Installing geoip netfilter module under fedora 9

Just few tips, after you have patched current kernel sources and iptables, you want now compile geoip module (not whole kernel).

So in kernel sources dir, where is also Makefile, execute this commands:

make modules_prepare
make -C $(pwd) M=net/netfilter/ modules
cp net/netfilter/xt_geoip.ko /lib/modules/`uname -r`/extra/
depmod -a
modprobe xt_geoip

Simple linux firewall for dedicated company network

Hi, we will setup basic firewall for small dedicated company network. Situation: all services for LAN users (email, proxy, dns, ntp) are situated in main company network, to which we connect using OpenVPN. So router acts as OpenVPN client, enabling tunneled incoming connections to this LAN from main company network. Created for Slackware. Take all this as fun example.

Basic firewall for Linux workstation

This shell script is something like good starting point firewall for Linux workstation. Adjust it on your own. Execute it at start of system.

You need kernel 2.4 or 2.6 with netfilter and state matching enabled (default on all distros known to me). Allowed incoming ssh is for sysadmins a _must_. Also ping helps to diag problem. If you need more complex firewall, try to think about blocking also outgoing connection. Also for servers and routers this script is not sufficient.

cat /etc/rc.d/rc.firewall
#!/bin/sh
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# enable incoming ssh and echo requests (ping)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT