2

I'd like to know the safest way to load iptables using Debian. Of course, I can use a script that uses iptables-restore :

#!/bin/sh
iptables-restore < /etc/firewall.conf

but : 1) where is the safest place to have it loaded ? /etc/network/if-up.d ? I'm concerned about the script being loaded early enough at boot time, and reliably enough when plugging/unplugging interfaces ...

2) is this script method using iptables-restore the most secure way ?

3) additionnally, how much does the answer validity stretch to other Linux distros ( Ubuntu, Fedora, CentOS ) ?

Thanks ^^

Improve this question
5
  • Write your rules in /etc/network/if-up.d/rules.sh by doing sudo iptables-save > /etc/network/if-up.d/rules.sh and then add /etc/network/if-up.d/rules.sh to /etc/rc.local before the line exit 0
    – Nehal J Wani
    Aug 24, 2014 at 9:22
  • Did you already look at this resource: debian-administration.org/article/615/… ? Using if-pre-up.d seems to address your concern that iptables is loaded before the interface is up.
    – agtoever
    Aug 24, 2014 at 9:25
  • OK, so /etc/network/if-pre-up.d/ seems like a good place to locate the script. But is it really 'packet-proof' ( I mean, no small time-lapse while a packet might sneak in while iptables is resetting ? ( I try to make it packet-proof ) ?
    – networkIT
    Aug 24, 2014 at 14:31
  • also, using if-pre-up.d/ would have the script flush the iptables each time a network-interfaces is down-ed or up-ed. This is inconvenient for fail2ban as an example. Wouldn't a strategically placed init.d script with custom update-rc.d settings be a more definitive solution ? But how to know when to have it started exactly ? ( ie what update-rc.d runlevel values and priorities use ), and have dependencies checked ?
    – networkIT
    Aug 24, 2014 at 14:37
  • Nehal J. Wani : why do you add /etc/network/if-up.d/rules.sh to /etc/rc.local ? so to make sure it's executed anyway ?
    – networkIT
    Aug 24, 2014 at 14:39

1 Answer 1

Reset to default
1

Debian includes a ready package to do this: iptables-persistent. I have used that and it works well on Debian and Ubuntu. Without performing much of a security analysis, I find it a good practice to use ready made solutions instead of rolling your own.

apt-get install iptables-persistent
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .