Hi guys,
sorry if i used SUSE and this is OpenSUSE forum, i’m typing fast, as shortcut ‘OS’ might be misleading - which shortcut you use? I’m one of admins of Scientific Linux forum and we use “SL”. 
Also, i want to stay on target, which is usage of iptables in SuSE (which i solved). So only very shortly for the shell usage:
We have different shell types, like ksh, cs, bash, sh etc and different Unixes uses diff. shells by default. I started on IBM AIX where default is ksh. So specifying the shell you want to run it in, you make sure which shell you use.
Also, if you want to do “./shell-script-name” you have to have a executable bit on, while “sh” will run it even without one. etc…
There is many ways how to do one thing in Linux, which is why we like it right?
Now for the iptables custom script usage on OpenSuse and replacement of SuSEfirewall2 firewall. I had to do ‘man man’ 
and read some, which i didn’t want to, as i’m time-pressed att (all the time) so what i got to:
-
SuSEfirewall2 has 2 phases:
phase 1:
/usr/lib/systemd/system/SuSEfirewall2_init.service
phase 2:
/usr/lib/systemd/system/SuSEfirewall2.service
phase one need to have a full access to loopback interface etc etc - which lead me to creating 2 iptables shell scripts where 1st shell script allow everything everywhere (policy ACCEPT) and 2nd shell script is the one executing the rules i need
-
based on those 2 units (services - see above) i create my own iptables units by copy and the by editing them:
first make copy of those existing:
cp /usr/lib/systemd/system/SuSEfirewall2_init.service /usr/lib/systemd/system/iptables_init.service
cp /usr/lib/systemd/system/SuSEfirewall2.service /usr/lib/systemd/system/iptables.service
-
put your own created 2 iptables shell scripts to /opt (or anywhere where you feel it right):
i named my 2 shell scripts as follow:
bwafd:/opt # ls -al
-rwx------ 1 lang users 2072 Jan 25 16:34 iptables_rules
-rwx------ 1 root root 335 Jan 26 13:37 iptables_rules_init
where content of 1st script that is run “iptables_rules_init” is general and allow all - that is the 1st phase of firewall initialization - just like suse firewall does (feel free to experiment) and 2nd script is the iptables shell script that ‘does the job done’ - see below:
cd /opt
cat iptables_rules_init
#!/bin/sh
# Interfaces and IP config (2 nic, one outside world, second lan):
# delete all existing rules.
#
iptables -t filter -F
iptables -t filter -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# DEFAULT POLICY:
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
2nd script:
cd /opt
cat iptables_rules
#!/bin/sh
# Interfaces and IP config (2 nic, one outside world, second lan):
# delete all existing rules.
#
iptables -t filter -F
iptables -t filter -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
# DEFAULT POLICY:
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# GENERAL RULES
# allow loopback interface:
#iptables -t nat -A PREROUTING -i lo -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#iptables -t nat -A POSTROUTING -o lo -j ACCEPT
# allow DNS
iptables -t filter -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
# allow ICMP http://www.iana.org/assignments/icmp-parameters
iptables -t filter -A INPUT -p icmp -s 0/0 --icmp-type 8 -j ACCEPT
iptables -t filter -A INPUT -p icmp -s 0/0 --icmp-type 11 -j ACCEPT
# allow response from outside to established connections that started inside:
iptables -t filter -A INPUT -p ALL -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t filter -A INPUT -p ALL -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
# allow all SSH connections to both interfaces:
iptables -t filter -A INPUT -p tcp -s 0/0 --dport 22 -m state --state NEW -j ACCEPT
# INPUT RULES
# allow Gordon rsync synchronization
iptables -t filter -A INPUT -p tcp -s 172.16.58.0/24 --dport 873 -m state --state NEW -j ACCEPT
# allow LAN
iptables -t filter -A INPUT -p ALL -s 192.168.111.0/24 -i eth0 -j ACCEPT
iptables -t filter -A INPUT -p ALL -s 192.168.122.0/24 -i eth1 -j ACCEPT
# FORWARD RULES
# z eth0 na eth1:
iptables -t filter -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
# z eth1 na eth0:
iptables -t filter -A FORWARD -i eth1 -o eth0 -j ACCEPT
#iptables -t filter -A FORWARD -i eth1 -d 192.168.1.0/24 -o virbr1 -j ACCEPT
# OUTPUT RULES
# internet interface:
iptables -t filter -A OUTPUT -p ALL -o eth0 -j ACCEPT
# lan interface:
iptables -t filter -A OUTPUT -p ALL -o eth1 -j ACCEPT
# POSTROUTING RULES:
#iptables -t nat -A POSTROUTING -o eth0 -s 192.168.111.0/24 -j SNAT --to 192.168.111.1
-
stop SuSEfirewall2 services:
list services:
systemctl list-units --type service
stop/disable:
systemctl stop SuSEfirewall2_init.service
systemctl disable SuSEfirewall2_init.service
systemctl stop SuSEfirewall2.service
systemctl disable SuSEfirewall2.service
by doing this, those services unit files are physically removed (deleted) from “/usr/lib/systemd/system” that is why we did copy of them first (in step 2)
-
edit your own iptables unit files (that you created in step 2 by copying the SuSEfirewall2 units):
cd /usr/lib/systemd/system
vi iptables.service
[Unit]
Description=iptables phase 2
After=network.target ypbind.service nfs.service nfsserver.service rpcbind.service SuSEfirewall2_init.service
Wants=iptables_init.service
[Service]
ExecStart=/opt/iptables_rules boot_setup
ExecStop=/opt/iptables_rules systemd_stop
RemainAfterExit=true
Type=oneshot
[Install]
WantedBy=multi-user.target
Alias=iptables_setup.service
Also=iptables_init.service
vi iptables_init.service
[Unit]
Description=iptables phase 1
Before=network.service
Before=basic.service
[Service]
ExecStart=/opt/iptables_rules_init boot_init
RemainAfterExit=true
Type=oneshot
[Install]
WantedBy=multi-user.target
Also=iptables.service
-
enable the services you created, so the operating system is aware of it:
systemctl enable iptables.service
ln -s '/usr/lib/systemd/system/iptables.service' '/etc/systemd/system/iptables_setup.service'
ln -s '/usr/lib/systemd/system/iptables.service' '/etc/systemd/system/multi-user.target.wants/iptables.service'
ln -s '/usr/lib/systemd/system/iptables_init.service' '/etc/systemd/system/multi-user.target.wants/iptables_init.service'
bwafd:/usr/lib/systemd/system # systemctl enable iptables_init.service
as you can see OS created the necessary links in order to start it properly
-
notes
All done - if you need to do any changes in your firewall, you just edit the iptables shell script in “/opt” meaning, no yast or GUI needed, just pure command line … the linux way!
Also, i dont say it is the best way, feel free to criticize and improve (i would appreciate it) i did it fast, so i hope i won’t offend any OpenSuse purist
Thanks for all suggestions and help
cheers
Karel
Thanks for helping out.