so you may need to adapt the file. Also there's a bug related to the net-device-up event that might affect you.

  • through ifup scripts. This is a bit fiddly here because the script must be run when the second interface comes up. Create a file /etc/network/if-up.d/my_firewall containing something like this (unstested):

    #!/bin/sh
    if [ "$IFACE" = "br0" ] || [ "$IFACE" = "eth0" ]; then
      if [ -n "$(ip addr show br0 | grep '^ *inet ')" ] 2>/dev/null &&
         [ -n "$(ip addr show eth0 | grep '^ *inet ')" ] 2>/dev/null; then
        /etc/init.d/local/my_firewall_script
      fi
    fi
    

    If there was a single interface, or if there was a guarantee that one of the interfaces always came up after the other, this method would be simpler and preferred: the script would be (assuming the single or last-up interface is eth0):

    #!/bin/sh
    if [ "$IFACE" = "et0" ]; then
      /etc/init.d/local/my_firewall_script
    fi
    

Note that the script given there is fairly specific to a particular setup — it's an example of a relatively advanced script. You'll have to adapt it to your setup, at least the IP address ranges and probably the name of the interfaces.

After you've found a method that works, I suggest you write a description of how you did it to the wiki page.

share|improve this answer
    
I tried the second way, no good. If I run firewall script from shell then I see the rule is added. However right after boot the rule is not there. Is there any way to log something to /var/log/messages from the script, so I can have some clue why it doesn't work. –  Pablo Sep 5 '10 at 1:39
    
@Michael: add set -x; exec >/var/tmp/ 2>&1 to the top of the ifup script. What happens if you do ifdown eth0; ifup eth0? –  Gilles Sep 5 '10 at 9:33

Here is some comprehensive documentation which provides several options you can choose from:

https://help.ubuntu.com/community/IptablesHowTo#Configuration on startup

share|improve this answer

You can save the script as /etc/iptables.up.rules for example and add:

post-up iptables-restore < /etc/iptables.up.rules

to /etc/network/interfaces file under the definition of your interface.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.