Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #226448 > unrolled thread

stretch vs iptables auto-start

Back to article view | Back to linux.debian.user

Contents

  stretch vs iptables auto-start Gene Heskett <gheskett@shentel.net> - 2020-08-23 20:30 +0200
    Re: stretch vs iptables auto-start Joe <joe@jretrading.com> - 2020-08-23 21:50 +0200
      Re: stretch vs iptables auto-start Gene Heskett <gheskett@shentel.net> - 2020-08-24 03:40 +0200
        Re: stretch vs iptables auto-start Joe <joe@jretrading.com> - 2020-08-24 10:30 +0200
        Re: stretch vs iptables auto-start Andrei POPESCU <andreimpopescu@gmail.com> - 2020-08-24 10:50 +0200
          Re: stretch vs iptables auto-start Gene Heskett <gheskett@shentel.net> - 2020-08-24 11:30 +0200
    Re: stretch vs iptables auto-start deloptes <deloptes@gmail.com> - 2020-08-23 22:20 +0200
      Re: stretch vs iptables auto-start Gene Heskett <gheskett@shentel.net> - 2020-08-24 03:50 +0200
        Re: stretch vs iptables auto-start deloptes <deloptes@gmail.com> - 2020-08-24 22:20 +0200
          Re: stretch vs iptables auto-start Andrew Cater <amacater@gmail.com> - 2020-08-24 23:10 +0200
            Re: stretch vs iptables auto-start Gene Heskett <gheskett@shentel.net> - 2020-08-25 01:10 +0200
    Re: stretch vs iptables auto-start Tixy <tixy@yxit.co.uk> - 2020-08-24 09:50 +0200
    Re: stretch vs iptables auto-start Greg Wooledge <wooledg@eeg.ccf.org> - 2020-08-24 14:30 +0200

#226448 — stretch vs iptables auto-start

Greetings all;

Since the big conversion of file structs vs who owns what, which 
apparently includes running rc.local as the logged in user and not as 
root, that has hidden the iptables stuff from everybody but root since 
its not now in the users $PATH.

So what is the best way to assure this stuff gets started during a reboot 
or restart of X? Stuff that s/b running regardless of any X restarts 
until the next full reboot?  Stretch, uptodate plus tde here.

Thanks.

Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
If we desire respect for the law, we must first make the law respectable.
 - Louis D. Brandeis
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [next] | [standalone]

#226451

On Sun, 23 Aug 2020 14:26:19 -0400
Gene Heskett <gheskett@shentel.net> wrote:

> Greetings all;
> 
> Since the big conversion of file structs vs who owns what, which 
> apparently includes running rc.local as the logged in user and not as 
> root, that has hidden the iptables stuff from everybody but root
> since its not now in the users $PATH.
> 
> So what is the best way to assure this stuff gets started during a
> reboot or restart of X? Stuff that s/b running regardless of any X
> restarts until the next full reboot?  Stretch, uptodate plus tde here.
> 
>

My server iptables is inherited from, I think, sarge, so it's probably
not done optimally today. It's an init script run from /etc/rcS.d. 

My netbook was stretch until a few weeks ago, is now buster, therefore
is somewhat broken. It has iptables-persistent installed, which I
believe is all that is needed now. 

Or you can muck about with systemd...

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#226458

On Sunday 23 August 2020 15:45:22 Joe wrote:

> On Sun, 23 Aug 2020 14:26:19 -0400
>
> Gene Heskett <gheskett@shentel.net> wrote:
> > Greetings all;
> >
> > Since the big conversion of file structs vs who owns what, which
> > apparently includes running rc.local as the logged in user and not
> > as root, that has hidden the iptables stuff from everybody but root
> > since its not now in the users $PATH.
> >
> > So what is the best way to assure this stuff gets started during a
> > reboot or restart of X? Stuff that s/b running regardless of any X
> > restarts until the next full reboot?  Stretch, uptodate plus tde
> > here.
>
> My server iptables is inherited from, I think, sarge, so it's probably
> not done optimally today. It's an init script run from /etc/rcS.d.

Ah,/etc/rcS.d/S18netfilter-persistent
but that does not mention iptables anyplace in it.  Whats the diff?

Or better yet, can this "netfilter" thingy import a set of rules saved 
from iptables?  Hey, I've got an idea, go RTFM.  Except there isn't one.

Next?

> My netbook was stretch until a few weeks ago, is now buster, therefore
> is somewhat broken. It has iptables-persistent installed, which I
> believe is all that is needed now.
>
> Or you can muck about with systemd...

Thanks.

Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
If we desire respect for the law, we must first make the law respectable.
 - Louis D. Brandeis
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#226463

On Sun, 23 Aug 2020 21:34:12 -0400
Gene Heskett <gheskett@shentel.net> wrote:

> On Sunday 23 August 2020 15:45:22 Joe wrote:
> 

> >
> > My server iptables is inherited from, I think, sarge, so it's
> > probably not done optimally today. It's an init script run from
> > /etc/rcS.d.  
> 
> Ah,/etc/rcS.d/S18netfilter-persistent
> but that does not mention iptables anyplace in it.  Whats the diff?
> 

Not quite. I have a pseudo-daemon script (lifted from Linux From
Scratch, before the auto-builds happened) that accepts a filename, so I
can have a couple of sets of rules, plus a status command to tell me
which is currently installed, and flush and stop commands to clear the
rules or to stop everything. 

My server only ever needs one set, but my netbook boots up into
suitable rules for public wifi, and I run a different set on a trusted
LAN. The netbook doesn't use my old daemon script, but uses
iptables-persistent and I just run other rulesets manually when needed.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#226465

[Multipart message — attachments visible in raw view] — view raw

On Du, 23 aug 20, 21:34:12, Gene Heskett wrote:
> On Sunday 23 August 2020 15:45:22 Joe wrote:
> >
> > My server iptables is inherited from, I think, sarge, so it's probably
> > not done optimally today. It's an init script run from /etc/rcS.d.
> 
> Ah,/etc/rcS.d/S18netfilter-persistent
> but that does not mention iptables anyplace in it.  Whats the diff?

Why should it mention iptables?

By the way, at least with systemd on buster the 'nftables' package is 
set to automatically load rules from /etc/nftables.conf, there is no 
need for any additional packages.
 
> Or better yet, can this "netfilter" thingy import a set of rules saved 
> from iptables?  Hey, I've got an idea, go RTFM.  Except there isn't one.

A quick web search found
https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables, 
which also mentions iptables-translate, according to 
https://packages.debian.org in the package 'iptables' (at least on 
buster).

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#226468

On Monday 24 August 2020 04:45:01 Andrei POPESCU wrote:

> On Du, 23 aug 20, 21:34:12, Gene Heskett wrote:
> > On Sunday 23 August 2020 15:45:22 Joe wrote:
> > > My server iptables is inherited from, I think, sarge, so it's
> > > probably not done optimally today. It's an init script run from
> > > /etc/rcS.d.
> >
> > Ah,/etc/rcS.d/S18netfilter-persistent
> > but that does not mention iptables anyplace in it.  Whats the diff?
>
> Why should it mention iptables?
>
> By the way, at least with systemd on buster the 'nftables' package is
> set to automatically load rules from /etc/nftables.conf, there is no
> need for any additional packages.
>
> > Or better yet, can this "netfilter" thingy import a set of rules
> > saved from iptables?  Hey, I've got an idea, go RTFM.  Except there
> > isn't one.
>
> A quick web search found
> https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables
>_to_nftables, which also mentions iptables-translate, according to
> https://packages.debian.org in the package 'iptables' (at least on
> buster).

Printed for both eyes open time of day, looks easy enough.  Thank you 
Andrei.
 
> Kind regards,
> Andrei


Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
If we desire respect for the law, we must first make the law respectable.
 - Louis D. Brandeis
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#226454

Hi Gene,

Gene Heskett wrote:

> Since the big conversion of file structs vs who owns what, which
> apparently includes running rc.local as the logged in user and not as
> root, that has hidden the iptables stuff from everybody but root since
> its not now in the users $PATH.
> 

I was running home brew iptables firewall until couple of months ago. It was
time to upgrade since iptables is getting replaced by net filter
(nftables). It was obvious that at some point an upgrade is inevitable.

After researching some options I picked up shorewall and I am very happy
with it.

My requirement was to be able to easily configure and maintain a firewall
with at least 3 (three) network cards Internet, Intranet and DMZ.
Accent put on easy to configure - and I must admit the shorewall thing is
amazing.

> So what is the best way to assure this stuff gets started during a reboot
> or restart of X? Stuff that s/b running regardless of any X restarts
> until the next full reboot?  Stretch, uptodate plus tde here.

I don't know if it suits your needs - you might be looking for a desktop
firewall, which I do not need and thus don't know ... but keep in mind that
at some point in the future nftables will be the king.

regards

[toc] | [prev] | [next] | [standalone]

#226459

On Sunday 23 August 2020 16:10:10 deloptes wrote:

> Hi Gene,
>
> Gene Heskett wrote:
> > Since the big conversion of file structs vs who owns what, which
> > apparently includes running rc.local as the logged in user and not
> > as root, that has hidden the iptables stuff from everybody but root
> > since its not now in the users $PATH.
>
> I was running home brew iptables firewall until couple of months ago.
> It was time to upgrade since iptables is getting replaced by net
> filter (nftables). It was obvious that at some point an upgrade is
> inevitable.
>
> After researching some options I picked up shorewall and I am very
> happy with it.
>
> My requirement was to be able to easily configure and maintain a
> firewall with at least 3 (three) network cards Internet, Intranet and
> DMZ. Accent put on easy to configure - and I must admit the shorewall
> thing is amazing.
>
> > So what is the best way to assure this stuff gets started during a
> > reboot or restart of X? Stuff that s/b running regardless of any X
> > restarts until the next full reboot?  Stretch, uptodate plus tde
> > here.
>
> I don't know if it suits your needs - you might be looking for a
> desktop firewall, which I do not need and thus don't know ... but keep
> in mind that at some point in the future nftables will be the king.
>
> regards

At the present time I have around 80 rules, all designed to deny the 
network spiders and bots that think they have to mirror my several 
giga-byte site, 2 or 3 times a day.  And that was eating up my bandwidth 
allocation on a slow net connection.

Is there a tut someplace to guide one in converting from iptables to this 
newer nftables? I'm assumeing its a similar utility.

Thanks.


Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
If we desire respect for the law, we must first make the law respectable.
 - Louis D. Brandeis
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#226478

Gene Heskett wrote:

> At the present time I have around 80 rules, all designed to deny the
> network spiders and bots that think they have to mirror my several
> giga-byte site, 2 or 3 times a day.  And that was eating up my bandwidth
> allocation on a slow net connection.
> 
> Is there a tut someplace to guide one in converting from iptables to this
> newer nftables? I'm assumeing its a similar utility.

Sure, but I have not looked into ... I only read there will be a couple of
years transition period and somehow a compatibility layer is or can be
used.

Perhaps someone more in this can gives us a detail or a hint to a good
tutorial

[toc] | [prev] | [next] | [standalone]

#226479

[Multipart message — attachments visible in raw view] — view raw

Start here perhaps? https://wiki.debian.org/nftables

It should be relatively straightforward to move backward and forwards.
Working as a systemd service means that it will start automatically if
you're using systemd.

[When in doubt, check the Debian wiki for a topic - if that's no good, have
a quick look at the Arch Linux wiki - as folk who build from source,
they're good at documenting how things work.

All best, as ever,

Andy C.

On Mon, Aug 24, 2020 at 8:15 PM deloptes <deloptes@gmail.com> wrote:

> Gene Heskett wrote:
>
> > At the present time I have around 80 rules, all designed to deny the
> > network spiders and bots that think they have to mirror my several
> > giga-byte site, 2 or 3 times a day.  And that was eating up my bandwidth
> > allocation on a slow net connection.
> >
> > Is there a tut someplace to guide one in converting from iptables to this
> > newer nftables? I'm assumeing its a similar utility.
>
> Sure, but I have not looked into ... I only read there will be a couple of
> years transition period and somehow a compatibility layer is or can be
> used.
>
> Perhaps someone more in this can gives us a detail or a hint to a good
> tutorial
>
>

[toc] | [prev] | [next] | [standalone]

#226480

On Monday 24 August 2020 17:03:13 Andrew Cater wrote:

> Start here perhaps? https://wiki.debian.org/nftables
>
> It should be relatively straightforward to move backward and forwards.
> Working as a systemd service means that it will start automatically if
> you're using systemd.
>
> [When in doubt, check the Debian wiki for a topic - if that's no good,
> have a quick look at the Arch Linux wiki - as folk who build from
> source, they're good at documenting how things work.
>
> All best, as ever,
>
> Andy C.

As always. good advice, thanks Andy.

> On Mon, Aug 24, 2020 at 8:15 PM deloptes <deloptes@gmail.com> wrote:
> > Gene Heskett wrote:
> > > At the present time I have around 80 rules, all designed to deny
> > > the network spiders and bots that think they have to mirror my
> > > several giga-byte site, 2 or 3 times a day.  And that was eating
> > > up my bandwidth allocation on a slow net connection.
> > >
> > > Is there a tut someplace to guide one in converting from iptables
> > > to this newer nftables? I'm assumeing its a similar utility.
> >
> > Sure, but I have not looked into ... I only read there will be a
> > couple of years transition period and somehow a compatibility layer
> > is or can be used.
> >
> > Perhaps someone more in this can gives us a detail or a hint to a
> > good tutorial


Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
If we desire respect for the law, we must first make the law respectable.
 - Louis D. Brandeis
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#226462

On Sun, 2020-08-23 at 14:26 -0400, Gene Heskett wrote:
> Greetings all;
> 
> Since the big conversion of file structs vs who owns what, which 
> apparently includes running rc.local as the logged in user and not
> as 
> root, that has hidden the iptables stuff from everybody but root
> since 
> its not now in the users $PATH.
> 
> So what is the best way to assure this stuff gets started during a
> reboot

On my Debian box acting as a router, currently running Buster but been
running for about 10 years of Debian upgrades, I start my firewall by
this line in /etc/network/interfaces

  pre-up /root/firewall.sh

Where firewall.sh is a shell script of iptables rules (that also stops
and restarts fail2ban amongst other housekeeping tasks).

I have that pre-up command in the section for my ADSL line, the full
list of commands is

  auto dsl-provider
  iface dsl-provider inet ppp
  pre-up /sbin/ifconfig eth0 up # line maintained by pppoeconf
  pre-up /root/firewall.sh
  provider dsl-provider

My thinking was that before bringing up my ADSL connection to the
internet I need to make sure that eth0 is up because that connects to
my modem, then install my firewall.

My server is using sysvinit not systemd.

-- 
Tixy

[toc] | [prev] | [next] | [standalone]

#226473

On Sun, Aug 23, 2020 at 02:26:19PM -0400, Gene Heskett wrote:
> Since the big conversion of file structs vs who owns what,

The what?  I can't even parse that.

> which 
> apparently includes running rc.local as the logged in user and not as 
> root,

Now that is pure nonsense.  You're just inventing incorrect explanations
for whatever behavior you're seeing that you don't understand.

If an /etc/rc.local file exists and has the execute bit turned on, it
is executed AS ROOT at BOOT TIME, before there is any "logged in user".

> that has hidden the iptables stuff from everybody but root since 
> its not now in the users $PATH.

Now I believe you're talking about the change to "su" in buster.

https://wiki.debian.org/NewInBuster#Changes

Of course, you might be talking about something else entirely, but
your message is so unclear that I can't tell what you mean.

If you mean "the iptables command is /sbin/iptables which is not in
my PATH by default as a user", well, like... duh?  Hasn't that always
been the case?  iptables is a system administration command, which
most end users will never need.  If you want to run it as an end user,
just make sure /sbin (and probably /usr/sbin) is in your PATH.  Not
that you can do much with it as an end user.  Or explicitly type
/sbin/iptables to run it.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web