iptables Administration in Redhat

Question

Normally (that is, on Debianish systems), when you have to add a firewall rule uou have to put a defenition in the iptables.d/ directory and restart iptables. I can easily write a script to do this on a few systems (for example with expect, or something like that).

On Redhat systems, they "forgot" the iptables.d/ directory, and you have to put the new rule in /etc/sysconfig/iptables. I can certainly device a sed and awk thingy that puts the rule in the file (the last rule is a reject rule, and everything beyond that is ignored, so you have to add the rule "in the middle" of the file). but these things often quickly get messy.

Question: is there a way to maintain the iptables rules of many Redhat Servers, such that you don;t need "hacking the file" with awk/sed ? I am looking for easy implementations, not something big like Satelite or JBoss-ON (RHQ).

Answer 1

Unless I'm missing the point to your question, it would seem to be that all you need to do is add the rule with the appropriate iptables -A or iptables -I command and then do an iptables-save > /etc/sysconfig/iptables to retain the current rule set across reboots.

Answer 2

If I understand correctly, you have misunderstanding of how iptables works.

Firewall rules are loaded into memory and are being used by netfilter - the kernel network facility. iptables - is just a command line tool that can access netfilter rules and modify them. Once you have set your firewall correctly you can just

/etc/init.d/iptables save

And system will save firewall state to harddrive. On boot system will restore these settings. I.e. you don't need to prepare any firewall initialization script, this is really old way of doing things.