0

the firewalld zones and rules etc are a complete pain in the butt compared to regular old iptables. My main goal is to get my iptables rules to run at startup and not have to recreate them all with firewalld-config.

I have the following shell script:

[root@hypersquij ~]# cat fw.sh 
#!/bin/bash

/usr/sbin/iptables -P INPUT ACCEPT
/usr/sbin/iptables -P FORWARD ACCEPT
/usr/sbin/iptables -P OUTPUT ACCEPT
/usr/sbin/iptables -t nat -F
/usr/sbin/iptables -t mangle -F
/usr/sbin/iptables -F
/usr/sbin/iptables -X

# Set default chain policies
/usr/sbin/iptables -P INPUT DROP
/usr/sbin/iptables -P FORWARD DROP
/usr/sbin/iptables -P OUTPUT ACCEPT

# Accept on localhost
/usr/sbin/iptables -A INPUT -i lo -j ACCEPT
/usr/sbin/iptables -A OUTPUT -o lo -j ACCEPT

# Allow established sessions to receive traffic
/usr/sbin/iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow ssh
/usr/sbin/iptables -I INPUT -p tcp --dport 22 -j ACCEPT

# various protocols 
/usr/sbin/iptables -A INPUT -p icmp -j ACCEPT
/usr/sbin/iptables -A INPUT -p ah -j ACCEPT
/usr/sbin/iptables -A INPUT -p esp -j ACCEPT

And the following /etc/rc.d/rc.local

[root@hypersquij ~]# cat /etc/rc.d/rc.local 
#!/bin/bash

/bin/bash /root/fw.sh

exit 0

perms:

[root@hypersquij ~]# ls -l /etc/rc.d/rc.local 
-rwxr-xr-x. 1 root root 43 Oct 16 09:49 /etc/rc.d/rc.local
[root@hypersquij ~]# ls -l fw.sh 
-rwxr--r--. 1 root root 829 Oct 16 09:46 fw.sh

I ran systemctl disable firewalld .

Doesn't appear this shell script is running on startup.

Current state of rc-local.service

[root@hypersquij ~]# systemctl status rc-local.service
● rc-local.service - /etc/rc.d/rc.local Compatibility
   Loaded: loaded (/usr/lib/systemd/system/rc-local.service; enabled-runtime; vendor preset: disabled)
   Active: active (exited) since Tue 2018-10-16 09:46:56 MDT; 9min ago
  Process: 1200 ExecStart=/etc/rc.d/rc.local start (code=exited, status=0/SUCCESS)
    Tasks: 0 (limit: 4915)
   CGroup: /system.slice/rc-local.service

Oct 16 09:46:56 hypersquij systemd[1]: Starting /etc/rc.d/rc.local Compatibility...
Oct 16 09:46:56 hypersquij systemd[1]: Started /etc/rc.d/rc.local Compatibility.

Can anyone help? All I want is this stupid fw.sh script to run on startup on fedora and trash the complexity of firewalld.

  • How do you know the script doesn't run on startup? Is /usr/sbin/iptables the right path? (how about /sbin/iptables?) – Kamil Maciorowski Oct 17 '18 at 11:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.