source: postlfs/security/iptables.xml@ 9eb7ee7

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 9eb7ee7 was 9eb7ee7, checked in by Bruce Dubbs <bdubbs@…>, 6 years ago

Update to bluez-5.50.
Update to libical-3.0.4.
Tags

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@20333 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 11.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY iptables-download-http "http://www.netfilter.org/projects/iptables/files/iptables-&iptables-version;.tar.bz2">
8 <!ENTITY iptables-download-ftp "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
9 <!ENTITY iptables-md5sum "3874ca08438be68cd793558283df48d1">
10 <!ENTITY iptables-size "664 KB">
11 <!ENTITY iptables-buildsize "17 MB">
12 <!ENTITY iptables-time "0.1 SBU">
13]>
14
15<sect1 id="iptables" xreflabel="Iptables-&iptables-version;">
16 <?dbhtml filename="iptables.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Iptables-&iptables-version;</title>
24
25 <indexterm zone="iptables">
26 <primary sortas="a-Iptables">Iptables</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Iptables</title>
31
32 <para>
33 The next part of this chapter deals with firewalls. The principal
34 firewall tool for Linux is <application>Iptables</application>. You will
35 need to install <application>Iptables</application> if you intend on using
36 any form of a firewall.
37 </para>
38
39 &lfs83_checked;
40
41 <bridgehead renderas="sect3">Package Information</bridgehead>
42 <itemizedlist spacing="compact">
43 <listitem>
44 <para>
45 Download (HTTP): <ulink url="&iptables-download-http;"/>
46 </para>
47 </listitem>
48 <listitem>
49 <para>
50 Download (FTP): <ulink url="&iptables-download-ftp;"/>
51 </para>
52 </listitem>
53 <listitem>
54 <para>
55 Download MD5 sum: &iptables-md5sum;
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download size: &iptables-size;
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Estimated disk space required: &iptables-buildsize;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Estimated build time: &iptables-time;
71 </para>
72 </listitem>
73 </itemizedlist>
74
75 <bridgehead renderas="sect3">Iptables Dependencies</bridgehead>
76
77 <bridgehead renderas="sect4">Optional</bridgehead>
78 <para role="optional">
79 <ulink url="http://www.netfilter.org/projects/nftables/index.html">nftables</ulink>
80 </para>
81
82
83 <para condition="html" role="usernotes">User Notes:
84 <ulink url="&blfs-wiki;/iptables"/>
85 </para>
86 </sect2>
87
88 <sect2 role="kernel" id="iptables-kernel">
89 <title>Kernel Configuration</title>
90
91 <para>
92 A firewall in Linux is accomplished through a portion of the
93 kernel called netfilter. The interface to netfilter is
94 <application>Iptables</application>. To use it, the appropriate
95 kernel configuration parameters are found in:
96 </para>
97
98<screen><literal>[*] Networking support ---&gt; [CONFIG_NET]
99 Networking Options ---&gt;
100 [*] Network packet filtering framework (Netfilter) ---&gt; [CONFIG_NETFILTER]</literal></screen>
101
102 <indexterm zone="iptables iptables-kernel">
103 <primary sortas="d-iptables">Iptables</primary>
104 </indexterm>
105
106 </sect2>
107
108 <sect2 role="installation">
109 <title>Installation of Iptables</title>
110
111 <note>
112 <para>
113 The installation below does not include building some specialized
114 extension libraries which require the raw headers in the
115 <application>Linux</application> source code. If you wish to build the
116 additional extensions (if you aren't sure, then you probably don't), you
117 can look at the <filename>INSTALL</filename> file to see an example of
118 how to change the <parameter>KERNEL_DIR=</parameter> parameter to point
119 at the <application>Linux</application> source code. Note that if you
120 upgrade the kernel version, you may also need to recompile
121 <application>Iptables</application> and that the BLFS team has not tested
122 using the raw kernel headers.
123 </para>
124
125 <para>
126 For some non-x86 architectures, the raw kernel headers may be
127 required. In that case, modify the <parameter>KERNEL_DIR=</parameter>
128 parameter to point at the <application>Linux</application> source
129 code.
130 </para>
131 </note>
132
133 <para>
134 Disable libebt/libarp extensions if
135 <ulink url="http://www.netfilter.org/projects/nftables/index.html">nftables</ulink>
136 is not installed to prevent a build failure:
137 </para>
138
139<screen><userinput>sed -i -e '/libebt_/s/^/#/' \
140 -e '/libarpt_/s/^/#/' extensions/GNUmakefile.in
141</userinput></screen>
142
143 <para>
144 Install <application>Iptables</application> by running the following
145 commands:
146 </para>
147
148<screen><userinput>./configure --prefix=/usr \
149 --sbindir=/sbin \
150 --disable-nftables \
151 --enable-libipq \
152 --with-xtlibdir=/lib/xtables &amp;&amp;
153make</userinput></screen>
154
155 <para>This package does not come with a test suite.</para>
156
157 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
158
159<screen role="root"><userinput>make install &amp;&amp;
160ln -sfv ../../sbin/xtables-legacy-multi /usr/bin/iptables-xml &amp;&amp;
161
162for file in ip4tc ip6tc ipq iptc xtables
163do
164 mv -v /usr/lib/lib${file}.so.* /lib &amp;&amp;
165 ln -sfv ../../lib/$(readlink /usr/lib/lib${file}.so) /usr/lib/lib${file}.so
166done</userinput></screen>
167
168 </sect2>
169
170 <sect2 role="commands">
171 <title>Command Explanations</title>
172
173 <para>
174 <parameter>--disable-nftables</parameter>: This switch disables building
175 nftables compat. Omit this switch if you have installed nftables.
176 </para>
177
178 <para>
179 <parameter>--enable-libipq</parameter>: This switch enables building
180 of <filename class="libraryfile">libipq.so</filename> which
181 can be used by some packages outside of BLFS.
182 </para>
183
184 <para>
185 <parameter>--with-xtlibdir=/lib/xtables</parameter>: Ensure all
186 <application>Iptables</application> modules are installed in the
187 <filename class="directory">/lib/xtables</filename> directory.
188 </para>
189
190 <para>
191 <option>--enable-nfsynproxy</option>: This switch enables installation
192 of <application>nfsynproxy</application> SYNPROXY configuration tool.
193 </para>
194
195 <para>
196 <command>ln -sfv ../../sbin/xtables-legacy-multi /usr/bin/iptables-xml</command>:
197 Ensure the symbolic link for <command>iptables-xml</command> is relative.
198 </para>
199
200 </sect2>
201
202 <sect2 role="configuration">
203 <title>Configuring Iptables</title>
204
205 <para>
206 Introductory instructions for configuring your firewall are
207 presented in the next section: <xref linkend="fw-firewall"/>
208 </para>
209
210 <sect3 id="iptables-init">
211 <title><phrase revision="sysv">Boot Script</phrase>
212 <phrase revision="systemd">Systemd Unit</phrase></title>
213
214 <para revision="sysv">
215 To set up the iptables firewall at boot, install the
216 <filename>/etc/rc.d/init.d/iptables</filename> init script included
217 in the <xref linkend="bootscripts"/> package.
218 </para>
219
220 <para revision="systemd">
221 To set up the iptables firewall at boot, install the
222 <filename>iptables.service</filename> unit included in the
223 <xref linkend="systemd-units"/> package.
224 </para>
225
226 <indexterm zone="iptables iptables-init">
227 <primary sortas="f-iptables">iptables</primary>
228 </indexterm>
229
230<screen role="root"><userinput>make install-iptables</userinput></screen>
231
232 </sect3>
233
234 </sect2>
235
236 <sect2 role="content">
237 <title>Contents</title>
238
239 <segmentedlist>
240 <segtitle>Installed Programs</segtitle>
241 <segtitle>Installed Libraries</segtitle>
242 <segtitle>Installed Directories</segtitle>
243
244 <seglistitem>
245 <seg>
246 ip6tables, ip6tables-restore, ip6tables-save, iptables, iptables-restore,
247 iptables-save, iptables-xml, nfsynproxy (optional) and xtables-multi
248 </seg>
249 <seg>
250 libip4tc.so, libip6tc.so, libipq.so, libiptc.so, and libxtables.so
251 </seg>
252 <seg>
253 /lib/xtables and /usr/include/libiptc
254 </seg>
255 </seglistitem>
256 </segmentedlist>
257
258 <variablelist>
259 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
260 <?dbfo list-presentation="list"?>
261 <?dbhtml list-presentation="table"?>
262
263 <varlistentry id="iptables-prog">
264 <term><command>iptables</command></term>
265 <listitem>
266 <para>
267 is used to set up, maintain, and inspect the tables of
268 IP packet filter rules in the Linux kernel.
269 </para>
270 <indexterm zone="iptables iptables-prog">
271 <primary sortas="b-iptables">iptables</primary>
272 </indexterm>
273 </listitem>
274 </varlistentry>
275
276 <varlistentry id="iptables-restore">
277 <term><command>iptables-restore</command></term>
278 <listitem>
279 <para>
280 is used to restore IP Tables from data specified on
281 STDIN. Use I/O redirection provided by your
282 shell to read from a file.
283 </para>
284 <indexterm zone="iptables iptables-restore">
285 <primary sortas="b-iptables-restore">iptables-restore</primary>
286 </indexterm>
287 </listitem>
288 </varlistentry>
289
290 <varlistentry id="iptables-save">
291 <term><command>iptables-save</command></term>
292 <listitem>
293 <para>
294 is used to dump the contents of an IP Table in easily
295 parseable format to STDOUT. Use I/O-redirection
296 provided by your shell to write to a file.
297 </para>
298 <indexterm zone="iptables iptables-save">
299 <primary sortas="b-iptables-save">iptables-save</primary>
300 </indexterm>
301 </listitem>
302 </varlistentry>
303
304 <varlistentry id="iptables-xml">
305 <term><command>iptables-xml</command></term>
306 <listitem>
307 <para>
308 is used to convert the output of
309 <command>iptables-save</command> to an XML format. Using the
310 <filename>iptables.xslt</filename> stylesheet converts the XML
311 back to the format of <command>iptables-restore</command>.
312 </para>
313 <indexterm zone="iptables iptables-xml">
314 <primary sortas="b-iptables-xml">iptables-xml</primary>
315 </indexterm>
316 </listitem>
317 </varlistentry>
318
319 <varlistentry id="ip6tables">
320 <term><command>ip6tables*</command></term>
321 <listitem>
322 <para>
323 are a set of commands for IPV6 that parallel the iptables
324 commands above.
325 </para>
326 <indexterm zone="iptables ip6tables">
327 <primary sortas="b-ip6tables">ip6tables</primary>
328 </indexterm>
329 </listitem>
330 </varlistentry>
331
332 <varlistentry id="nfsynproxy">
333 <term><command>nfsynproxy</command></term>
334 <listitem>
335 <para>
336 (optional) configuration tool. SYNPROXY target makes handling of
337 large SYN floods possible without the large performance penalties
338 imposed by the connection tracking in such cases.
339 </para>
340 <indexterm zone="iptables nfsynproxy">
341 <primary sortas="b-nfsynproxy">nfsynproxy</primary>
342 </indexterm>
343 </listitem>
344 </varlistentry>
345
346 <varlistentry id="xtables-multi">
347 <term><command>xtables-multi</command></term>
348 <listitem>
349 <para>
350 is a binary that behaves according to the name it is called by.
351 </para>
352 <indexterm zone="iptables xtables-multi">
353 <primary sortas="b-xtables-multi">xtables-multi</primary>
354 </indexterm>
355 </listitem>
356 </varlistentry>
357
358 </variablelist>
359
360 </sect2>
361
362</sect1>
Note: See TracBrowser for help on using the repository browser.