This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
iptables [2014/11/24 02:09] ben |
iptables [2014/11/24 02:15] ben |
||
---|---|---|---|
Line 3: | Line 3: | ||
===== Gateway Firewall Configuration ===== | ===== Gateway Firewall Configuration ===== | ||
The firewall configuration is held in subversion, at the url | The firewall configuration is held in subversion, at the url | ||
- | <tt>svn+ssh:// | + | '' |
- | To test rules while editing the rules file, the <tt>iptables-restore</ | + | To test rules while editing the rules file, the '' |
To add new holes for specific machines, scroll to the bottom of the file and copy an existing example. To add new machines is slightly more complex, but there are already examples for most scenarios in this file. | To add new holes for specific machines, scroll to the bottom of the file and copy an existing example. To add new machines is slightly more complex, but there are already examples for most scenarios in this file. | ||
To permanently affect the changes to the configuration, | To permanently affect the changes to the configuration, | ||
- | {{Command|< | + | {{Command|'' |
===== Host firewalls ===== | ===== Host firewalls ===== | ||
Line 23: | Line 23: | ||
Policy routing needs the following kernel options set: | Policy routing needs the following kernel options set: | ||
- | {{Kernel|2.6.28-gentoo-r1|< | + | {{Kernel|2.6.28-gentoo-r1|'' |
- | Create an alternate routing table by adding the following line to the end of <tt>rt_tables</tt>. | + | Create an alternate routing table by adding the following line to the end of '' |
- | {{File|/ | + | {{File|/ |
{{Note|The name " | {{Note|The name " | ||
The default gateway should be added to both routing tables, along with any other static routes if needed. | The default gateway should be added to both routing tables, along with any other static routes if needed. | ||
- | {{File|/ | + | {{File|/ |
- | Now we need to specify that certain connections will be sent according to the alternate routing table instead of the main one. These scripts are stored in subversion, under <tt>routing-rules</ | + | Now we need to specify that certain connections will be sent according to the alternate routing table instead of the main one. These scripts are stored in subversion, under '' |
- | {{File|/ | + | {{File|/ |
- | {{File|/ | + | {{File|/ |
The final bit of magic comes in the form of some iptables rules, which mark particular connections to use the alternate routing table: | The final bit of magic comes in the form of some iptables rules, which mark particular connections to use the alternate routing table: | ||
- | {{File|iptables-rules|< | + | {{File|iptables-rules|'' |
==== Traffic Shaping ==== | ==== Traffic Shaping ==== |