source: postlfs/security/iptables.xml@ 00f9a2a1

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 00f9a2a1 was 00f9a2a1, checked in by Bruce Dubbs <bdubbs@…>, 7 years ago

Update to kf5-5.37.
Update to NetworkManager-1.8.2.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@19091 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 11.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY iptables-download-http "http://www.netfilter.org/projects/iptables/files/iptables-&iptables-version;.tar.bz2">
8 <!ENTITY iptables-download-ftp "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
9 <!ENTITY iptables-md5sum "ab38a33806b6182c6f53d6afb4619add">
10 <!ENTITY iptables-size "608 KB">
11 <!ENTITY iptables-buildsize "15 MB">
12 <!ENTITY iptables-time "0.2 SBU">
13]>
14
15<sect1 id="iptables" xreflabel="Iptables-&iptables-version;">
16 <?dbhtml filename="iptables.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Iptables-&iptables-version;</title>
24
25 <indexterm zone="iptables">
26 <primary sortas="a-Iptables">Iptables</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Iptables</title>
31
32 <para>
33 The next part of this chapter deals with firewalls. The principal
34 firewall tool for Linux is <application>Iptables</application>. You will
35 need to install <application>Iptables</application> if you intend on using
36 any form of a firewall.
37 </para>
38
39 &lfs81_checked;
40
41 <bridgehead renderas="sect3">Package Information</bridgehead>
42 <itemizedlist spacing="compact">
43 <listitem>
44 <para>
45 Download (HTTP): <ulink url="&iptables-download-http;"/>
46 </para>
47 </listitem>
48 <listitem>
49 <para>
50 Download (FTP): <ulink url="&iptables-download-ftp;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download MD5 sum: &iptables-md5sum;
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download size: &iptables-size;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Estimated disk space required: &iptables-buildsize;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated build time: &iptables-time;
71 </para>
72 </listitem>
73 </itemizedlist>
74
75 <bridgehead renderas="sect3">Iptables Dependencies</bridgehead>
76
77 <bridgehead renderas="sect4">Optional</bridgehead>
78 <para role="optional">
79 <ulink url="http://www.netfilter.org/projects/nftables/index.html">nftables</ulink>
80 </para>
81
82
83 <para condition="html" role="usernotes">User Notes:
84 <ulink url="&blfs-wiki;/iptables"/>
85 </para>
86 </sect2>
87
88 <sect2 role="kernel" id="iptables-kernel">
89 <title>Kernel Configuration</title>
90
91 <para>
92 A firewall in Linux is accomplished through a portion of the
93 kernel called netfilter. The interface to netfilter is
94 <application>Iptables</application>. To use it, the appropriate
95 kernel configuration parameters are found in:
96 </para>
97
98<screen><literal>[*] Networking support ---&gt; [CONFIG_NET]
99 Networking Options ---&gt;
100 [*] Network packet filtering framework (Netfilter) ---&gt; [CONFIG_NETFILTER]</literal></screen>
101
102 <indexterm zone="iptables iptables-kernel">
103 <primary sortas="d-iptables">Iptables</primary>
104 </indexterm>
105
106 </sect2>
107
108 <sect2 role="installation">
109 <title>Installation of Iptables</title>
110
111 <note>
112 <para>
113 The installation below does not include building some specialized
114 extension libraries which require the raw headers in the
115 <application>Linux</application> source code. If you wish to build the
116 additional extensions (if you aren't sure, then you probably don't), you
117 can look at the <filename>INSTALL</filename> file to see an example of
118 how to change the <parameter>KERNEL_DIR=</parameter> parameter to point
119 at the <application>Linux</application> source code. Note that if you
120 upgrade the kernel version, you may also need to recompile
121 <application>Iptables</application> and that the BLFS team has not tested
122 using the raw kernel headers.
123 </para>
124
125 <para>
126 For some non-x86 architectures, the raw kernel headers may be
127 required. In that case, modify the <parameter>KERNEL_DIR=</parameter>
128 parameter to point at the <application>Linux</application> source
129 code.
130 </para>
131 </note>
132
133 <para>
134 Install <application>Iptables</application> by running the following
135 commands:
136 </para>
137
138<screen><userinput>./configure --prefix=/usr \
139 --sbindir=/sbin \
140 --disable-nftables \
141 --enable-libipq \
142 --with-xtlibdir=/lib/xtables &amp;&amp;
143make</userinput></screen>
144
145 <para>This package does not come with a test suite.</para>
146
147 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
148
149<screen role="root"><userinput>make install &amp;&amp;
150ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml &amp;&amp;
151
152for file in ip4tc ip6tc ipq iptc xtables
153do
154 mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
155 ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
156done</userinput></screen>
157
158 </sect2>
159
160 <sect2 role="commands">
161 <title>Command Explanations</title>
162
163 <para>
164 <parameter>--disable-nftables</parameter>: This switch disables building
165 nftables compat. Omit this switch if you have installed nftables.
166 </para>
167
168 <para>
169 <parameter>--enable-libipq</parameter>: This switch enables building
170 of <filename class="libraryfile">libipq.so</filename> which
171 can be used by some packages outside of BLFS.
172 </para>
173
174 <para>
175 <parameter>--with-xtlibdir=/lib/xtables</parameter>: Ensure all
176 <application>Iptables</application> modules are installed in the
177 <filename class="directory">/lib/xtables</filename> directory.
178 </para>
179
180 <para>
181 <option>--enable-nfsynproxy</option>: This switch enables installation
182 of <application>nfsynproxy</application> SYNPROXY configuration tool.
183 </para>
184
185 <para>
186 <command>ln -sfv ../../sbin/xtables-multi /usr/bin/iptables-xml</command>:
187 Ensure the symbolic link for <command>iptables-xml</command> is relative.
188 </para>
189
190 </sect2>
191
192 <sect2 role="configuration">
193 <title>Configuring Iptables</title>
194
195 <para>
196 Introductory instructions for configuring your firewall are
197 presented in the next section: <xref linkend="fw-firewall"/>
198 </para>
199
200 <sect3 id="iptables-init">
201 <title><phrase revision="sysv">Boot Script</phrase>
202 <phrase revision="systemd">Systemd Unit</phrase></title>
203
204 <para revision="sysv">
205 To set up the iptables firewall at boot, install the
206 <filename>/etc/rc.d/init.d/iptables</filename> init script included
207 in the <xref linkend="bootscripts"/> package.
208 </para>
209
210 <para revision="systemd">
211 To set up the iptables firewall at boot, install the
212 <filename>iptables.service</filename> unit included in the
213 <xref linkend="systemd-units"/> package.
214 </para>
215
216 <indexterm zone="iptables iptables-init">
217 <primary sortas="f-iptables">iptables</primary>
218 </indexterm>
219
220<screen role="root"><userinput>make install-iptables</userinput></screen>
221
222 </sect3>
223
224 </sect2>
225
226 <sect2 role="content">
227 <title>Contents</title>
228
229 <segmentedlist>
230 <segtitle>Installed Programs</segtitle>
231 <segtitle>Installed Libraries</segtitle>
232 <segtitle>Installed Directories</segtitle>
233
234 <seglistitem>
235 <seg>
236 ip6tables, ip6tables-restore, ip6tables-save, iptables, iptables-restore,
237 iptables-save, iptables-xml, nfsynproxy (optional) and xtables-multi
238 </seg>
239 <seg>
240 libip4tc.so, libip6tc.so, libipq.so, libiptc.so, and libxtables.so
241 </seg>
242 <seg>
243 /lib/xtables and /usr/include/libiptc
244 </seg>
245 </seglistitem>
246 </segmentedlist>
247
248 <variablelist>
249 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
250 <?dbfo list-presentation="list"?>
251 <?dbhtml list-presentation="table"?>
252
253 <varlistentry id="iptables-prog">
254 <term><command>iptables</command></term>
255 <listitem>
256 <para>
257 is used to set up, maintain, and inspect the tables of
258 IP packet filter rules in the Linux kernel.
259 </para>
260 <indexterm zone="iptables iptables-prog">
261 <primary sortas="b-iptables">iptables</primary>
262 </indexterm>
263 </listitem>
264 </varlistentry>
265
266 <varlistentry id="iptables-restore">
267 <term><command>iptables-restore</command></term>
268 <listitem>
269 <para>
270 is used to restore IP Tables from data specified on
271 STDIN. Use I/O redirection provided by your
272 shell to read from a file.
273 </para>
274 <indexterm zone="iptables iptables-restore">
275 <primary sortas="b-iptables-restore">iptables-restore</primary>
276 </indexterm>
277 </listitem>
278 </varlistentry>
279
280 <varlistentry id="iptables-save">
281 <term><command>iptables-save</command></term>
282 <listitem>
283 <para>
284 is used to dump the contents of an IP Table in easily
285 parseable format to STDOUT. Use I/O-redirection
286 provided by your shell to write to a file.
287 </para>
288 <indexterm zone="iptables iptables-save">
289 <primary sortas="b-iptables-save">iptables-save</primary>
290 </indexterm>
291 </listitem>
292 </varlistentry>
293
294 <varlistentry id="iptables-xml">
295 <term><command>iptables-xml</command></term>
296 <listitem>
297 <para>
298 is used to convert the output of
299 <command>iptables-save</command> to an XML format. Using the
300 <filename>iptables.xslt</filename> stylesheet converts the XML
301 back to the format of <command>iptables-restore</command>.
302 </para>
303 <indexterm zone="iptables iptables-xml">
304 <primary sortas="b-iptables-xml">iptables-xml</primary>
305 </indexterm>
306 </listitem>
307 </varlistentry>
308
309 <varlistentry id="ip6tables">
310 <term><command>ip6tables*</command></term>
311 <listitem>
312 <para>
313 are a set of commands for IPV6 that parallel the iptables
314 commands above.
315 </para>
316 <indexterm zone="iptables ip6tables">
317 <primary sortas="b-ip6tables">ip6tables</primary>
318 </indexterm>
319 </listitem>
320 </varlistentry>
321
322 <varlistentry id="nfsynproxy">
323 <term><command>nfsynproxy</command></term>
324 <listitem>
325 <para>
326 (optional) configuration tool. SYNPROXY target makes handling of
327 large SYN floods possible without the large performance penalties
328 imposed by the connection tracking in such cases.
329 </para>
330 <indexterm zone="iptables nfsynproxy">
331 <primary sortas="b-nfsynproxy">nfsynproxy</primary>
332 </indexterm>
333 </listitem>
334 </varlistentry>
335
336 <varlistentry id="xtables-multi">
337 <term><command>xtables-multi</command></term>
338 <listitem>
339 <para>
340 is a binary that behaves according to the name it is called by.
341 </para>
342 <indexterm zone="iptables xtables-multi">
343 <primary sortas="b-xtables-multi">xtables-multi</primary>
344 </indexterm>
345 </listitem>
346 </varlistentry>
347
348 </variablelist>
349
350 </sect2>
351
352</sect1>
Note: See TracBrowser for help on using the repository browser.