2 - Raspberry PI Community Projects

The previous section lists available actions, but not their respective options. The LOG action,
for instance, has the following options:
• --log-priority, with default value warning, indicates the syslog message priority;
• --log-prefix allows specifying a text prefix to differentiate between logged messages;
• --log-tcp-sequence, --log-tcp-options and --log-ip-options indicate extra data to be integrated
into the message: respectively, the TCP sequence number, TCP options, and IP
options.
The DNAT action (only available for IPv4) provides the --to-destination address:port option
to indicate the new destination IP address and/or port. Similarly, SNAT provides --to-source
address:port to indicate the new source IP address and/or port.
The REDIRECT action (only available for IPv4) provides the --to-ports port(s) option to indicate
the port, or port range, where the packets should be redirected.
14.2.3. Creating Rules
Each rule creation requires one invocation of iptables/ip6tables. Typing these commands
manually can be tedious, so the calls are usually stored in a script so that the same configuration
is set up automatically every time the machine boots. This script can be written by hand, but it
can also be interesting to prepare it with a high-level tool such as fwbuilder.
The principle is simple. In the first step, one needs to describe all the elements that will be
involved in the actual rules:
• the firewall itself, with its network interfaces;
• the networks, with their corresponding IP ranges;
• the servers;
• the ports belonging to the services hosted on the servers.
The rules are then created with simple drag-and-drop actions on the objects. A few contextual
menus can change the condition (negating it, for instance). Then the action needs to be chosen
and configured.
As far as IPv6 is concerned, one can either create two distinct rulesets for IPv4 and IPv6, or
create only one and let fwbuilder translate the rules according to the addresses assigned to
the objects.
380 The Debian Administrator's Handbook