source: postlfs/security/iptables.xml@ dd362e5

10.0 10.1 11.0 6.0 6.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 ken/refactor-virt krejzi/svn lazarus nosym perl-modules qt5new systemd-11177 systemd-13485 trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since dd362e5 was dd362e5, checked in by Randy McMurchy <randy@…>, 17 years ago

Fixed instructions in the first 110 pages of the PDF version so that line lengths don't exceed the viewable area

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@3272 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 6.0 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
3 "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY iptables-download-http "http://www.iptables.org/files/iptables-&iptables-version;.tar.bz2">
8 <!ENTITY iptables-download-ftp "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
9 <!ENTITY iptables-size "157 KB">
10 <!ENTITY iptables-buildsize "4.4 MB">
11 <!ENTITY iptables-time "0.13 SBU">
12]>
13
14<sect1 id="iptables" xreflabel="iptables-&iptables-version;">
15<sect1info>
16<othername>$LastChangedBy$</othername>
17<date>$Date$</date>
18</sect1info>
19<?dbhtml filename="iptables.html"?>
20<title>iptables-&iptables-version;</title>
21
22<para>The next part of this chapter deals with firewalls. The principle
23firewall tool for Linux, as of the 2.4 kernel series, is
24<application>iptables</application>. It replaces
25<application>ipchains</application> from the 2.2 series and
26<application>ipfwadm</application> from the 2.0 series. You will need to
27install <application>iptables</application> if you intend on using any form of
28a firewall.</para>
29
30<sect2>
31<title>Introduction to <application>iptables</application></title>
32
33<para>To use a firewall, as well as installing
34<application>iptables</application>, you will need
35to configure the relevant options into your kernel. This is discussed
36in the next part of this chapter &ndash;
37<xref linkend="fw-kernel"/>.</para>
38
39<para>If you intend to use <acronym>IP</acronym>v6 you might consider extending
40the kernel by running <command>make patch-o-matic</command> in the top-level
41source tree directory of <application>iptables</application>. If you are
42going to do this, on a freshly untarred kernel, you need to run
43<command>yes "" | make config &amp;&amp; make dep</command> first because
44otherwise the patch-o-matic command is likely to fail while setting up
45some dependencies.</para>
46
47<para>If you are going to patch the kernel, you need to do it before you
48compile <application>iptables</application>, because during the compilation,
49the kernel source tree is checked (if it is available at <filename
50class="directory">/usr/src/linux-<replaceable>[version]</replaceable>
51</filename>) to see which features are available. Support will only be compiled
52into <application>iptables</application> for the features recognized at
53compile-time. Applying a kernel patch may result in errors, often because the
54hooks for the patches have changed or because the <command>runme</command>
55script doesn't recognize that a patch has already been incorporated.</para>
56
57<para>Note that for most people, patching the kernel is unnecessary.
58With the later 2.4.x kernels, most functionality is already available
59and those who need to patch it are generally those who need a specific
60feature; if you don't know why you need to patch the kernel, you're
61unlikely to need to!</para>
62
63<sect3><title>Package information</title>
64<itemizedlist spacing='compact'>
65<listitem><para>Download (HTTP): <ulink
66url="&iptables-download-http;"/></para></listitem>
67<listitem><para>Download (FTP): <ulink
68url="&iptables-download-ftp;"/></para></listitem>
69<listitem><para>Download size: &iptables-size;</para></listitem>
70<listitem><para>Estimated disk space required:
71&iptables-buildsize;</para></listitem>
72<listitem><para>Estimated build time:
73&iptables-time;</para></listitem></itemizedlist>
74</sect3>
75
76<!-- <sect3><title>Additional downloads</title>
77<itemizedlist spacing='compact'>
78<listitem><para>Required Patch (fixes a build issue with
79<application>linux</application>-2.6.7): <ulink
80url="&patch-root;/iptables-&iptables-version;-build_fix-1.patch"/></para>
81</listitem>
82</itemizedlist></sect3> -->
83
84</sect2>
85
86<sect2>
87<title>Installation of <application>iptables</application></title>
88
89<para>Install <application>iptables</application> by running the following
90commands:</para>
91
92<screen><userinput><command>make PREFIX=/usr LIBDIR=/lib BINDIR=/sbin &amp;&amp;
93make PREFIX=/usr LIBDIR=/lib BINDIR=/sbin install</command></userinput></screen>
94
95</sect2>
96
97<sect2>
98<title>Command explanations</title>
99
100<para><parameter>PREFIX=/usr LIBDIR=/lib BINDIR=/sbin</parameter>: Compiles
101and installs <application>iptables</application> libraries into
102<filename class="directory">/lib</filename>, binaries into
103<filename class="directory">/sbin</filename> and the remainder into the
104<filename class="directory">/usr</filename> hierarchy instead of
105<filename class="directory">/usr/local</filename>. Firewalls are
106generally activated during the boot process and
107<filename class="directory">/usr</filename> may not be mounted at that
108time.</para>
109
110</sect2>
111
112<sect2>
113<title>Contents</title>
114
115<para>The <application>iptables</application> package contains
116<command>iptables</command>, <command>iptables-restore</command>,
117<command>iptables-save</command>, <command>ip6tables</command>
118and the <filename class='libraryfile'>libip*.so</filename> library
119modules.</para>
120
121</sect2>
122
123<sect2><title>Description</title>
124
125<sect3><title>iptables</title>
126<para><command>iptables</command> is used to set up, maintain, and inspect the
127tables of <acronym>IP</acronym> packet filter rules in the Linux kernel.</para>
128</sect3>
129
130<sect3><title>iptables-restore, iptables-save</title>
131<para>These are used to save and to restore your elaborated set of chains and
132rules. Until <application>iptables</application>-1.2.5, they were declared
133experimental.</para>
134</sect3>
135
136<sect3 id="ip6tables" xreflabel="ip6tables"><title>ip6tables</title>
137<para>This is the same as <command>iptables</command> but for use with
138<acronym>IP</acronym>v6. As of v1.2.5, it is not as complete as the standard
139<acronym>IP</acronym>v4 version, especially with regard to some of the
140modules.</para>
141</sect3>
142
143<sect3><title>libip*.so library modules</title>
144<para>These are various modules (implemented as dynamic libraries) which
145extend the core functionality of <command>iptables</command>.</para>
146</sect3>
147
148</sect2>
149
150</sect1>
Note: See TracBrowser for help on using the repository browser.