0

I’m doing some rules in a machine with the firewall disabled, but when I run rcSuSEfirewall2 a lot of rules and policies are applyed by default:

iptables -L

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            state RELATED
input_ext  all  --  anywhere             anywhere
input_ext  all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere            limit: avg 3/min bu                                                                                        rst 5 LOG level warning tcp-options ip-options prefix `SFW2-IN-ILL-TARGET '
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            limit: avg 3/min bu                                                                                        rst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWD-ILL-ROUTING '

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain forward_ext (0 references)
target     prot opt source               destination

Chain input_ext (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere            PKTTYPE = broadcast                                                                                        
ACCEPT     icmp --  anywhere             anywhere            icmp source-quench
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
LOG        all  --  anywhere             anywhere            limit: avg 3/min bu                                                                                        rst 5 PKTTYPE = multicast LOG level warning tcp-options ip-options prefix `SFW2-                                                                                        INext-DROP-DEFLT '
DROP       all  --  anywhere             anywhere            PKTTYPE = multicast                                                                                        
DROP       all  --  anywhere             anywhere            PKTTYPE = broadcast                                                                                        
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min bu                                                                                        rst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options pre                                                                                        fix `SFW2-INext-DROP-DEFLT '
LOG        icmp --  anywhere             anywhere            limit: avg 3/min bu                                                                                        rst 5 LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT '
LOG        udp  --  anywhere             anywhere            limit: avg 3/min bu                                                                                        rst 5 state NEW LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP                                                                                        -DEFLT '
DROP       all  --  anywhere             anywhere

Chain reject_func (0 references)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-res                                                                                        et
REJECT     udp  --  anywhere             anywhere            reject-with icmp-po                                                                                        rt-unreachable
REJECT     all  --  anywhere             anywhere            reject-with icmp-pr                                                                                        oto-unreachable

Resuming my question: How can I set my Suse firewall to when I start it show all policies in the ACCEPT chain? like this:

iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
(my custom DROP Rule)

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

PS: I know sounds no sense but it is because I’m adding extra rules in /etc/sysconfig/scripts/SuSEfirewall2-custom

I'm using SuSE Linux Enterprise Server 11 Service Pack 3

UPDATE:

I've rechecked if Yast Firewall haves an option to set policies to ACCEPT but nothing.

5
  • try yast firewall or yast2 firewall (GUI) and select disable and save and exit.
    – cybernard
    Sep 5, 2015 at 5:45
  • Ty for the reply, if I disable firewall my custom rules are auto disabled too Sep 5, 2015 at 5:49
  • Did Enterprise SP3 get systemd?
    – cybernard
    Sep 5, 2015 at 17:23
  • Nope, systemd is on sles 12 Sep 5, 2015 at 22:28
  • I believe you can remove some of the rules under yast firewall instead of using the disable option.
    – cybernard
    Sep 6, 2015 at 16:38

1 Answer 1

0

Well, i want to share this workarround, i think is not so elegant as i wanted but it works.

First create a file and call it as you want i.e fwsrv

#!/bin/bash
# Author: Francisco Tapia
#
# /etc/init.d/fwsrv
#
### BEGIN INIT INFO
# Provides:          fwsrv
# Required-Start:    network
# Should-Start:      $null
# Required-Stop:     $null
# Should-Stop:       $null
# Default-Start:     5
# Default-Stop:      5
# Short-Description: Executes iptables rules.
# Description:       this is not a service.
### END INIT INFO

. /etc/rc.status

rc_reset

case "$1" in
   start)
     # use colour for ease of spotting
      echo -e "\E[36mRunning $0 (start)...\E[0m";
      /etc/init.d/fwsrv.d/start
      echo -e "\E[36mDone $0 \E[0m";
   ;;
   stop)

      echo -e "\E[36mRunning $0 (stop)...\E[0m";
      /etc/init.d/fwsrv.d/stop
      echo -e "\E[36mDone $0 \E[0m";
   ;;
   restart)
      $0 stop
      $0 start
      rc_status
      ;;
   *)
      echo "Usage $0 (start|stop|restart)"
      exit 1; 
      ;;
esac 

rc_exit

Then create 2 files one called start and other stop with this content in script.

#!/bin/bash

# run scripts with names starting 0-9 in foreground. if you want to
# put a script in start.d and you care about when it gets run in relation
# to other scripts, give it a name starting 0-9
for i in $(dirname $0)/start.d/[0-9]*;do
   test -x $i && echo -e "\E[36mRunning ${i} \E[0m" && $i
done

# run scripts with names starting a-z in the background 
# as this reduces the over all time this script takes to run.
for i in $(dirname $0)/start.d/[a-z]*;do
   test -x $i && echo -e "\E[36mRunning ${i} \E[0m" && $i &
done

# wait for children to exit
wait;

and finally the last one called rules and it will have all my desired rules:

#!/bin/bash
rcSuSEfirewall2 start
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F
#My Desired Rules

Then execute the following commands in terminal.

cp fwsrv /etc/init.d/fwsrv
chmod u+x /etc/init.d/fwsrv
mkdir -p /etc/init.d/fwsrv.d/start.d
mkdir -p /etc/init.d/fwsrv.d/stop.d
cp start /etc/init.d/fwsrv.d/start
cp stop /etc/init.d/fwsrv.d/stop
chmod u+x /etc/init.d/fwsrv.d/start
chmod u+x /etc/init.d/fwsrv.d/stop
cp rules /etc/init.d/fwsrv.d/start.d/rules
chmod u+x /etc/init.d/fwsrv.d/start.d/rules
insserv /etc/init.d/fwsrv

Now the Machine will start the Firewall when starts and cleaning all rules and applying all custom rules. if you want to add more rules just edit rules file in /etc/init.d/fwsrv.d/start.d/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .