OpenVZ Forum: Support » iptables/firewall script for openvz

Home » General » Support » iptables/firewall script for openvz

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

iptables/firewall script for openvz [message #35001]

Thu, 19 February 2009 04:51

TheStig
Messages: 94
Registered: December 2008

Member

Hello community,

i have taken a small iptables script i've found years ago on a site called
http://harry.homelinux.org
and tweaked it over the years to fit my needs and adopted recently so it will secure an openvz HN with containers that have international ip-addresses.

i've written it in two parts, the init-script and an config file. it's quite specific to what type of ip filtering i need, but maybe someone out there could use it too?

as i couldn't do much testing yet there are for sure bugs and incompatibilities in there, but i thought maybe some of you would like to give it a try.

it should be relatively easy to adopt the script to your enviroment and maybe i will write a version where more options can be configured via the config file.

i will at least test and improve the script a bit and write a version that will work on containers as well (actually it should already, but there are table-rules that are not wanted inside a container).

if it's somewhat stable it maybe a thing for the iptables article in the openvz-wiki?!

looking forward to suggestions...
Joe

Attachment: firewall.conf
(Size: 1.44KB, Downloaded 480 times)
Attachment: firewall
(Size: 10.98KB, Downloaded 412 times)

[Updated on: Thu, 19 February 2009 04:56]

Report message to a moderator

Re: iptables/firewall script for openvz [message #35002 is a reply to message #35001]

Thu, 19 February 2009 05:05

TheStig
Messages: 94
Registered: December 2008

Member

quick overview on what it actually does:

* closes ports on all devices
* enables loopback and internet-to-venet communication
* open specific ports globally (like http)
* open specific ports to trusted ip's, hostnames or blocks (like imap, dns)
* option to define DMZ and BANNED IP's/blocks
* option to only open specific ports/protocols for individual ip's/blocks/hostnames

Report message to a moderator

Re: iptables/firewall script for openvz [message #35012 is a reply to message #35001]

Thu, 19 February 2009 18:33

TheStig
Messages: 94
Registered: December 2008

Member

as expected there were loads of bugs, it now just works just fine on my hardware nodes.

enjoy...

Attachment: firewall_v0.01
(Size: 11.20KB, Downloaded 425 times)

Report message to a moderator

Re: iptables/firewall script for openvz [message #39039 is a reply to message #35001]

Fri, 05 March 2010 11:08

TheStig
Messages: 94
Registered: December 2008

Member

slightly updated version, as I use it at the moment.

is there actually someone who cares for an OpenVZ-comaptible iptables-script?

Edit: Uploaded the wrong version - hopefully this one's the right one ,-)

Attachment: firewall.conf
(Size: 1.29KB, Downloaded 469 times)
Attachment: firewall
(Size: 11.78KB, Downloaded 448 times)

[Updated on: Fri, 05 March 2010 11:34]

Report message to a moderator

Re: iptables/firewall script for openvz [message #39043 is a reply to message #35001]

Sat, 06 March 2010 11:33

sunoano
Messages: 8
Registered: January 2010

Junior Member

1)
I've created one too http://github.com/sunoano/bash/blob/master/packet_filter

I also wrote some docu how to use it http://sunoano.name/ws/public_xhtml/firewall.html#sunos_rule _set_and_how_it_is_applied

2)
I also have another script called vzbulk http://github.com/sunoano/bash/blob/master/vzbulk This one has nothing to do with firewalling but might be useful; docu is inside the scipt at the top.

[Updated on: Sat, 06 March 2010 11:39]

Report message to a moderator

Previous Topic:	Ubuntu 9.04 wrong permissions on /dev/null after restart
Next Topic:	numfile fails even when limit and barrier are set to 9223372036854775807

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Fri Apr 26 07:58:37 GMT 2024

Total time taken to generate the page: 0.01670 seconds