[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: OT: /etc/init.d/networking & firewall

Bernd Eckenfels wrote:
> On Tue, Aug 08, 2000 at 01:05:46PM +0200, Domenico Andreoli wrote:
> > i'm just wondering where to put my firewall rules in order to make them
> > run on boot. i was thinking to hack /etc/init.d/networking, it seems
> > the best place but i don't drink that nobody already had this question.
> Perhaps it would be the best to switch the ipchains to policy "default deny"
> at the start of networking and then set up the rules afterwards in your own
> script. fwctl is one of those options for setting up the rules.

This is a *bad* idea. It is better to simply add a rule at the
end of the chain: ipchains -A input -j DENY

It may look the same, but there is an important difference when
you run ipchains -F on a machine with no keyboard or screen...
Martijn van Oosterhout <kleptog@cupid.suninternet.com>

Reply to: