[webmin-l] Linux Firewall Module

[Fred Grayson]

I am having a problem with this module on Red Hat 7.3, current, IPTables 1.2.8-8.72.3, with Webmin
1.106. Maybe someone can help? Here's the story.

I go to the "Easy Firewall Generator for IPTables" sit at http://morizot.net/firewall/gen/ and generate a
fairly straight forward script that just allows a few basic services. The configuration is:

Static Internet IP Address
Single System
Allow Inbound Services (TCP 22, 25, 110, 113,80, 443, 10000)

After the script is generated I drop it into the system as /etc/rc.d/init.d/iptables and stop and start
iptables. The firewall behaves as expected.

Next I go into Webmin's Linux Firewall Module and do the few things needed in Module Config to get it to
see the script. The module gives me a very impressive view of all the rules, but if I want to make
changes, I can't save them. The Apply Configuration, Revert Configuration, and Active at Boot buttons
are absent.

I have read the help that comes with the module, and it says "If you already have a firewall on your
system that has been setup manually or from a script file, the module will offer to convert it to an IPtables
save file for you, and create a script to be run at boot time to activate the rules in the file." But I never get
this offer. The module obviously reads and understands the /etc/rc.d/init.d/iptables file - it looks great!
What am I missing here?

Can someone whip up a quickie firewall at the above site and maybe see why the Webmin module isn't
doing what I think it's supposed to?

Thanks for your time.




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
-
Forwarded by the Webmin mailing list at webadmin-***@lists.sourceforge.net
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list

[David Brown]

Post by Fred Grayson
I am having a problem with this module on Red Hat 7.3, current, IPTables
1.2.8-8.72.3, with Webmin
1.106. Maybe someone can help? Here's the story.
I go to the "Easy Firewall Generator for IPTables" sit at http://morizot.net/firewall/gen/
and generate a
fairly straight forward script that just allows a few basic services. The
Static Internet IP Address
Single System
Allow Inbound Services (TCP 22, 25, 110, 113,80, 443, 10000)
After the script is generated I drop it into the system as /etc/rc.d/init.d/iptables
and stop and start
iptables. The firewall behaves as expected.
Next I go into Webmin's Linux Firewall Module and do the few things needed
in Module Config to get it to
see the script. The module gives me a very impressive view of all the rules,
but if I want to make
changes, I can't save them. The Apply Configuration, Revert Configuration,
and Active at Boot buttons
are absent.
I have read the help that comes with the module, and it says "If you already
have a firewall on your
system that has been setup manually or from a script file, the module will
offer to convert it to an IPtables
save file for you, and create a script to be run at boot time to activate
the rules in the file." But I never get
this offer. The module obviously reads and understands the /etc/rc.d/init.d/iptables
file - it looks great!
What am I missing here?
Can someone whip up a quickie firewall at the above site and maybe see
why the Webmin module isn't
doing what I think it's supposed to?
Thanks for your time.
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
-
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list

Hello Fred, this is not an answer to your question but an alternative in case the iptables firewall does not work for you. I have been using the Shorewall module on a public server running many services for about a year w/o any problems. Hope this helps, David.


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
-
Forwarded by the Webmin mailing list at webadmin-***@lists.sourceforge.net
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list

[Kris Deugau]

Post by Fred Grayson
I am having a problem with this module on Red Hat 7.3, current,
IPTables 1.2.8-8.72.3, with Webmin
1.106. Maybe someone can help? Here's the story.
I go to the "Easy Firewall Generator for IPTables" sit at
http://morizot.net/firewall/gen/ and generate a
fairly straight forward script that just allows a few basic services.

Um. This generates a standalone script much like the ipchains ones I
copied and mangled and recopied and updated for several years, until I
did a fresh RH7.3 install that didn't like ipchains. :/ RedHat's
"official" system works differently.

Generally, anything that tells you to replace a provided init script is
a BadThing (TM), because it *will* get broken if you upgrade the package
that the script is a part of. (For instance, there *have* been a few
updates to the RH iptables package for 7.3... and those updates would
have overwritten this generated script.)

Post by Fred Grayson
Static Internet IP Address
Single System
Allow Inbound Services (TCP 22, 25, 110, 113,80, 443, 10000)
After the script is generated I drop it into the system as
/etc/rc.d/init.d/iptables and stop and start
iptables. The firewall behaves as expected.

That's your problem.

On RH >= 7.1, /etc/[rc.d/]init.d/iptables is a generic script to apply a
set of firewall rules that are defined in /etc/sysconfig/iptables.
(ipchains is done the same way.)

Since Webmin recognizes RedHat, it "knows" where RedHat keeps its
firewall configuration and how it's formatted. The site you used to
generate a firewall doesn't generate a script in that format. :/

Post by Fred Grayson
Next I go into Webmin's Linux Firewall Module and do the few things
needed in Module Config to get it to see the script. The module gives
me a very impressive view of all the rules, but if I want to make
changes, I can't save them. The Apply Configuration, Revert
Configuration, and Active at Boot buttons are absent.

I don't know whether Webmin really recognizes a firewall script in
another format; at a guess it will simply strip out anything it doesn't
recognize- and that might be why you can't make changes through Webmin.

Personally, I found it very simple to just build a firewall directly
with Webmin's "Linux Firewall" module, and some of the updates to that
module since I used it to figure out how iptables works have made it
even easier. I've attached a version of the /etc/sysconfig/iptables
script on one of the systems I maintain, modified for your setup.

Post by Fred Grayson
The module obviously reads and understands the
/etc/rc.d/init.d/iptables file - it looks great!

Well, it understands the iptables lines in that file. <g> That script
also includes kernel TCP/IP tuning, and miscellaneous network options
that are not technically part of a set of iptables rules, along with a
*lot* of shell-script variable substitution. None of which would be
understood by the Linux Firewall module.

-kgd