Re: [gentoo-user] Help with script for iptables

[Iain Buchanan]

On Wed, 2006-11-15 at 20:29 +0000, Mick wrote:
> Hi All,
>
> I have been using Daniel Robbins' basic script for years but now on a laptop I
> have more than one ways of connecting to the Internet.  The script uses the
> variable UPLINK to define the incoming interface like so:
> ==============================================
> #change this to the name of the interface that provides your "uplink"
> #(connection to the Internet)

you could try modifying the script slightly:

> UPLINK="eth0"

make that
UPLINK="eth0 ppp0" # space separated

then I was going to say use a
for i in x; do ...; done
loop, but I realised that won't work exactly, because of the line
>        iptables -A INPUT -i ! ${UPLINK} -j ACCEPT
then something strange would happen.

What you're really saying is "for every interface not specified, accept
incoming packets".  This gets a bit tricky, cause you either have to
parse the output of ifconfig (ugly) or specify the interface that are
NOT "uplinks" (prone to user error).

You could say:

UPLINK="eth0 wlan0 ppp0"

if [ "$1" = "start" ]
then
        echo "Starting firewall..."
        iptables -P INPUT DROP
	for IFS in `ifconfig | grep "Link encap:" | awk '{print $1}'`; do
		for UPIFS in ${UPLINK}; do
			# if IFS isn't in UPIFS, then accept all trafic on IFS
			if ...

forget that! too ugly.  What are you really trying to do?  Make all your
interface the "uplink", ie. firewalled?

In that case, just say this:

> UPLINK="who cares?"
>
> if [ "$1" = "start" ]
> then
>         echo "Starting firewall..."
>         iptables -P INPUT DROP
>         iptables -A INPUT -i lo -j ACCEPT
>         iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

done! Now everything is firewalled, and only lo is trusted.

However, I haven't seen the rest of this script, so I don't know if that
will break things.  Maybe you want to post back with some more info if
that doesn't suit your needs...

cya!
-- 
Iain Buchanan <iaindb at netspace dot net dot au>

	"How many people work here?"
	"Oh, about half."

-- 
gentoo-user@g.o mailing list