source: postlfs/security/iptables-systemd.xml@ 295ca00

systemd-13485
Last change on this file since 295ca00 was 295ca00, checked in by Douglas R. Reno <renodr@…>, 6 years ago

Update to Sudo-1.8.15 (merged from trunk r16594)
Update to stunnel-5.29 (merged from trunk r16797)
Update to ssh-askpass-4.1p2 (merged from trunk r16811)
Update to p11-kit-0.23.2 (merged from trunk r16716)
Update to OpenSSL-1.0.2e (merged from trunk r16708)
Update to OpenSSH-7.1p2 (merged from trunk r16811)
Update to NSS-3.21 (merged from trunk r16627)
Update to MIT Kerberos V5-1.14 (merged from trunk r16679)
Update to iptables-1.6.0 (merged from trunk r16742)
Update to GPGME-1.6.0 (merged from trunk r16360)
Update to GnuTLS-3.4.8 (merged from trunk r16797)

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/branches/systemd@16833 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 11.3 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY iptables-download-http "http://www.netfilter.org/projects/iptables/files/iptables-&iptables-version;.tar.bz2">
8 <!ENTITY iptables-download-ftp "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
9 <!ENTITY iptables-md5sum "27ba3451cb622467fc9267a176f19a31">
10 <!ENTITY iptables-size "596 KB">
11 <!ENTITY iptables-buildsize "19 MB">
12 <!ENTITY iptables-time "0.1 SBU">
13]>
14
15<sect1 id="iptables" xreflabel="Iptables-&iptables-version;">
16 <?dbhtml filename="iptables.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Iptables-&iptables-version;</title>
24
25 <indexterm zone="iptables">
26 <primary sortas="a-Iptables">Iptables</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Iptables</title>
31
32 <para>
33 The next part of this chapter deals with firewalls. The principal
34 firewall tool for Linux is <application>Iptables</application>. You will
35 need to install <application>Iptables</application> if you intend on using
36 any form of a firewall.
37 </para>
38
39 &lfs77_checked;
40
41 <bridgehead renderas="sect3">Package Information</bridgehead>
42 <itemizedlist spacing="compact">
43 <listitem>
44 <para>
45 Download (HTTP): <ulink url="&iptables-download-http;"/>
46 </para>
47 </listitem>
48 <listitem>
49 <para>
50 Download (FTP): <ulink url="&iptables-download-ftp;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download MD5 sum: &iptables-md5sum;
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download size: &iptables-size;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Estimated disk space required: &iptables-buildsize;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated build time: &iptables-time;
71 </para>
72 </listitem>
73 </itemizedlist>
74
75 <bridgehead renderas="sect3">Iptables Dependencies</bridgehead>
76
77 <bridgehead renderas="sect4">Optional</bridgehead>
78 <para role="optional">
79 <ulink url="http://www.netfilter.org/projects/nftables/index.html">nftables</ulink>
80 </para>
81
82 <para condition="html" role="usernotes">User Notes:
83 <ulink url="&blfs-wiki;/iptables"/>
84 </para>
85 </sect2>
86
87 <sect2 role="kernel" id="iptables-kernel">
88 <title>Kernel Configuration</title>
89
90 <para>
91 A firewall in Linux is accomplished through a portion of the
92 kernel called netfilter. The interface to netfilter is
93 <application>Iptables</application>. To use it, the appropriate
94 kernel configuration parameters are found in:
95 </para>
96
97<screen><literal>[*] Networking support ---&gt; [CONFIG_NET]
98 Networking Options ---&gt;
99 [*] Network packet filtering framework (Netfilter) ---&gt; [CONFIG_NETFILTER]</literal></screen>
100
101 <indexterm zone="iptables iptables-kernel">
102 <primary sortas="d-iptables">Iptables</primary>
103 </indexterm>
104
105 </sect2>
106
107 <sect2 role="installation">
108 <title>Installation of Iptables</title>
109
110 <note>
111 <para>
112 The installation below does not include building some specialized
113 extension libraries which require the raw headers in the
114 <application>Linux</application> source code. If you wish to build the
115 additional extensions (if you aren't sure, then you probably don't), you
116 can look at the <filename>INSTALL</filename> file to see an example of
117 how to change the <parameter>KERNEL_DIR=</parameter> parameter to point
118 at the <application>Linux</application> source code. Note that if you
119 upgrade the kernel version, you may also need to recompile
120 <application>Iptables</application> and that the BLFS team has not tested
121 using the raw kernel headers.
122 </para>
123
124 <para>
125 For some non-x86 architectures, the raw kernel headers may be
126 required. In that case, modify the <parameter>KERNEL_DIR=</parameter>
127 parameter to point at the <application>Linux</application> source
128 code.
129 </para>
130 </note>
131
132 <para>
133 Install <application>Iptables</application> by running the following
134 commands:
135 </para>
136
137<screen><userinput>./configure --prefix=/usr \
138 --sbindir=/sbin \
139 --disable-nftables \
140 --enable-libipq \
141 --with-xtlibdir=/lib/xtables &amp;&amp;
142make</userinput></screen>
143
144 <para>This package does not come with a test suite.</para>
145
146 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
147
148<screen role="root"><userinput>make install &amp;&amp;
149ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml &amp;&amp;
150
151for file in ip4tc ip6tc ipq iptc xtables
152do
153 mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
154 ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
155done</userinput></screen>
156
157 </sect2>
158
159 <sect2 role="commands">
160 <title>Command Explanations</title>
161
162 <para>
163 <parameter>--disable-nftables</parameter>: This switch disables building
164 nftables compatibility. Omit this switch if you have installed nftables.
165 </para>
166
167 <para>
168 <option>--enable-libipq</option>: This switch enables building
169 of <filename class="libraryfile">libipq.so</filename> which
170 can be used by some packages outside of BLFS.
171 </para>
172
173 <para>
174 <option>--enable-nfsynproxy</option>: This switch enables installation
175 of <application>nfsynproxy</application> SYNPROXY configuration tool.
176 </para>
177
178 <para>
179 <option>--with-xtlibdir=/lib/xtables</option>: Ensure all
180 <application>iptables</application> modules are installed in the
181 <filename class="directory">/lib/xtables</filename> directory.
182 </para>
183
184 <para>
185 <command>ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml</command>:
186 Ensure the symbolic link for <command>iptables-xml</command> is relative.
187 </para>
188
189 </sect2>
190
191 <sect2 role="configuration">
192 <title>Configuring Iptables</title>
193
194 <para>
195 Introductory instructions for configuring your firewall are
196 presented in the next section: <xref linkend="fw-firewall"/>
197 </para>
198
199 <sect3 id="iptables-init">
200 <title>Systemd Units</title>
201
202 <para>
203 To set up the <application>Iptables</application> firewall at boot,
204 install the systemd unit from the <xref linkend="bootscripts"/>
205 package by running the following command as the
206 <systemitem class="username">root</systemitem> user:
207 </para>
208
209 <indexterm zone="iptables iptables-init">
210 <primary sortas="f-iptables">iptables</primary>
211 </indexterm>
212
213<screen role="root"><userinput>make install-iptables</userinput></screen>
214
215 </sect3>
216
217 </sect2>
218
219 <sect2 role="content">
220 <title>Contents</title>
221
222 <segmentedlist>
223 <segtitle>Installed Programs</segtitle>
224 <segtitle>Installed Libraries</segtitle>
225 <segtitle>Installed Directories</segtitle>
226
227 <seglistitem>
228 <seg>
229 ip6tables,
230 ip6tables-restore,
231 ip6tables-save,
232 iptables,
233 iptables-restore,
234 iptables-save,
235 iptables-xml,
236 nfsynproxy (optional) and xtables-multi
237 </seg>
238 <seg>
239 libip4tc.so,
240 libip6tc.so,
241 libipq.so,
242 libiptc.so,
243 and libxtables.so
244 </seg>
245 <seg>
246 /lib/xtables
247 and /usr/include/libiptc
248 </seg>
249 </seglistitem>
250 </segmentedlist>
251
252 <variablelist>
253 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
254 <?dbfo list-presentation="list"?>
255 <?dbhtml list-presentation="table"?>
256
257 <varlistentry id="iptables-prog">
258 <term><command>iptables</command></term>
259 <listitem>
260 <para>
261 is used to set up, maintain, and inspect the tables of
262 IP packet filter rules in the Linux kernel.
263 </para>
264 <indexterm zone="iptables iptables-prog">
265 <primary sortas="b-iptables">iptables</primary>
266 </indexterm>
267 </listitem>
268 </varlistentry>
269
270 <varlistentry id="iptables-restore">
271 <term><command>iptables-restore</command></term>
272 <listitem>
273 <para>
274 is used to restore IP Tables from data specified on
275 STDIN. Use I/O redirection provided by your
276 shell to read from a file.
277 </para>
278 <indexterm zone="iptables iptables-restore">
279 <primary sortas="b-iptables-restore">iptables-restore</primary>
280 </indexterm>
281 </listitem>
282 </varlistentry>
283
284 <varlistentry id="iptables-save">
285 <term><command>iptables-save</command></term>
286 <listitem>
287 <para>
288 is used to dump the contents of an IP Table in easily
289 parseable format to STDOUT. Use I/O-redirection
290 provided by your shell to write to a file.
291 </para>
292 <indexterm zone="iptables iptables-save">
293 <primary sortas="b-iptables-save">iptables-save</primary>
294 </indexterm>
295 </listitem>
296 </varlistentry>
297
298 <varlistentry id="iptables-xml">
299 <term><command>iptables-xml</command></term>
300 <listitem>
301 <para>
302 is used to convert the output of
303 <command>iptables-save</command> to an XML format. Using the
304 <filename>iptables.xslt</filename> stylesheet converts the XML
305 back to the format of <command>iptables-restore</command>.
306 </para>
307 <indexterm zone="iptables iptables-xml">
308 <primary sortas="b-iptables-xml">iptables-xml</primary>
309 </indexterm>
310 </listitem>
311 </varlistentry>
312
313 <varlistentry id="ip6tables">
314 <term><command>ip6tables*</command></term>
315 <listitem>
316 <para>
317 are a set of commands for IPV6 that parallel the iptables
318 commands above.
319 </para>
320 <indexterm zone="iptables ip6tables">
321 <primary sortas="b-ip6tables">ip6tables</primary>
322 </indexterm>
323 </listitem>
324 </varlistentry>
325
326 <varlistentry id="nfsynproxy">
327 <term><command>nfsynproxy</command></term>
328 <listitem>
329 <para>
330 (optional) configuration tool. SYNPROXY target makes handling of
331 large SYN floods possible without the large performance penalties
332 imposed by the connection tracking in such cases.
333 </para>
334 <indexterm zone="iptables nfsynproxy">
335 <primary sortas="b-nfsynproxy">nfsynproxy</primary>
336 </indexterm>
337 </listitem>
338 </varlistentry>
339
340 <varlistentry id="xtables-multi">
341 <term><command>xtables-multi</command></term>
342 <listitem>
343 <para>
344 is a binary that behaves according to the name it is called by.
345 </para>
346 <indexterm zone="iptables xtables-multi">
347 <primary sortas="b-xtables-multi">xtables-multi</primary>
348 </indexterm>
349 </listitem>
350 </varlistentry>
351
352 </variablelist>
353
354 </sect2>
355
356</sect1>
Note: See TracBrowser for help on using the repository browser.