source: postlfs/security/iptables.xml@ 8008a55

10.0 10.1 11.0 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 ken/refactor-virt krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk upgradedb xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since 8008a55 was 8008a55, checked in by Randy McMurchy <randy@…>, 14 years ago

Fixed a typo in the Iptables instructions

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@7002 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 10.4 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY iptables-download-http "http://www.netfilter.org/projects/iptables/files/iptables-&iptables-version;.tar.bz2">
8 <!ENTITY iptables-download-ftp "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
9 <!ENTITY iptables-md5sum "0a9209f928002e5eee9cdff8fef4d4b3">
10 <!ENTITY iptables-size "169 KB">
11 <!ENTITY iptables-buildsize "4.0 MB">
12 <!ENTITY iptables-time "0.1 SBU">
13]>
14
15<sect1 id="iptables" xreflabel="iptables-&iptables-version;">
16 <?dbhtml filename="iptables.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Iptables-&iptables-version;</title>
24
25 <indexterm zone="iptables">
26 <primary sortas="a-Iptables">Iptables</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Iptables</title>
31
32 <para>The next part of this chapter deals with firewalls. The principal
33 firewall tool for Linux, as of the 2.4 kernel series, is
34 <application>iptables</application>. It replaces
35 <application>ipchains</application> from the 2.2 series and
36 <application>ipfwadm</application> from the 2.0 series. You will need to
37 install <application>iptables</application> if you intend on using any
38 form of a firewall.</para>
39
40 <bridgehead renderas="sect3">Package Information</bridgehead>
41 <itemizedlist spacing="compact">
42 <listitem>
43 <para>Download (HTTP): <ulink url="&iptables-download-http;"/></para>
44 </listitem>
45 <listitem>
46 <para>Download (FTP): <ulink url="&iptables-download-ftp;"/></para>
47 </listitem>
48 <listitem>
49 <para>Download MD5 sum: &iptables-md5sum;</para>
50 </listitem>
51 <listitem>
52 <para>Download size: &iptables-size;</para>
53 </listitem>
54 <listitem>
55 <para>Estimated disk space required: &iptables-buildsize;</para>
56 </listitem>
57 <listitem>
58 <para>Estimated build time: &iptables-time;</para>
59 </listitem>
60 </itemizedlist>
61
62 <para condition="html" role="usernotes">User Notes:
63 <ulink url="&blfs-wiki;/iptables"/></para>
64
65 </sect2>
66
67 <sect2 role="kernel" id='iptables-kernel'>
68 <title>Kernel Configuration</title>
69
70 <para>A firewall in Linux is accomplished through a portion of the
71 kernel called netfilter. The interface to netfilter is
72 <application>iptables</application>. To use it, the appropriate
73 kernel configuration parameters are found in Networking &rArr;
74 Networking Options &rArr; Network Packet Filtering &rArr;
75 Core Netfilter Configuration (and) IP: Netfilter Configuration.</para>
76
77 <indexterm zone="iptables iptables-kernel">
78 <primary sortas="d-iptables">Iptables</primary>
79 </indexterm>
80
81 </sect2>
82
83 <sect2 role="installation">
84 <title>Installation of Iptables</title>
85
86 <note>
87 <para>The installation below does not include building some specialized
88 extension libraries which require the raw headers in the
89 <application>Linux</application> source code. If you wish to build the
90 additional extensions (if you aren't sure, then you probably don't), you
91 can look at the <filename>INSTALL</filename> file to see an example of
92 how to change the <parameter>KERNEL_DIR=</parameter> parameter to point
93 at the <application>Linux</application> source code. Note that if you
94 upgrade the kernel version, you may also need to recompile
95 <application>iptables</application> and that the BLFS team has not tested
96 using the raw kernel headers.</para>
97
98 <!-- <para>Installation of <application>iptables</application> will fail
99 if raw kernel headers are found in <filename
100 class='directory'>/usr/src/linux</filename> either as actual files
101 or a symlink. As of the Linux 2.6 kernel series, this directory
102 should no longer exist because appropriate headers were installed
103 from the <application>Linux-Libc-Headers</application> package during
104 the base LFS installation.</para> -->
105
106 <para>For some non-x86 architectures, the raw kernel headers may be
107 required. In that case, modify the <parameter>KERNEL_DIR=</parameter>
108 parameter to point at the <application>Linux</application> source
109 code.</para>
110 </note>
111
112 <para>Install <application>iptables</application> by running the following
113 commands:</para>
114
115<screen><userinput>sed -i 's/name="$node/name="node/' iptables.xslt &amp;&amp;
116make LIBDIR=/lib KERNEL_DIR=/usr</userinput></screen>
117
118 <para>This package does not come with a test suite.</para>
119
120 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
121
122<screen role="root"><userinput>make PREFIX=/usr LIBDIR=/lib BINDIR=/sbin \
123 MANDIR=/usr/share/man install &amp;&amp;
124install -v -m644 iptables.xslt /lib/iptables</userinput></screen>
125
126 </sect2>
127
128 <sect2 role="commands">
129 <title>Command Explanations</title>
130
131 <para><command>sed -i 's/name="$node/name="node/' iptables.xslt</command>:
132 This corrects a syntax error in the XSLT stylesheet for use with
133 <command>iptables-xml</command>.</para>
134
135 <para><parameter>PREFIX=/usr LIBDIR=/lib BINDIR=/sbin</parameter>:
136 Compiles and installs <application>iptables</application> modules
137 into <filename class="directory">/lib</filename>, binaries into
138 <filename class="directory">/sbin</filename> and the remainder into
139 the <filename class="directory">/usr</filename> hierarchy instead of
140 <filename class="directory">/usr/local</filename>. Firewalls are
141 generally activated during the boot process and
142 <filename class="directory">/usr</filename> may not be mounted at
143 that time.</para>
144
145 <para><parameter>KERNEL_DIR=/usr</parameter>: This parameter is used to
146 point at the sanitized kernel headers in
147 <filename class='directory'>/usr</filename> and not use the raw kernel
148 headers in <filename class='directory'>/usr/src/linux</filename>.</para>
149
150 </sect2>
151
152 <sect2 role="configuration">
153 <title>Configuring Iptables</title>
154
155 <para>Introductory instructions for configuring your firewall are
156 presented in the next section: <xref linkend='fw-firewall'/></para>
157
158 <sect3 id="iptables-init">
159 <title>Boot Script</title>
160
161 <para>To set up the iptables firewall at boot, install the
162 <filename>/etc/rc.d/init.d/iptables</filename> init script included
163 in the <xref linkend="bootscripts"/> package.</para>
164
165 <indexterm zone="iptables iptables-init">
166 <primary sortas="f-iptables">iptables</primary>
167 </indexterm>
168
169<screen role="root"><userinput>make install-iptables</userinput></screen>
170
171 </sect3>
172
173 </sect2>
174
175 <sect2 role="content">
176 <title>Contents</title>
177
178 <segmentedlist>
179 <segtitle>Installed Programs</segtitle>
180 <segtitle>Installed Libraries</segtitle>
181 <segtitle>Installed Directory</segtitle>
182
183 <seglistitem>
184 <seg>iptables, iptables-restore, iptables-save, iptables-xml and
185 ip6tables</seg>
186 <seg>libip6t_*.so and libipt_*.so</seg>
187 <seg>/lib/iptables</seg>
188 </seglistitem>
189 </segmentedlist>
190
191 <variablelist>
192 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
193 <?dbfo list-presentation="list"?>
194 <?dbhtml list-presentation="table"?>
195
196 <varlistentry id="iptables-prog">
197 <term><command>iptables</command></term>
198 <listitem>
199 <para>is used to set up, maintain, and inspect the tables of
200 IP packet filter rules in the Linux kernel.</para>
201 <indexterm zone="iptables iptables-prog">
202 <primary sortas="b-iptables">iptables</primary>
203 </indexterm>
204 </listitem>
205 </varlistentry>
206
207 <varlistentry id="iptables-restore">
208 <term><command>iptables-restore</command></term>
209 <listitem>
210 <para>is used to restore IP Tables from data
211 specified on STDIN. Use I/O redirection provided by your
212 shell to read from a file.</para>
213 <indexterm zone="iptables iptables-restore">
214 <primary sortas="b-iptables-restore">iptables-restore</primary>
215 </indexterm>
216 </listitem>
217 </varlistentry>
218
219 <varlistentry id="iptables-save">
220 <term><command>iptables-save</command></term>
221 <listitem>
222 <para>is used to dump the contents of an IP Table
223 in easily parseable format to STDOUT. Use I/O-redirection
224 provided by your shell to write to a file.</para>
225 <indexterm zone="iptables iptables-save">
226 <primary sortas="b-iptables-save">iptables-save</primary>
227 </indexterm>
228 </listitem>
229 </varlistentry>
230
231 <varlistentry id="iptables-xml">
232 <term><command>iptables-xml</command></term>
233 <listitem>
234 <para>is used to convert the output of
235 <command>iptables-save</command> to an XML format. Using the
236 <filename>iptables.xslt</filename> stylesheet converts the XML
237 bask to the format of <command>iptables-restore</command>.</para>
238 <indexterm zone="iptables iptables-xml">
239 <primary sortas="b-iptables-xml">iptables-xml</primary>
240 </indexterm>
241 </listitem>
242 </varlistentry>
243
244 <varlistentry id="ip6tables">
245 <term><command>ip6tables</command></term>
246 <listitem>
247 <para>is used to set up, maintain, and inspect the tables of
248 IPv6 packet filter rules in the Linux kernel. Several different
249 tables may be defined. Each table contains a number of built-in
250 chains and may also contain user-defined chains.</para>
251 <indexterm zone="iptables ip6tables">
252 <primary sortas="b-ip6tables">ip6tables</primary>
253 </indexterm>
254 </listitem>
255 </varlistentry>
256
257 <varlistentry id="libip-iptables">
258 <term><filename class='libraryfile'>libip*.so</filename></term>
259 <listitem>
260 <para>library modules are various modules (implemented as dynamic
261 libraries) which extend the core functionality of
262 <command>iptables</command>.</para>
263 <indexterm zone="iptables libip-iptables">
264 <primary sortas="c-libip-iptables">libip*.so</primary>
265 </indexterm>
266 </listitem>
267 </varlistentry>
268
269 </variablelist>
270
271 </sect2>
272
273</sect1>
Note: See TracBrowser for help on using the repository browser.