Ignore:
Timestamp:
08/13/2012 03:17:23 PM (12 years ago)
Author:
Krejzi <krejzi@…>
Branches:
10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, 7.10, 7.4, 7.5, 7.6, 7.6-blfs, 7.6-systemd, 7.7, 7.8, 7.9, 8.0, 8.1, 8.2, 8.3, 8.4, 9.0, 9.1, basic, bdubbs/svn, elogind, gnome, kde5-13430, kde5-14269, kde5-14686, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, krejzi/svn, lazarus, lxqt, nosym, perl-modules, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, systemd-11177, systemd-13485, trunk, upgradedb, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal
Children:
fa29663
Parents:
a8f9c437
Message:

GnuTLS 3.0.22, ISO Codes 3.38, Iptables 1.4.15, LVM2 2.02.97, Mpg123 1.14.4 and NSPR 4.9.2.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@10506 af4574ff-66df-0310-9fd7-8a98e5e911e0

File:
1 edited

Legend:

Unmodified
Added
Removed

  • postlfs/security/iptables.xml

    ra8f9c437 r4591404  
    77  <!ENTITY iptables-download-http "http://www.netfilter.org/projects/iptables/files/iptables-&iptables-version;.tar.bz2">
    88  <!ENTITY iptables-download-ftp  "ftp://ftp.netfilter.org/pub/iptables/iptables-&iptables-version;.tar.bz2">
    9   <!ENTITY iptables-md5sum        "5ab24ad683f76689cfe7e0c73f44855d">
    10   <!ENTITY iptables-size          "500 KB">
    11   <!ENTITY iptables-buildsize     "17 MB">
     9  <!ENTITY iptables-md5sum        "8bf564ea8348522fc1db727868828def">
     10  <!ENTITY iptables-size          "504 KB">
     11  <!ENTITY iptables-buildsize     "15 MB">
    1212  <!ENTITY iptables-time          "0.2 SBU">
    1313]>
    1414
    15 <sect1 id="iptables" xreflabel="iptables-&iptables-version;">
     15<sect1 id="iptables" xreflabel="Iptables-&iptables-version;">
    1616  <?dbhtml filename="iptables.html"?>
    1717
    … …  
    3030    <title>Introduction to Iptables</title>
    3131
    32   <para>The next part of this chapter deals with firewalls.  The principal
    33   firewall tool for Linux is <application>iptables</application>.  You will
    34   need to install <application>iptables</application> if you intend on using
    35   any form of a firewall.</para>
    36 
    37   &lfs71_checked;
     32    <para>
     33      The next part of this chapter deals with firewalls.  The principal
     34      firewall tool for Linux is <application>Iptables</application>. You will
     35      need to install <application>Iptables</application> if you intend on using
     36      any form of a firewall.
     37    </para>
     38
     39    &lfs71_checked;
    3840
    3941    <bridgehead renderas="sect3">Package Information</bridgehead>
    4042    <itemizedlist spacing="compact">
    4143      <listitem>
    42         <para>Download (HTTP): <ulink url="&iptables-download-http;"/></para>
    43       </listitem>
    44       <listitem>
    45         <para>Download (FTP): <ulink url="&iptables-download-ftp;"/></para>
    46       </listitem>
    47       <listitem>
    48         <para>Download MD5 sum: &iptables-md5sum;</para>
    49       </listitem>
    50       <listitem>
    51         <para>Download size: &iptables-size;</para>
    52       </listitem>
    53       <listitem>
    54         <para>Estimated disk space required: &iptables-buildsize;</para>
    55       </listitem>
    56       <listitem>
    57         <para>Estimated build time: &iptables-time;</para>
     44        <para>
     45          Download (HTTP): <ulink url="&iptables-download-http;"/>
     46        </para>
     47      </listitem>
     48      <listitem>
     49        <para>
     50          Download (FTP): <ulink url="&iptables-download-ftp;"/>
     51        </para>
     52      </listitem>
     53      <listitem>
     54        <para>
     55          Download MD5 sum: &iptables-md5sum;
     56        </para>
     57      </listitem>
     58      <listitem>
     59        <para>
     60          Download size: &iptables-size;
     61        </para>
     62      </listitem>
     63      <listitem>
     64        <para>
     65          Estimated disk space required: &iptables-buildsize;
     66        </para>
     67      </listitem>
     68      <listitem>
     69        <para>
     70          Estimated build time: &iptables-time;
     71        </para>
    5872      </listitem>
    5973    </itemizedlist>
    6074
    6175    <para condition="html" role="usernotes">User Notes:
    62     <ulink url="&blfs-wiki;/iptables"/></para>
    63 
    64   </sect2>
    65 
    66   <sect2 role="kernel" id='iptables-kernel'>
     76      <ulink url="&blfs-wiki;/iptables"/>
     77    </para>
     78  </sect2>
     79
     80  <sect2 role="kernel" id="iptables-kernel">
    6781    <title>Kernel Configuration</title>
    6882
    69     <para>A firewall in Linux is accomplished through a portion of the
    70     kernel called netfilter. The interface to netfilter is
    71     <application>iptables</application>. To use it, the appropriate
    72     kernel configuration parameters are found in Networking Support &rArr;
    73     Networking Options &rArr; Network Packet Filtering Framework.</para>
     83    <para>
     84      A firewall in Linux is accomplished through a portion of the
     85      kernel called netfilter. The interface to netfilter is
     86      <application>Iptables</application>. To use it, the appropriate
     87      kernel configuration parameters are found in Networking Support &rArr;
     88      Networking Options &rArr; Network Packet Filtering Framework.
     89    </para>
    7490
    7591    <indexterm zone="iptables iptables-kernel">
    … …  
    8399
    84100    <note>
    85       <para>The installation below does not include building some specialized
    86       extension libraries which require the raw headers in the
    87       <application>Linux</application> source code. If you wish to build the
    88       additional extensions (if you aren't sure, then you probably don't), you
    89       can look at the <filename>INSTALL</filename> file to see an example of
    90       how to change the <parameter>KERNEL_DIR=</parameter> parameter to point
    91       at the <application>Linux</application> source code. Note that if you
    92       upgrade the kernel version, you may also need to recompile
    93       <application>iptables</application> and that the BLFS team has not tested
    94       using the raw kernel headers.</para>
    95 
    96       <para>For some non-x86 architectures, the raw kernel headers may be
    97       required. In that case, modify the <parameter>KERNEL_DIR=</parameter>
    98       parameter to point at the <application>Linux</application> source
    99       code.</para>
     101      <para>
     102        The installation below does not include building some specialized
     103        extension libraries which require the raw headers in the
     104        <application>Linux</application> source code. If you wish to build the
     105        additional extensions (if you aren't sure, then you probably don't), you
     106        can look at the <filename>INSTALL</filename> file to see an example of
     107        how to change the <parameter>KERNEL_DIR=</parameter> parameter to point
     108        at the <application>Linux</application> source code. Note that if you
     109        upgrade the kernel version, you may also need to recompile
     110        <application>Iptables</application> and that the BLFS team has not tested
     111        using the raw kernel headers.
     112      </para>
     113
     114      <para>
     115        For some non-x86 architectures, the raw kernel headers may be
     116        required. In that case, modify the <parameter>KERNEL_DIR=</parameter>
     117        parameter to point at the <application>Linux</application> source
     118        code.
     119      </para>
    100120    </note>
    101121
    102     <para>Install <application>iptables</application> by running the following
    103     commands:</para>
    104 
    105 <screen><userinput>./configure --prefix=/usr     \
    106             --exec-prefix=    \
    107             --bindir=/sbin    \
    108             --with-xtlibdir=/lib/xtables \
    109             --with-pkgconfigdir=/usr/lib/pkgconfig &amp;&amp;
     122    <para>
     123      Install <application>Iptables</application> by running the following
     124      commands:
     125    </para>
     126
     127<screen><userinput>./configure --prefix=/usr                          \
     128            --exec-prefix=                         \
     129            --bindir=/sbin                         \
     130            --with-xtlibdir=/lib/xtables           \
     131            --with-pkgconfigdir=/usr/lib/pkgconfig \
     132            --enable-libipq                        \
     133            --enable-devel &amp;&amp;
    110134make</userinput></screen>
    111135
    … …  
    122146    <title>Command Explanations</title>
    123147
    124     <para><parameter>--exec-prefix=</parameter>: Ensure all binaries and
    125     libraries end up in <filename class="directory">/</filename> directory
    126     tree.</para>
    127 
    128     <para><parameter>--bindir=/sbin</parameter>: Ensure all the executables go
    129     in <filename class="directory">/sbin</filename>.</para>
    130 
    131     <para><parameter>--with-xtlibdir=/lib/xtables</parameter>: Ensure all
    132     iptables modules are installed in the
    133     <filename class="directory">/lib/xtables</filename> directory.</para>
    134 
    135     <para><parameter>--with-pkgconfigdir=/usr/lib/pkgconfig</parameter>:
    136     Ensure all the pkgconfig files are in the standard location.</para>
    137 
    138     <para><command>ln -sfv xtables-multi /sbin/iptables-xml</command>: Ensure
    139     the symbolic link for <command>iptables-xml</command> is relative.</para>
     148    <para>
     149      <parameter>--exec-prefix=</parameter>: Ensure all binaries and
     150      libraries end up in <filename class="directory">/</filename>
     151      directory tree.
     152    </para>
     153
     154    <para>
     155      <parameter>--bindir=/sbin</parameter>: Ensure all the executables go
     156      in <filename class="directory">/sbin</filename>.
     157    </para>
     158
     159    <para>
     160      <parameter>--with-xtlibdir=/lib/xtables</parameter>: Ensure all
     161      Iptables modules are installed in the
     162      <filename class="directory">/lib/xtables</filename> directory.
     163    </para>
     164
     165    <para>
     166      <parameter>--with-pkgconfigdir=/usr/lib/pkgconfig</parameter>:
     167      Ensure all the pkgconfig files are in the standard location.
     168    </para>
     169
     170    <para>
     171      <option>--enable-libipq</option>: This switch enables building
     172      of <filename class="libraryfile">libipq.so</filename> which
     173      can be used by some packages outside of BLFS.
     174    </para>
     175
     176    <para>
     177      <option>--enable-devel</option>: This switch enables installation
     178      of <application>Iptables</application> development headers that
     179      can be used by some packages outside of BLFS.
     180    </para>
     181
     182    <para>
     183      <command>ln -sfv xtables-multi /sbin/iptables-xml</command>: Ensure
     184      the symbolic link for <command>iptables-xml</command> is relative.
     185    </para>
    140186
    141187  </sect2>
    … …  
    144190    <title>Configuring Iptables</title>
    145191
    146     <para>Introductory instructions for configuring your firewall are
    147     presented in the next section: <xref linkend="fw-firewall"/></para>
     192    <para>
     193      Introductory instructions for configuring your firewall are
     194      presented in the next section: <xref linkend="fw-firewall"/>
     195    </para>
    148196
    149197    <sect3  id="iptables-init">
    150198      <title>Boot Script</title>
    151199
    152       <para>To set up the iptables firewall at boot, install the
    153       <filename>/etc/rc.d/init.d/iptables</filename> init script included
    154       in the <xref linkend="bootscripts"/> package.</para>
     200      <para>
     201        To set up the iptables firewall at boot, install the
     202        <filename>/etc/rc.d/init.d/iptables</filename> init script included
     203        in the <xref linkend="bootscripts"/> package.
     204      </para>
    155205
    156206      <indexterm zone="iptables iptables-init">
    … …  
    173223
    174224      <seglistitem>
    175         <seg>iptables, iptables-restore, iptables-save, iptables-xml,
    176         ip6tables, ip6tables-restore, ip6tables-save,
    177         and xtables-multi</seg>
    178         <seg>libip4tc.so, libip6tc.so, libiptc.so, libxtables.so,
    179         and numerous modules in /lib/xtables</seg>
    180         <seg>/lib/xtables, /usr/include/libiptc and /usr/share/xtables</seg>
     225        <seg>
     226          ip6tables, ip6tables-restore, ip6tables-save, iptables, iptables-restore,
     227          iptables-save, iptables-xml and xtables-multi
     228        </seg>
     229        <seg>
     230          libip4tc.so, libip6tc.so, libipq.so, libiptc.so and libxtables.so
     231        </seg>
     232        <seg>
     233          /lib/xtables and /usr/include/libiptc
     234        </seg>
    181235      </seglistitem>
    182236    </segmentedlist>
    … …  
    190244        <term><command>iptables</command></term>
    191245        <listitem>
    192           <para>is used to set up, maintain, and inspect the tables of
    193           IP packet filter rules in the Linux kernel.  It is a
    194           symbolic link to xtables-multi.</para>
     246          <para>
     247            is used to set up, maintain, and inspect the tables of
     248            IP packet filter rules in the Linux kernel.
     249          </para>
    195250          <indexterm zone="iptables iptables-prog">
    196251            <primary sortas="b-iptables">iptables</primary>
    … …  
    202257        <term><command>iptables-restore</command></term>
    203258        <listitem>
    204           <para>is used to restore IP Tables from data
    205           specified on STDIN. Use I/O redirection provided by your
    206           shell to read from a file. It is a symbolic link to
    207           xtables-multi.</para>
     259          <para>
     260            is used to restore IP Tables from data specified on
     261            STDIN. Use I/O redirection provided by your
     262            shell to read from a file.
     263          </para>
    208264          <indexterm zone="iptables iptables-restore">
    209265            <primary sortas="b-iptables-restore">iptables-restore</primary>
    … …  
    215271        <term><command>iptables-save</command></term>
    216272        <listitem>
    217           <para>is used to dump the contents of an IP Table
    218           in easily parseable format to STDOUT. Use I/O-redirection
    219           provided by your shell to write to a file. It is a symbolic link to
    220           xtables-multi.</para>
     273          <para>
     274            is used to dump the contents of an IP Table in easily
     275            parseable format to STDOUT. Use I/O-redirection
     276            provided by your shell to write to a file.
     277          </para>
    221278          <indexterm zone="iptables iptables-save">
    222279            <primary sortas="b-iptables-save">iptables-save</primary>
    … …  
    228285        <term><command>iptables-xml</command></term>
    229286        <listitem>
    230           <para>is used to convert the output of
    231           <command>iptables-save</command> to an XML format. Using the
    232           <filename>iptables.xslt</filename> stylesheet converts the XML
    233           back to the format of <command>iptables-restore</command>.
    234           It is a symbolic link to xtables-multi.</para>
     287          <para>
     288            is used to convert the output of
     289            <command>iptables-save</command> to an XML format. Using the
     290            <filename>iptables.xslt</filename> stylesheet converts the XML
     291            back to the format of <command>iptables-restore</command>.
     292          </para>
    235293          <indexterm zone="iptables iptables-xml">
    236294            <primary sortas="b-iptables-xml">iptables-xml</primary>
    … …  
    242300        <term><command>ip6tables*</command></term>
    243301        <listitem>
    244           <para>are a set of commands for IPV6 that parallel the iptables
    245           commands above.  All of these commands are symbolic
    246           links to xtables-multi.</para>
     302          <para>
     303            are a set of commands for IPV6 that parallel the iptables
     304            commands above.
     305          </para>
    247306          <indexterm zone="iptables ip6tables">
    248307            <primary sortas="b-ip6tables">ip6tables</primary>
Note: See TracChangeset for help on using the changeset viewer.