Skip to content

Commit b64df05

Browse files
flexibeastflexibeast
committed
<various>: Split "Firewalls" section into distinct sections.
1 parent 969e08d commit b64df05

File tree

4 files changed

+99
-87
lines changed

4 files changed

+99
-87
lines changed

Diff for: ‎src/SUMMARY.md

+2
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@
3333
- [Power Management](./config/power-management.md)
3434
- [Network](./config/network/index.md)
3535
- [Firewalls](./config/network/firewalls.md)
36+
- [iptables](./config/network/iptables.md)
37+
- [nftables](./config/network/nftables.md)
3638
- [wpa_supplicant](./config/network/wpa_supplicant.md)
3739
- [IWD](./config/network/iwd.md)
3840
- [NetworkManager](./config/network/networkmanager.md)

Diff for: ‎src/config/network/firewalls.md

+6-87
Original file line numberDiff line numberDiff line change
@@ -1,92 +1,11 @@
11
# Firewalls
22

3-
## iptables
3+
By default, the `iptables` package is installed on the base system. However,
4+
iptables is now considered deprecated on Linux, with nftables as its
5+
replacement.
46

5-
By default, the `iptables` package is installed on the base system. It provides
6-
[iptables(8)/ip6tables(8)](https://man.voidlinux.org/iptables.8). The related
7-
services use the `/etc/iptables/iptables.rules` and
8-
`/etc/iptables/ip6tables.rules` ruleset files, which must be created by the
9-
system administrator.
7+
## Section Contents
108

11-
Two example rulesets are provided in the `/etc/iptables` directory:
12-
`empty.rules` and `simple_firewall.rules`.
9+
- [iptables](./iptables.md)
10+
- [nftables](./nftables.md)
1311

14-
### Applying the rules at boot
15-
16-
To apply iptables rules at runit stage 1, install the `runit-iptables` package.
17-
This adds a core-service which restores the `iptables.rules` and
18-
`ip6tables.rules` rulesets.
19-
20-
Alternatively, to apply these rules at stage 2, add the following to
21-
`/etc/rc.local`:
22-
23-
```
24-
if [ -e /etc/iptables/iptables.rules ]; then
25-
iptables-restore /etc/iptables/iptables.rules
26-
fi
27-
28-
if [ -e /etc/iptables/ip6tables.rules ]; then
29-
ip6tables-restore /etc/iptables/ip6tables.rules
30-
fi
31-
```
32-
33-
After rebooting, check the active firewall rules:
34-
35-
```
36-
# iptables -L
37-
# ip6tables -L
38-
```
39-
40-
### Applying the rules at runtime
41-
42-
`iptables` comes with two runit services, `iptables` and `ip6tables`, to quickly
43-
flush or restore the `iptables.rules` and `ip6tables.rules` rulesets. Once these
44-
services are [enabled](../services/index.md#enabling-services), you can flush
45-
the rulesets by downing the relevant service, e.g.:
46-
47-
```
48-
# sv down iptables
49-
```
50-
51-
and restore them by upping the relevant service, e.g.:
52-
53-
```
54-
# sv up ip6tables
55-
```
56-
57-
## nftables
58-
59-
`nftables` replaces `iptables`, `ip6tables`, `arptables` and `ebtables`
60-
(collectively referred to as `xtables`). The [nftables
61-
wiki](https://wiki.nftables.org/wiki-nftables/index.php/Main_Page) describes
62-
[the main
63-
differences](https://wiki.nftables.org/wiki-nftables/index.php/Main_differences_with_iptables)
64-
from the `iptables` toolset.
65-
66-
To use `nftables`, install the `nftables` package, which provides
67-
[nft(8)](https://man.voidlinux.org/nft.8). It also provides
68-
[iptables-translate(8)/ip6tables-translate(8)](https://man.voidlinux.org/iptables-translate.8)
69-
and
70-
[iptables-restore-translate(8)/ip6tables-restore-translate(8)](https://man.voidlinux.org/iptables-restore-translate.8),
71-
which convert `iptables` rules to `nftables` rules.
72-
73-
### Applying the rules at boot
74-
75-
To apply nftables rules at runit stage 1, install the `runit-nftables` package.
76-
This adds a core-service which restores the ruleset in `/etc/nftables.conf`.
77-
78-
### Applying the rules at runtime
79-
80-
The `nftables` package provides the `nftables` service, which uses rules from
81-
`/etc/nftables.conf`. Once you [enable](../services/index.md#enabling-service)
82-
the `nftables` service, to load the rules, run:
83-
84-
```
85-
# sv up nftables
86-
```
87-
88-
To flush the rules, run:
89-
90-
```
91-
# sv down nftables
92-
```

Diff for: ‎src/config/network/iptables.md

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# iptables
2+
3+
By default, the `iptables` package is installed on the base system. It provides
4+
[iptables(8)/ip6tables(8)](https://man.voidlinux.org/iptables.8). The related
5+
services use the `/etc/iptables/iptables.rules` and
6+
`/etc/iptables/ip6tables.rules` ruleset files, which must be created by the
7+
system administrator.
8+
9+
Two example rulesets are provided in the `/etc/iptables` directory:
10+
`empty.rules` and `simple_firewall.rules`.
11+
12+
## Applying the rules at boot
13+
14+
To apply iptables rules at runit stage 1, install the `runit-iptables` package.
15+
This adds a core-service which restores the `iptables.rules` and
16+
`ip6tables.rules` rulesets.
17+
18+
Alternatively, to apply these rules at stage 2, add the following to
19+
`/etc/rc.local`:
20+
21+
```
22+
if [ -e /etc/iptables/iptables.rules ]; then
23+
iptables-restore /etc/iptables/iptables.rules
24+
fi
25+
26+
if [ -e /etc/iptables/ip6tables.rules ]; then
27+
ip6tables-restore /etc/iptables/ip6tables.rules
28+
fi
29+
```
30+
31+
After rebooting, check the active firewall rules:
32+
33+
```
34+
# iptables -L
35+
# ip6tables -L
36+
```
37+
38+
## Applying the rules at runtime
39+
40+
`iptables` comes with two runit services, `iptables` and `ip6tables`, to quickly
41+
flush or restore the `iptables.rules` and `ip6tables.rules` rulesets. Once these
42+
services are [enabled](../services/index.md#enabling-services), you can flush
43+
the rulesets by downing the relevant service, e.g.:
44+
45+
```
46+
# sv down iptables
47+
```
48+
49+
and restore them by upping the relevant service, e.g.:
50+
51+
```
52+
# sv up ip6tables
53+
```

Diff for: ‎src/config/network/nftables.md

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# nftables
2+
3+
`nftables` replaces `iptables`, `ip6tables`, `arptables` and `ebtables`
4+
(collectively referred to as `xtables`). The [nftables
5+
wiki](https://wiki.nftables.org/wiki-nftables/index.php/Main_Page) describes
6+
[the main
7+
differences](https://wiki.nftables.org/wiki-nftables/index.php/Main_differences_with_iptables)
8+
from the `iptables` toolset.
9+
10+
To use `nftables`, install the `nftables` package, which provides
11+
[nft(8)](https://man.voidlinux.org/nft.8). It also provides
12+
[iptables-translate(8)/ip6tables-translate(8)](https://man.voidlinux.org/iptables-translate.8)
13+
and
14+
[iptables-restore-translate(8)/ip6tables-restore-translate(8)](https://man.voidlinux.org/iptables-restore-translate.8),
15+
which convert `iptables` rules to `nftables` rules.
16+
17+
## Applying the rules at boot
18+
19+
To apply nftables rules at runit stage 1, install the `runit-nftables` package.
20+
This adds a core-service which restores the ruleset in `/etc/nftables.conf`.
21+
22+
## Applying the rules at runtime
23+
24+
The `nftables` package provides the `nftables` service, which uses rules from
25+
`/etc/nftables.conf`. [Enabling](../services/index.md#enabling-services) the
26+
service will load the rules.
27+
28+
To flush the rules, run:
29+
30+
```
31+
# sv down nftables
32+
```
33+
34+
To re-load the rules, run:
35+
36+
```
37+
# sv up nftables
38+
```

0 commit comments

Comments
 (0)