iptables脚本开机不能自动执行:-bash: /etc/sysconfig/iptables: Permission denied

luojm_24680

[root@sushe ~]# /etc/sysconfig/iptables

-bash: /etc/sysconfig/iptables: Permission denied

[root@sushe ~]# more /etc/rc.d/rc.local

#!/bin/sh

#

# This script will be executed *after* all the other init scripts.

# You can put your own initialization stuff in here if you don't

# want to do the full Sys V style init stuff.

touch /var/lock/subsys/local

ifconfig eth0 add 10.8.35.1 netmask 255.255.255.0

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -F

iptables -X

iptables -F -t nat

iptables -X -t nat

iptables -Z -t nat

#iptables -F -t mangle

#iptables -X -t mangle

#iptables -Z -t mangle

/etc/sysconfig/iptables

[root@sushe ~]#

[root@sushe ~]# more /etc/sysconfig/iptables

# Generated by iptables-save v1.3.8 on Tue Dec 11 10:01:27 2007

*nat

REROUTING ACCEPT [2047:254489]

OSTROUTING ACCEPT [2:127]

:OUTPUT ACCEPT [0:0]

-A POSTROUTING -o eth1 -j SNAT --to-source 61.50.*.*

COMMIT

# Completed on Tue Dec 11 10:01:27 2007

# Generated by iptables-save v1.3.8 on Tue Dec 11 10:01:27 2007

*filter

:INPUT ACCEPT [347:59060]

:FORWARD ACCEPT [79:4926]

:OUTPUT ACCEPT [62:10360]

-A INPUT -i lo -j ACCEPT

-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT

-A INPUT -p esp -j ACCEPT

-A INPUT -p ah -j ACCEPT

-A INPUT -p udp -m udp --dport 631 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 631 -j ACCEPT

-A INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

COMMIT

# Completed on Tue Dec 11 10:01:27 2007

[root@sushe ~]#

platinum

那不是 iptables 脚本，且没有执行权限，所以不能执行

luojm_24680

那是我了解的太肤浅了,那/etc/sysconfig/iptables文件可是用iptables-save保存得到的

又怎么保存成可以利用rc.local开机执行的脚本呢,

或者说怎么做才是最合理的呢

麻烦说说这两项,谢谢!

[ 本帖最后由 luojm_24680 于 2007-12-11 11:45 编辑 ]

platinum

如果你用的是 redhat 公司的发行版，那么当设置好适当的规则后
service iptables save 即可保存
chkconfig iptables on 可实现启动自动加载脚本
如有改动，直接修改 /etc/sysconfig/iptables 后 service iptables restart 即可生效

或者写个脚本程序，用 /etc/rc.local 调用

详情请见 /etc/init.d/iptables

luojm_24680

我使用了
service iptables save
chkconfig iptables on

结果是:service iptables save后,在/etc/sysconfig/iptables文件,内容如下:

[root@sushe ~]# more /etc/sysconfig/iptables
# Generated by iptables-save v1.3.8 on Tue Dec 11 12:33:51 2007
*filter
:INPUT ACCEPT [1924:209294]
:FORWARD ACCEPT [8:499]
:OUTPUT ACCEPT [1042:79046]
-A INPUT -i lo -j ACCEPT
COMMIT
# Completed on Tue Dec 11 12:33:51 2007
# Generated by iptables-save v1.3.8 on Tue Dec 11 12:33:51 2007
*nat
REROUTING ACCEPT [124:20532]
OSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth1 -j SNAT --to-source 61.50.139.251
COMMIT
# Completed on Tue Dec 11 12:33:51 2007
[root@sushe ~]# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

重新启动linux,再用iptables -L,或iptables -t nat -L
还是什么规则也没有,也就是没有自动执行,

我的是rhel5,

谢谢!

[ 本帖最后由 luojm_24680 于 2007-12-11 12:46 编辑 ]

platinum

若你在保存前本身没有规则，那么保存的内容当然就是空
若你的规则都是写在 nat 表或 mangle 表里的，iptables -L 当然看不到内容，这并非“没有自动执行”

luojm_24680

我把上个贴修改了下,请重新看上个贴,在里面我做了nat转换,客户端电脑可以上网

用了上面两个命令保存\加载\重启,但客户端不能上网

请再帮忙分析,谢谢!

platinum

vi /etc/sysctl.conf
把 net.ipv4.ip_forward 改成 1

luojm_24680

可是我已经把下面文件中的
/proc/sys/net/ipv4/ip_forward

改为1了,

与你说的 vi /etc/sysctl.conf
把 net.ipv4.ip_forward 改成 1
这个文件有什么不同,为什么我直接输入规则,有/proc/sys/net/ipv4/ip_forward就行(且一直都为1)


还有一个问题,想自动执行下面的几行命令,又怎么做?
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat

我已经修改了你说的这个文件了,但重启用iptables -t nat -L,还是没有nat规则

[root@sushe ~]# more /etc/sysconfig/iptables
# Generated by iptables-save v1.3.8 on Tue Dec 11 12:33:51 2007
*filter
:INPUT ACCEPT [1924:209294]
:FORWARD ACCEPT [8:499]
:OUTPUT ACCEPT [1042:79046]
-A INPUT -i lo -j ACCEPT
COMMIT
# Completed on Tue Dec 11 12:33:51 2007
# Generated by iptables-save v1.3.8 on Tue Dec 11 12:33:51 2007
*nat
REROUTING ACCEPT [124:20532]
OSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth1 -j SNAT --to-source 61.50.139.251
COMMIT
# Completed on Tue Dec 11 12:33:51 2007




[root@sushe ~]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

谢谢!

luojm_24680

对了,我在/etc/rc.d/rc.local中增加了内容,不知对上面是否有影响,导致我的不能正常启动,请帮忙分析,谢谢!

[root@sushe ~]# more /etc/rc.d/rc.local
#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.

touch /var/lock/subsys/local
ifconfig eth0 add 10.8.35.1 netmask 255.255.255.0

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -F
iptables -X
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
#iptables -F -t mangle
#iptables -X -t mangle
#iptables -Z -t mangle

/etc/sysconfig/iptables