Some important (security) information:

1) Always first start the firewall before you enable your (ADSL) internet connection (if possible). For an ppp-interface that doesn't exist yet you can use the wildcard device called "ppp+" (but this only works if there aren't any other ppp interfaces!).

2) Don't change any (security) settings ('EXPERT SETTINGS') if you don't really understand what they mean. Changing them anyway could have a big impact on the security of your machine.

3) I get a lot of emails from people complaining that their webserver etc. stopped working after installing my firewall. This is the CORRECT behaviour for a firewall: BLOCKING ALL incoming traffic by default. If you want for example want to run an HTTP-server(port 80) and/or an SSH-server(port 22) accessible from the internet you should configure the OPEN_TCP / OPEN_UDP variables accordingly. For HTTP AND SSH it should become: OPEN_TCP="22 80" OPEN_UDP="22 80"

Quick setup

If you want to have it run quickly or are a novice user than this is the part that's important. Remember that my firewall has a lot of other useful features which will NOT be used in this way. On the other hand, various security features are enabled by default to protect you from hostile attacks.

1) First we've to check whether your Linux setup is OK in order to make the script work correctly:

- It of course requires iptables to be installed. It's recommended to get the latest version (package), if possible. This prevents any incompatibilities or bugs my script might have with older versions and the latest version contains all known (security) fixes, which strengthens the firewall itself.

- Make sure that you have a kernel with iptables compiled into it or a module-based kernel with the iptables modules installed. This is NOT possible when ipchains is still installed. If ipchains is installed (default for RedHat 7.1) you need to do "rmmod ipchains" first before running this script.

  • It requires /bin/sh (installed by default)

  • My scripts needs the following binaries in your path: ifconfig, modprobe, grep, uname, sed, date, cut.

  • The traffic shaper (rc.traffic-shaper) requires the "tc" command (from the iproute2 package).

  • If you want to enable resolving of IPs ($RESOLV_IPS) then the command 'dig' should also be available.

2) Now we need to determine whether you have a single- or dual-homed machine. Single means you ONLY have one network-interface, which is the one connected to the outside "evil" world (internet). Dual-homed also have a local subnet connected to an additional network interface.

3) Put rc.iptables & iptables-firewall.conf in the appropriate directories (see above). You probably also want to automatically start the firewall-script at system boot. There are various ways to accomplish this (depending on your distribution), here are some examples:

  • RedHat: Drop a line like "/etc/rc.d/rc.iptables start" in the file "/etc/rc.d/rc.local" (probably at or near the end). The script is also compatible with chkconfig runlevels (Redhat) Note that the script has a chkconfig-compatible header, so if you're familar with it you can use this to stop/start the script in the different runlevels. In this case don't start it from "/etc/rc.d/rc.local" but instead put the script itself in /etc/init.d/ (instead of /etc/rc.d/) and eg. run "chkconfig rc.iptables on".

  • Debian: Put rc.iptables in "/etc/init.d/" and create a softlink to it in "/etc/rcS.d/" (eg. "ln -s /etc/init.d/rc.iptables /etc/rcS.d/S99iptables")

Now we will change the required settings in "(/etc/)iptables-firewall.conf":

4) Configure your external network interfaces, EXT_IF. This is the interface which is the one connected to the internet. When you have an (dynamically) IP assigned to you (by your ISP) via DHCP, you should set "EXT_IF_DHCP_IP=1" else leave it off (0).

5) For dual-homed machines you should also configure INT_IF, the interface used for the local network. You should set your local subnet range in "INTERNAL_NET=". If you want your internal network to be able to access the internet (aka. internet-sharing), you should also enable NAT (Masquerading) by setting "NAT=1").

6) If you don't have an (A)DSL modem (which works with a PPtP connection to your machine) or you have a bridging (transparent) modem, you can continue with step 7 (You can verify this with 'ifconfig', if a ppp device with your public IP exists you should (most likely) configure the (A)DSL MODEM settings).

Now we must configure the network interface(ethX) to which your modem is physically(!) connected (=MODEM_IF, which is commented(#) out by default), and this is NOT ppp+, ppp0 etc.!

Here are some examples on how to do it for some providers (it's assumed that the modem is connected to eth0):

PPPoE connection with a static public IP (ie. MxStream in the Netherlands)
(setup with the ADSL4Linux package from
- MODEM_IF="eth0"
- MODEM_IP="" # Make sure this IP corresponds to the one used by your modem!

T-DSL (Germany) with a dynamic public IP:
- MODEM_IF="eth0"

PPPoA connection with a dynamic public IP (eg. Versatel Zonnet in the Netherlands):
- MODEM_IF="eth0"
- MODEM_IF_IP="" # This MUST be unset("") (default)
- MODEM_IP="" # Make sure this IP corresponds to the one used by your modem!

Note: For extra security you *can* set the IP of your modem (MODEM_IP), but it's not neccessary (anymore). If you don't know its IP or believe it doesn't have an IP, you can leave MODEM_IP="" (default). The same applies for the IP of the modem network interface (MODEM_IF_IP). In case of a PPPoA (PPP-over-ATM) you MUST leave MODEM_IF_IP unset(="")!

7) When your public IP is assigned to you by your ISP (through DHCP) then you should enable support for an DHCP-assigned external IP by setting "EXT_IF_DHCP_IP=1".

8) You're now ready to start the firewall by issueing "/etc/rc.d/rc.iptables start" or /etc/init.d/rc.iptables start (or whatever place you put rc.iptables in). Everything should now work OK, if it doesn't, carefully review all steps and your configuration. For troubleshouting you can consult my webpage (FAQ).

NOTE: Additional (more advanced) options are (also) explained in the configuration-file comments or in the QA's on my webpage (eg. Freeswan/VPN support).

Parameters for rc.iptables:
start = Start firewall (AND reset iptables counters)
stop = Stop firewall (set default policies to accept)
restart = Restart firewall (DOES NOT reset iptables counters)
breread = Reread blocked hosts (blackhole) file
status [-t {table}] [chain] = View firewall ruleset ([chain] & [-t {table}] are optional)"