Skip to main content

IPTABLES and M4

I manage high traffic web servers that are constantly under attack. To manage the security of these web servers, I need to routinely update my iptables rules, and by routinely, I mean every morning when I roll into the office.

When I searched for a solution that allowed me to dynamically define my rules with a merge option, nothing come to the forefront. There are some miscellaneous posts about using PERL and cat, but nothing really useful.

Then I remember M4. If you don't know about M4, then you should man it.

Here's what you do.

iptables.m4:


---- start ----

# Firewall configuration written by
# system-config-securitylevel
# Manual customization of this file is not
# recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
include(/root/iptables/iptables_special)
include(/root/iptables/iptables_reject)
include(/root/iptables/iptables_accept)
#
# The final rule that rejects everything
# that does not match
# the other explicit rules
#
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

----- end -----



This is the driver for the m4 process. When you want to create the iptables file, you just run:

m4 iptables.m4 > iptables

Here is a nifty script that does it all:


---- start ----

rm -f iptables
cp -f /etc/sysconfig/iptables iptables_back_`date +%Y%m%d`
m4 iptables.m4 > iptables
cp -f iptables /etc/sysconfig/
/etc/rc.d/init.d/iptables restart

---- end ----



This script will create a backup file for you so you don't clobber your current config with a bad m4 parse.

Just save that script into something like "update.x" and chmod +x on it. Then you can update components of your iptables rule file much more easily.

Quick and easy solution. No perl junk, no expensive security management software, nothing but runtime macro substitution with M4.

Popular posts from this blog

Stock Option Debt Income

The 2024 Presidential election has brought out a topic of interest that seems to have been perverted. There is this "Taxing Unrealized Capital Gains" [1] movement that is being falsely attributed to Vice President Harris. Clearly, this is a change in the revenue code that was designed by someone in office long before VP Harris was in office. My money is on Elizabeth Warren and Bernie Sanders. What is this change in the revenue code though? For that you have to understand what Silicon Valley zillionaires are doing with their stock options. Many of these people in this special economic area have huge discounts on stock prices for companies that are not public yet, or are public and can not be sold [2]. To be fair to these holders of equity, banks allow them to finance debt using leverage against those options. If you hold an option that is worth $5M then a bank might lend you a share of that value, thus realizing a debt against the option [3]. This is a fair debt instrument and...
Read more

A Self Defeating Race False Narrative

2020 is the year of the pandemic. The SARS-Cov-2 (Covid19) virus has rampaged across the planet infecting 4,893,136 [1] people by May 20, 2020. At this time, of those 4.8M people, 323,256 people have perished from complications that arise from the infection. Arising out of this pandemic has been a narrative about non-white ethnic groups being disproportionately affected by the infection [6,7,8]. A narrative that conditions people to believe that they are perpetually victims only creates a "collective victimhood" [4,5] in that group. This "collective victimhood" costs its members millions in unrealized potential, sends them cowering from social interactions that would otherwise benefit them, and ultimately creates an environment that perpetuates itself. Let's try to dispel that false narrative and deal just with data. I pulled my data from the CDC [9] looking at mortality only. The mortality data from CDC contains per-state mortality rates on a per-infectio...
Read more

Number of Primes

Anderson's Theorem (a) The number of primes in [1,n] is no more than 2+floor(n/2). The probability of n being prime when n is not prime is 1/2 - see Dasgupta,Papadimitriou,Vazirani "Algorithms" page 26. Therefore, the E(pi(n)) is n/2. (b) There does not exist another set of adjacent primes other than {1,2,3} 5: 2 + floor(5/2) = 2 + 2 = 4:=> {1,2,3,5} : 4 <= 4 7: 2 + floor(7/2) = 2 + 3 = 5 => {1,2,3,5,7} : 5 <= 5 11: 2 + floor(11/2) = 2 + 5 = 7 => {1,2,3,5,7,11} 6 <= 7 26: 2 + floor(26/2) = 15 => {1,2,3,5,7,11,13,17,19,23} : 10 <= 15 Lagrange's Theorem is Inaccurate Lagrange's theorem about primes states that pi(x) is the number of primes <= x. The pi(x) is approximately x/ln(x). He postulated that the lim of pi(x)/(x/lnx) as x-> infinity was 1. This is incorrect. if the number of primes is bounded by n/2 then refactoring and reducing Lagrange's Theorem results in the lim of ln(x) as x approaches infinity. This is alwa...
Read more