uruk - wrapper for Linux iptables, for managing firewall rules

uruk

uruk loads an rc file (see uruk-rc(5)) which defines network service access policy, and invokes iptables(8) to set up firewall rules implementing this policy. By default the file /etc/uruk/rc is used; one can overrule this by specifying another file in the URUK_CONFIG environment variable. Under some circumstances, it's useful to use another command for iptables; this can be achieved by setting the URUK_IPTABLES (and/or URUK_IP6TABLES) environment variables. See uruk-rc(5) for details.

Uruk will not "just work" out of the box. It needs manual configuration. For those of you who don't like reading lots of documentation:

 # cp /usr/share/doc/uruk/examples/rc /etc/uruk/rc
 # vi /etc/uruk/rc
 # /etc/init.d/uruk start

Once the uruk script is installed, you want to go use it, of course. We'll give a detailed description of what to do here.

First, create an rc file. See uruk-rc(5) for info on how to do this. Once this file is created and installed (this script looks in /etc/uruk/rc by default), you're ready to run uruk. You might want to test your rc file by running uruk in debug mode, see uruk-rc(5).

Vanilla iptables

After editing rc, load your rules like this. First flush your current rules:

 # iptables -F

Then enable your rc rules

 # uruk

. Inspect the rules by doing:

 # iptables -L

. If you want to make these changes survive a reboot, use the init script as shipped with this package. If you'd rather write your own init script, the iptables-restore(8) and iptables-save(8) commands from the iptables package might be helpful.

Using the Uruk init script

Assumed is the Uruk init script is installed as explained in the README file. Optionally, install /etc/default/uruk (or /etc/sysconfig/uruk) and tweak it. An example file is in /usr/share/doc/uruk/examples/default (You might like to enable support for IPv6 rules, or for uruk-save.) Now activate uruk by doing:

 # /etc/init.d/uruk start

Now your pre-uruk iptables rules (if any) are saved as the "inactive" ruleset. While executing /etc/init.d/uruk start, your box is open during a short while. If you don't like this, read about uruk-save.

When rebooting, everything will be fine: /etc/init.d/uruk stores state in /var/lib/uruk/iptables, using iptables-save(8), which comes with Linux iptables.

Using ifupdown

In case you have just one network interface which should get protected, you could use interfaces(5) from the ifupdown package instead of the init script:

 # mkdir -p /var/lib/uruk/iptables

# iptables -F

# iptables-save -c > /var/lib/uruk/iptables/down # uruk # iptables-save -c > /var/lib/uruk/iptables/up

Add

 pre-up iptables-restore < /var/lib/uruk/iptables/up
 post-down iptables-restore < /var/lib/uruk/iptables/down

to your interfaces stanza, in your /etc/network/interfaces .

However, beware! Uruk will fiddle with the global iptables rules. Some default uruk rules affect all network interfaces.

Need to change your rules?

Using the Uruk init script

Do

 # vi /etc/uruk/rc
 # /etc/init.d/uruk force-reload

While executing /etc/init.d/uruk force-reload, your box is open during a short while. If you don't like this, read about uruk-save.

By default, uruk-save is not used by the uruk init script. You might want to use it, though. The uruk-save script is faster and when using uruk-save, your box won't be open while loading new rules. But beware: uruk-save is not as robust as using uruk itself. However, if you don't use any hooks in your rc file, you're save.

The init script will use uruk-save only if asked to do so in /etc/default/uruk (or /etc/sysconfig/uruk). If this file features

enable_uruk_save=true enable_uruk_save_warning=false

uruk-save is used whenever appropriate. The enable_uruk_save_warning variable controls whether a warning should get displayed whenever uruk-save is called. See uruk-save(8) for more details.

By default, uruk drops packets which have unknown private network addresses in their source or destination.

By default, uruk drops all ICMP packets with type other than

address-mask-reply address-mask-request destination-unreachable (this is a catch-all for a lot of types) echo-request echo-reply parameter-problem (catch-all for ip-header-bad and required-option-missing) timestamp-reply timestamp-request ttl-zero-during-transit ttl-zero-during-reassembly

By default, the FORWARD chain is left untouched, so has policy ACCEPT. (This won't do much harm, since packet forwarding is disabled by default in the Linux kernel. However, if you don't mind being paranoid, you might want to add a

 iptables --policy FORWARD REJECT

to your $rc_a uruk hook. See uruk-rc(5).)

By default, uruk logs all UDP and TCP packets which are blocked by the user defined policies. Loglevel is debug, logprefix is "iptables:". See also the notes on loglevel in uruk-rc(5).

Blocked TCP packets are answered with a tcp-reset.

In order to keep the uruk script small and simple, the script does very little error handling. It does not check the contents of the rc file in any way before executing it. When your rc file contains bogus stuff, uruk will very likely behave in unexpected ways. Caveat emptor.

uruk honors environment variables URUK_IPTABLES (/sbin/iptables by default) and URUK_CONFIG (/etc/uruk/rc by default).

uruk-rc(5), The Uruk homepage is at http://mdcc.cx/uruk/ .

iptables(8), iptables-save(8), iptables-restore(8), http://www.netfilter.org/

interfaces(5), http://ifupdown.sourceforge.net/

Copyright (C) 2003 Stichting LogReport Foundation logreport@logreport.org; Copyright (C) 2003, 2004 Tilburg University http://www.uvt.nl/; Copyright (C) 2003, 2004, 2005 Joost van Baal

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with http://www.gnu.org/copyleft/gpl.html or write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

Joost van Baal <joostvb-uruk@mdcc.cx>