Fedora Linux Support Community & Resources Center
  #1  
Old 26th February 2012, 01:26 PM
JakeR Offline
Registered User
 
Join Date: Feb 2012
Location: Sweden
Posts: 13
linuxchrome
Question Cant modify iptables

Hi

I have created a rpm file that modifies the /etc/sysconfig/iptables when installed (add rules to block internet for all users except one.). It works well.

I include this rpm-file in my kickstart file, but no changes in /etc/sysconfig/iptables are made. When I boot up on the live iso I find my modified iptables-file in /etc/sysconfig/iptables.old.

How do I make changes in /etc/sysconfig/iptables from a kickstart file (livecd-creator)?
Reply With Quote
  #2  
Old 1st April 2012, 04:25 PM
AndrewSerk Offline
Registered User
 
Join Date: Oct 2010
Posts: 889
linuxfirefox
Re: Cant modify iptables

Hello,
The approach you used is probably a better choice than what I have posted below. I suspect the issue you are seeing is a result of you rpm installing before iptables installs. You could add iptables as a dependency for your rpm in your spec file so that iptables must be installed first
Code:
%post
cat >> /etc/rc.d/init.d/livesys << EOF_livesys

# setup firewall
rm /etc/sysconfig/iptables
touch /etc/sysconfig/iptables

cat >> /etc/sysconfig/iptables << EOF_iptables
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth+ -j MASQUERADE
-A POSTROUTING -o ippp+ -j MASQUERADE
-A POSTROUTING -o isdn+ -j MASQUERADE
-A POSTROUTING -o ppp+ -j MASQUERADE
-A POSTROUTING -o tun+ -j MASQUERADE
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j DROP
-A INPUT -p icmp -m icmp --icmp-type echo-reply -j DROP
-A INPUT -p icmp -m icmp --icmp-type echo-request -j DROP
-A INPUT -p icmp -m icmp --icmp-type parameter-problem -j DROP
-A INPUT -p icmp -m icmp --icmp-type redirect -j DROP
-A INPUT -p icmp -m icmp --icmp-type router-advertisement -j DROP
-A INPUT -p icmp -m icmp --icmp-type router-solicitation -j DROP
-A INPUT -p icmp -m icmp --icmp-type source-quench -j DROP
-A INPUT -p icmp -m icmp --icmp-type time-exceeded -j DROP
-A INPUT -p icmp -j DROP
-A INPUT -i lo -j DROP
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p icmp -m icmp --icmp-type destination-unreachable -j DROP
-A FORWARD -p icmp -m icmp --icmp-type echo-reply -j DROP
-A FORWARD -p icmp -m icmp --icmp-type echo-request -j DROP
-A FORWARD -p icmp -m icmp --icmp-type parameter-problem -j DROP
-A FORWARD -p icmp -m icmp --icmp-type redirect -j DROP
-A FORWARD -p icmp -m icmp --icmp-type router-advertisement -j DROP
-A FORWARD -p icmp -m icmp --icmp-type router-solicitation -j DROP
-A FORWARD -p icmp -m icmp --icmp-type source-quench -j DROP
-A FORWARD -p icmp -m icmp --icmp-type time-exceeded -j DROP
-A FORWARD -p icmp -j DROP
-A FORWARD -i lo -j DROP
-A FORWARD -o eth+ -j DROP
-A FORWARD -o ippp+ -j DROP
-A FORWARD -o isdn+ -j DROP
-A FORWARD -o ppp+ -j DROP
-A FORWARD -o tun+ -j DROP
-A INPUT -j DROP
-A FORWARD -j DROP
COMMIT
EOF_iptables
 EOF_livesys
EDIT:
You should add a chmod for iptables above EOF_livesys

Last edited by AndrewSerk; 3rd April 2012 at 04:36 PM.
Reply With Quote
  #3  
Old 19th June 2012, 01:24 PM
JakeR Offline
Registered User
 
Join Date: Feb 2012
Location: Sweden
Posts: 13
macoschrome
Re: Cant modify iptables

Quote:
Originally Posted by AndrewSerk View Post
Hello,
The approach you used is probably a better choice than what I have posted below. I suspect the issue you are seeing is a result of you rpm installing before iptables installs. You could add iptables as a dependency for your rpm in your spec file so that iptables must be installed first
Thanks!

I have created a fork of the system-config-firewall package and changed the default rules in src/fw_iptables.py.
Reply With Quote
  #4  
Old 20th June 2012, 02:36 AM
AndrewSerk Offline
Registered User
 
Join Date: Oct 2010
Posts: 889
linuxfirefox
Re: Cant modify iptables

Very nice! I like your approach.
Reply With Quote
Reply

Tags
iptables, modify

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Modify Yum Behavior jvinla Using Fedora 2 11th March 2010 07:55 PM
command #service iptables save changed the original config of iptables kesavulur Security and Privacy 0 28th November 2007 06:33 AM
modify ldap b4u Servers & Networking 0 19th June 2005 06:15 PM
Trying to modify CTRL ALT DEL ajwynn Using Fedora 3 4th May 2005 02:45 PM
Modify LILO Dridhas Using Fedora 5 13th August 2004 06:37 AM


Current GMT-time: 19:37 (Thursday, 31-07-2014)

TopSubscribe to XML RSS for all Threads in all ForumsFedoraForumDotOrg Archive
logo

All trademarks, and forum posts in this site are property of their respective owner(s).
FedoraForum.org is privately owned and is not directly sponsored by the Fedora Project or Red Hat, Inc.

Privacy Policy | Term of Use | Posting Guidelines | Archive | Contact Us | Founding Members

Powered by vBulletin® Copyright ©2000 - 2012, vBulletin Solutions, Inc.

FedoraForum is Powered by RedHat