Do you use an iptables script or just edit iptables?

[JD50]

Just curious to see what most people do. I've seen a few people use an iptables shell script but I've always just edited /etc/sysconfig/iptables. What do you guys do? I'm talking about in a production or lab environment with multiple servers, not your home desktop box.

 

[Nothinman]

The only reason I can see for using a custom script instead of using he infrastructure provided by the OS is that you downloaded the script from the Internet and don't actually know how it works.

And I'm pretty sure that iptables-save/iptables-restore are faster than calling the iptables command over and over again in a script so it makes sense from both performance and standardization viewpoints to use the system scripts and files.

 

[bobross419]

I'm glad I came across this post. I had first started modifying the iptables file directly, then found a few sites saying that this was real bad juju. I'd take the opinions of AT Linux gurus over random google sites any day of the week 😉

 

[JD50]

I'm glad I came across this post. I had first started modifying the iptables file directly, then found a few sites saying that this was real bad juju. I'd take the opinions of AT Linux gurus over random google sites any day of the week 😉

It's not bad juju. That's how I've always done it because that's the way I learned, and that was from a Red Hat class. Some people might not like directly editing the file because if you make a mistake and somehow lock yourself out (if you're connecting remotely) then you're screwed, because the iptables file obviously persists across reboot.

 

[Nothinman]

It's not bad juju. That's how I've always done it because that's the way I learned, and that was from a Red Hat class. Some people might not like directly editing the file because if you make a mistake and somehow lock yourself out (if you're connecting remotely) then you're screwed, because the iptables file obviously persists across reboot.

Yea, but the chances of doing that with a custom script are about the same because eventually you'll set that script to run on boot.

 

[lord_emperor]

If you use either method correctly then what is the difference?

 

[Nothinman]

If you use either method correctly then what is the difference?

The only way I could see there being a problem is if RedHat's GUI firewall tool doesn't deal with manual edits well. If such a tool exists, I haven't touched RHEL or CentOS in a while.