Until this point in the course, we've read them all VIP table rules directly at the console and they
were loaded into RAM.
If we have a firewall with many, many rules, it's much easier to write all these rules in a script,
make that script executable and then run it.
But if we just want a simple rule that drops the traffic from a specific IP address or allows a specific
service to communicate with the outside world, we can simply right that rule at the Linux terminal.
Let's see some live examples, if I want to write an IP table rule at the Linux terminal, I simply
write the rule is what IP table is minus A input, minus B, ICMP minus J, drop Viksten.
The rule drops all incoming ICMP traffic to this Linux machine.
It's important to note that IP tables rule rules written at the terminal are not saved after the system
is restarted.
If you reboot the system, you will lose all the rules.
And you say, OK, OK, but do I have to write all the rules each time the computer starts?
Of course you don't.
If you want your IP table rules to persist after the system restarts, you write to them in a shell
script, make that script executable and configure the script to be run automatically.
It would time.
Let's go to work and see how we create a script with IP table rules and then around the script.
Remember that the script is just a text file that contains shall commence.
I'm going to create the script using my preferred text editor, which is very.
In your case, if you haven't used the VA before, try a simple Edita like Manau, Pekoe or even Notepad,
V.I. is a very good and efficient editor.
Batiks not the easiest one to use in Linux.
The name of the script will be Firehole, one that S.A.G., the first line of the script will look like
this.
Well, sign an exclamation mark and the path to bash.
This is called She Bank, and it tells the Shell what program to interpret the script with when executing
it.
In this example, the script is to be interpreted and run by the special.
If you write another script, let's say a Python script, you write here The Path to the Python interpreter.
The most common option is using Besch and inside the file, I'll simply write some IP table rules.
For example, I'll write a rule that drops all incoming SSX traffic so traffic to port to 22 and to
another HUGULEY that drop outgoing traffic to Port 80 and 443.
So HTP IMPAC stops traffic.
And the first rule table is minus 18, minus minus minus the part 22, minus G drop.
It drops incoming traffic to Port 20 to.
And tools that drop out going ETP and HTP traffic.
IP table is myna, say output X, outgoing traffic minus BTP minus minus, deport a D minus J drop.
And another rule for ETPs IP tables minus a output minus BTP minus minus deport four for three minus
jatra.
OK, here, output.
I'm saving the script, make it executable and then run it.
And we see the.
The role of water drops, incoming traffic and the rules that drop outgoing ETP and he keeps traffic.
One important thing to know is the vetting around the script using its name like Firehole, one that
they seek.
So without a doubt, which is the current working directory and the forum, I get an error comment not
found.
This happens because the current working directory doesn't belong to the Linux path, so the Shell doesn't
look for the script inside the current directory, it's looking for Cumming's only in these directories.
Here is where the shell is looking for Cemex, so you have either to add the current working directory
to Perth or run the script using DOT forward slash into the name of the script.
In fact, it says take the script from the current working directory, which is that and it.
Now, suppose we want to change something in our script, for example, I don't want to block outgoing
ETOPS traffic anymore.
The logical thing to do is to open the script, replace that line, save the script and run it again.
In this example, I've executed the script again.
If we to the final IP table minus Varnell, we see that there are more holes that we have expected.
There are only three rules in the script, but more rules in the realm memory.
In fact, each rule seems doubled.
To make this point clearer, I'll execute the script again.
Now, there are even more holes in the ram of memory, something is wrong, what could it be?
Each time I've executed the script, the rules from the script.
So with those three rules have been appended to the table changed.
I ran the script three times, so I have nine holes and this is not what we want.
As a result, when I ran the final script, I expect that only those rules from the script are loaded.
How do we do it?
A good practice is to add at the beginning of the script IP tables minus F.
This will flush all the change of the filter table and start with a new, fresh, friable.
I am opening the file and at the beginning I am adding IP table minus F.
This will flash all the chains.
I'm saving the file and running it again.
And we noticed that only the rules from the script have been loaded, all other rules have been flushed.
An important remark is that if you have rules also on other occasions and tables like, say, rules
for doing that, you should also flash those tables and change.
Let's see what is all about.
I'm adding a rule that will perform Ethernet, it will translate to the private IP addresses from network
10 data zero data zero two zero eight to the public IP of this Linux machine, in this case, outer
IP tables minus the net.
It's mandatory to specify the table minus a post routing minus s the IP addresses that will be translated.
It's an entire network.
Minus O, the outgoing interface,
minus J.
S Net and thesaurus, and I'll write a random IP address.
I suppose this is the public IP don't focus on the net will have an entire section on this, I'm saving
the script and then run it and I'll run it many times.
When I am listing the net filter, we see there are many egoless.
There are four rules, not one like in my script, it upended the rule to post routing change and to
not filter.
Each time I've executed the script.
This issue will be solved by also flushing down that table at the beginning of the Feigel escaped.
Here at the beginning, I write IAPT Bullis, minus Demet, minus F.
I'm saving the script and running it again.
I can arrange it as many times as I want.
There will be a single net rule.
The rule from the script IP table is minus DeMatte, minus V and L.
And there is only one rule.
OK, Rexall, thank you.