NAME

alterator-net-iptables - script for simple iptables(8) rules management.

SYNOPSIS

alterator-net-iptables [-4 | -6] <action> [<options>]

or iptables_helper [-4 | -6] <action> [<options>]

DESCRIPTION

alterator-net-iptables - script for simple iptables(8) rules management. There are also a number of alterator modules comes with it:

net-iptables

base module for setting up masquerading and closing IP ports;

net-dnat

for setting up port forwarding;

net-tc

for restricting access from internal networks: binding ip with mac addresses, traffic control, firewall

net-iptables-manual

for manual editing of iptables rules

alterator-net-iptables has its own config file /etc/alterator/net-iptables.conf with a small number of settings. All system settings are done using this file. So it is not a good idea to use alterator-net-iptables if you want to configure iptables by hands or by other programs. All your settings will be lost after execution of alterator-net-iptables.

alterator-net-iptables uses etcnet(8) system to interact with iptables.

alterator-net-iptables deals with the following settings:

external_interfaces

To mark some network interfaces as external.

commit_mode

If commit_mode if off alterator-net-iptables do not commit settings to system

mode

To select gateway or router mode. In gateway mode masquerading is enabled for all packets going to external ifaces.

opened_services

To open some services on external ifaces. Each service is a set of specific ports as specified in /etc/alterator/net-iptables/*.desktop. In /etc/alterator/net-iptables/List services to be shown in interfaces are specified. Other services are hidden from the user, but you can also open them.

opened_tcp_ports, opened_udp_ports

To open some additional ports on external ifaces.

System settings done by alterator-net-iptables:

* ip forwarding is always on

* ip firewalling is always on

* add ip_conntrack_ftp to /etc/net/ifaces/default/fw/iptables/modules

* ACCEPT all INPUT packets from internal ifaces

* DROP all INPUT packets from external ifaces excepting
that for opened ports and services and packets with
--state ESTABLISHED,RELATED

* ACCEPT all FORWARD packets from internal ifaces

* DROP all FORWARD packets from external ifaces except
* packets with --state ESTABLISHED,RELATED
* packets for DNAT
* packets for this iface's network
* packets through bridges

* if mode is "gateway", address translation (masquerading) is applied
to output to each external iface

ACTIONS AND OPTIONS

-4

Use iptables (IPv4 packet filter). This is the default and cannot be combined with -6.

-6

Use ip6tables (IPv6 packet filter). It cannot be combined with -4.

alterator-net-iptables help Show help message

alterator-net-iptables show <options> Show current settings

-m

show mode (gateway|router)

-c

show commit mode (on|off)

-l

show log mode (on|off)

-e

show list of external interfaces (space separated)

-i

show list of internal interfaces

-s

show list of opened services on external ifaces

-t

show list of opened extra tcp ports on external ifaces

-u

show list of opened extra udp ports on external ifaces

-v

be verbose

alterator-net-iptables write <options> Change some settings and commit them to system

-m <mode>

Specify mode (gateway|router)

-c <mode>

Specify commit mode (on|off)

-l <mode>

Specify log mode (on|off)

-e <list>

Specify list of external interfaces

-s <list>

Specify list of opened services on external ifaces

-t <list>

Specify list of opened extra tcp ports on external ifaces

-u <list>

Specify list of opened extra udp ports on external ifaces

-d

Don't change system settings, only config file

-v

be verbose

Values in lists must be separated by semicolon.

You can add value to existing list using "+<value>" argument, remove it using "-<value>" or replace the whole list using "<value1>;<value2>;..."

alterator-net-iptables reset Reset settings to the default values

alterator-net-iptables list Show list of available services (using $LANGUAGE environment variable)

alterator-net-iptables ir <options> Module for restricting access from internal networks (see alterator-net-iptables ir help)

alterator-net-iptables pr <options> Port redirection module (see alterator-net-iptables ir help)

alterator-net-iptables dnat <options> DNAT module (see alterator-net-iptables ir help)

alterator-net-iptables ulog <options> ULOG module (see alterator-net-iptables ir help)

EXAMPLES

alterator-net-iptables show

show current settings

alterator-net-iptables show -i

show internal interfaces

alterator-net-iptables show -m

show mode

alterator-net-iptables list

list available services

alterator-net-iptables write -s +ssh

open ssh on external interfaces

alterator-net-iptables write -s -ftp

close ftp on external interfaces

alterator-net-iptables write -e "eth1;eth2"

set external interfaces

alterator-net-iptables write -m gateway

turn on masquerading

alterator-net-iptables write -t "20;21" -u "20;21"

open only specified ports

alterator-net-iptables write -t "+22" -u "+22"

open specified ports

alterator-net-iptables reset

Reset settings to default values. Turn off all modules

AUTHOR

Vladislav Zavjalov <slazav@altlinux.org>