[CentOS] CentOS 6.3 as Firewall/Router

On 01/04/2013 04:11 PM, Dale Dellutri wrote:
> On Fri, Jan 4, 2013 at 3:04 PM, Tim Evans <tkevans at tkevans.com> wrote:
>> On 01/04/2013 03:03 PM, Dale Dellutri wrote:
>>> On Fri, Jan 4, 2013 at 11:01 AM, Tim Evans <tkevans at tkevans.com> wrote:
>>>> I'm replacing an ancient Solaris 'ipf' firewall/router with a brand new
>>>> CentOS 6.3 system.  In the olden days, I successfully used the attached
>>>> iptables script (as /etc/rc.local) on Red Hat 5.x systems, but this doesn't
>>>> seem to be quite working on the new system.
>>>>
>>>> Specifically, while it seems to be routing ok, you cannot connect to
>>>> anything on the inside net (e.g., with ssh or a browser) and cannot connect
>>>> to the system with ssh or anything else from elsewhere on the inside net.
>>>> Yet arp shows this system active.
>>>>
>>>> Is there obsolete stuff here, and/or anything missing that would cause this?
>>>
>>> You found the error, but I have a question about running this in rc.local.
>>>
>>> Aren't you opening a very short time security hole by running this from
>>> rc.local?  Service network starts up early in the startup sequence
>>> (/etc/rc.d/rc3.d/S10network), and rc.local is at the very end.
>>>
>>> Wouldn't it be better to run the iptables rules once, then do:
>>>     service iptables save
>>> This way, iptables rules would be in place (S08iptables) before
>>> netowrk startup.
>>>
>>
>> Thanks, Dale.  I'm trying to remember why I did it this way (nearly 10
>> years ago, when I did this first.)  Seems it had to do with not turning
>> on routing until the very end (instead of enabling it in
>> /etc/sysctl.conf), relying on the out-of-the-box iptables rules in the
>> interim (iptables still starts normally). This script overlays its
>> rules, then turns on NAT and routing.
>
> Do the out-of-the-box iptables rules allow all entry to the system?
>
> What's in /etc/sysconfig/iptables ?
>
> I understand that the script does more than simply set iptables rules.
> However, you could set the rules you want, then just turn on
> NAT and routing in rc.local.
>
> I'm not trying to criticize, just curious.
>
Thanks, again, Dale.  I'm curious, too, now, and will try to find any 
documentation I did back in '05 when I did this.

-- 
Tim Evans			|   5 Chestnut Court
UNIX System Admin Consulting	|   Owings Mills, MD 21117
http://www.tkevans.com/		|   443-394-3864
http://www.come-here.com/News/	|   tkevans at tkevans.com