source: postlfs/security/iptables-systemd.xml@ 2325e9ba

systemd-13485
Last change on this file since 2325e9ba was ac38e9dc, checked in by Douglas R. Reno <renodr@…>, 9 years ago

Import back into SVN from Github

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/branches/systemd@16309 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 10.7 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY iptables-download-http "http://www.netfilter.org/projects/iptables/files/iptables-&iptables-version;.tar.bz2">
8 <!ENTITY iptables-download-ftp "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
9 <!ENTITY iptables-md5sum "536d048c8e8eeebcd9757d0863ebb0c0">
10 <!ENTITY iptables-size "536 KB">
11 <!ENTITY iptables-buildsize "15 MB">
12 <!ENTITY iptables-time "0.2 SBU">
13]>
14
15<sect1 id="iptables" xreflabel="Iptables-&iptables-version;">
16 <?dbhtml filename="iptables.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Iptables-&iptables-version;</title>
24
25 <indexterm zone="iptables">
26 <primary sortas="a-Iptables">Iptables</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Iptables</title>
31
32 <para>
33 The next part of this chapter deals with firewalls. The principal
34 firewall tool for Linux is <application>Iptables</application>. You will
35 need to install <application>Iptables</application> if you intend on using
36 any form of a firewall.
37 </para>
38
39 &lfs77_checked;
40
41 <bridgehead renderas="sect3">Package Information</bridgehead>
42 <itemizedlist spacing="compact">
43 <listitem>
44 <para>
45 Download (HTTP): <ulink url="&iptables-download-http;"/>
46 </para>
47 </listitem>
48 <listitem>
49 <para>
50 Download (FTP): <ulink url="&iptables-download-ftp;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download MD5 sum: &iptables-md5sum;
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download size: &iptables-size;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Estimated disk space required: &iptables-buildsize;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated build time: &iptables-time;
71 </para>
72 </listitem>
73 </itemizedlist>
74
75 <para condition="html" role="usernotes">User Notes:
76 <ulink url="&blfs-wiki;/iptables"/>
77 </para>
78 </sect2>
79
80 <sect2 role="kernel" id="iptables-kernel">
81 <title>Kernel Configuration</title>
82
83 <para>
84 A firewall in Linux is accomplished through a portion of the
85 kernel called netfilter. The interface to netfilter is
86 <application>Iptables</application>. To use it, the appropriate
87 kernel configuration parameters are found in:
88 </para>
89
90<screen><literal>[*] Networking support ---&gt; [CONFIG_NET]
91 Networking Options ---&gt;
92 [*] Network packet filtering framework (Netfilter) ---&gt; [CONFIG_NETFILTER]</literal></screen>
93
94 <indexterm zone="iptables iptables-kernel">
95 <primary sortas="d-iptables">Iptables</primary>
96 </indexterm>
97
98 </sect2>
99
100 <sect2 role="installation">
101 <title>Installation of Iptables</title>
102
103 <note>
104 <para>
105 The installation below does not include building some specialized
106 extension libraries which require the raw headers in the
107 <application>Linux</application> source code. If you wish to build the
108 additional extensions (if you aren't sure, then you probably don't), you
109 can look at the <filename>INSTALL</filename> file to see an example of
110 how to change the <parameter>KERNEL_DIR=</parameter> parameter to point
111 at the <application>Linux</application> source code. Note that if you
112 upgrade the kernel version, you may also need to recompile
113 <application>Iptables</application> and that the BLFS team has not tested
114 using the raw kernel headers.
115 </para>
116
117 <para>
118 For some non-x86 architectures, the raw kernel headers may be
119 required. In that case, modify the <parameter>KERNEL_DIR=</parameter>
120 parameter to point at the <application>Linux</application> source
121 code.
122 </para>
123 </note>
124
125 <para>
126 Install <application>Iptables</application> by running the following
127 commands:
128 </para>
129
130<screen><userinput>./configure --prefix=/usr \
131 --sbindir=/sbin \
132 --enable-libipq \
133 --with-xtlibdir=/lib/xtables &amp;&amp;
134make</userinput></screen>
135
136 <para>This package does not come with a test suite.</para>
137
138 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
139
140<screen role="root"><userinput>make install &amp;&amp;
141ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml &amp;&amp;
142
143for file in ip4tc ip6tc ipq iptc xtables
144do
145 mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
146 ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
147done</userinput></screen>
148
149 </sect2>
150
151 <sect2 role="commands">
152 <title>Command Explanations</title>
153
154 <para>
155 <parameter>--with-xtlibdir=/lib/xtables</parameter>: Ensure all
156 <application>Iptables</application> modules are installed in the
157 <filename class="directory">/lib/xtables</filename> directory.
158 </para>
159
160 <para>
161 <option>--enable-libipq</option>: This switch enables building
162 of <filename class="libraryfile">libipq.so</filename> which
163 can be used by some packages outside of BLFS.
164 </para>
165
166 <para>
167 <option>--enable-nfsynproxy</option>: This switch enables installation
168 of <application>nfsynproxy</application> SYNPROXY configuration tool.
169 </para>
170
171 <para>
172 <command>ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml</command>:
173 Ensure the symbolic link for <command>iptables-xml</command> is relative.
174 </para>
175
176 </sect2>
177
178 <sect2 role="configuration">
179 <title>Configuring Iptables</title>
180
181 <para>
182 Introductory instructions for configuring your firewall are
183 presented in the next section: <xref linkend="fw-firewall"/>
184 </para>
185
186 <sect3 id="iptables-init">
187 <title>Systemd Units</title>
188
189 <para>
190 To set up the <application>Iptables</application> firewall at boot,
191 install the systemd unit from the <xref linkend="bootscripts"/>
192 package by running the following command as the
193 <systemitem class="username">root</systemitem> user:
194 </para>
195
196 <indexterm zone="iptables iptables-init">
197 <primary sortas="f-iptables">iptables</primary>
198 </indexterm>
199
200<screen role="root"><userinput>make install-iptables</userinput></screen>
201
202 </sect3>
203
204 </sect2>
205
206 <sect2 role="content">
207 <title>Contents</title>
208
209 <segmentedlist>
210 <segtitle>Installed Programs</segtitle>
211 <segtitle>Installed Libraries</segtitle>
212 <segtitle>Installed Directories</segtitle>
213
214 <seglistitem>
215 <seg>
216 ip6tables, ip6tables-restore, ip6tables-save, iptables, iptables-restore,
217 iptables-save, iptables-xml, nfsynproxy (optional) and xtables-multi
218 </seg>
219 <seg>
220 libip4tc.so, libip6tc.so, libipq.so, libiptc.so, and libxtables.so
221 </seg>
222 <seg>
223 /lib/xtables and /usr/include/libiptc
224 </seg>
225 </seglistitem>
226 </segmentedlist>
227
228 <variablelist>
229 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
230 <?dbfo list-presentation="list"?>
231 <?dbhtml list-presentation="table"?>
232
233 <varlistentry id="iptables-prog">
234 <term><command>iptables</command></term>
235 <listitem>
236 <para>
237 is used to set up, maintain, and inspect the tables of
238 IP packet filter rules in the Linux kernel.
239 </para>
240 <indexterm zone="iptables iptables-prog">
241 <primary sortas="b-iptables">iptables</primary>
242 </indexterm>
243 </listitem>
244 </varlistentry>
245
246 <varlistentry id="iptables-restore">
247 <term><command>iptables-restore</command></term>
248 <listitem>
249 <para>
250 is used to restore IP Tables from data specified on
251 STDIN. Use I/O redirection provided by your
252 shell to read from a file.
253 </para>
254 <indexterm zone="iptables iptables-restore">
255 <primary sortas="b-iptables-restore">iptables-restore</primary>
256 </indexterm>
257 </listitem>
258 </varlistentry>
259
260 <varlistentry id="iptables-save">
261 <term><command>iptables-save</command></term>
262 <listitem>
263 <para>
264 is used to dump the contents of an IP Table in easily
265 parseable format to STDOUT. Use I/O-redirection
266 provided by your shell to write to a file.
267 </para>
268 <indexterm zone="iptables iptables-save">
269 <primary sortas="b-iptables-save">iptables-save</primary>
270 </indexterm>
271 </listitem>
272 </varlistentry>
273
274 <varlistentry id="iptables-xml">
275 <term><command>iptables-xml</command></term>
276 <listitem>
277 <para>
278 is used to convert the output of
279 <command>iptables-save</command> to an XML format. Using the
280 <filename>iptables.xslt</filename> stylesheet converts the XML
281 back to the format of <command>iptables-restore</command>.
282 </para>
283 <indexterm zone="iptables iptables-xml">
284 <primary sortas="b-iptables-xml">iptables-xml</primary>
285 </indexterm>
286 </listitem>
287 </varlistentry>
288
289 <varlistentry id="ip6tables">
290 <term><command>ip6tables*</command></term>
291 <listitem>
292 <para>
293 are a set of commands for IPV6 that parallel the iptables
294 commands above.
295 </para>
296 <indexterm zone="iptables ip6tables">
297 <primary sortas="b-ip6tables">ip6tables</primary>
298 </indexterm>
299 </listitem>
300 </varlistentry>
301
302 <varlistentry id="nfsynproxy">
303 <term><command>nfsynproxy</command></term>
304 <listitem>
305 <para>
306 (optional) configuration tool. SYNPROXY target makes handling of
307 large SYN floods possible without the large performance penalties
308 imposed by the connection tracking in such cases.
309 </para>
310 <indexterm zone="iptables nfsynproxy">
311 <primary sortas="b-nfsynproxy">nfsynproxy</primary>
312 </indexterm>
313 </listitem>
314 </varlistentry>
315
316 <varlistentry id="xtables-multi">
317 <term><command>xtables-multi</command></term>
318 <listitem>
319 <para>
320 is a binary that behaves according to the name it is called by.
321 </para>
322 <indexterm zone="iptables xtables-multi">
323 <primary sortas="b-xtables-multi">xtables-multi</primary>
324 </indexterm>
325 </listitem>
326 </varlistentry>
327
328 </variablelist>
329
330 </sect2>
331
332</sect1>
Note: See TracBrowser for help on using the repository browser.