Starting a fw

/dev/rob0 rob0 at
Fri Jul 8 15:12:08 CEST 2005

Visham Ramsurrun wrote:
> I was once told that in order to start a firewall automatically when a
> machine boots, we must make sure that the init process calls the
> script by making a symbolic link to that file in the /etc/rc.d/rcX.d
> directories.

This is not an iptables / netfilter issue. Different distros do this in 
different ways. Take this up in your distro's documentation or an 
appropriate forum.

That said ... I agree with what Robert told you.

> Let's say I have a firewall script called with the following rules in it:

This IS a netfilter issue.

> $IPT -F
> $IPT -X
> $IPT -A FORWARD -i eth0 -o eth0 -s -d
> -m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
> request -j ACCEPT
> $IPT -A FORWARD -i eth0 -o eth0 -s -d
> -m state --state NEW,ESTABLISHED,RELATED -p icmp --icmp-type echo
> reply -j ACCEPT

You are only planning to relay pings on your eth0 subnet, All INPUT and OUTPUT packets are dropped, including 

This machine won't be performing any useful network service. I strongly 
suspect that your FORWARD rules will never be hit. Are other machines on (eth0) routing through this one somehow?
     mail to this address is discarded unless "/dev/rob0"
     or "not-spam" is in Subject: header

More information about the netfilter mailing list