topic Converting from ipchains to iptables in Operating System - Linux

Converting from ipchains to iptables

Steven E. Protter — Wed, 16 Oct 2002 17:52:58 GMT

I want to convert my production Linux system(I have a web hosting biz) from ipchains firewall to iptables.

I am under the impression that iptables is a next step type evolution based on ipchains.

So, can I change my ipchains configuration file /etc/sysconfig/ipchains to /etc/sysconfig/iptables

I pretty much want the same firewall configuration, but I want to eventually add features.

I'm using Linux 7.3 fully patched.

Also, I'd like to know if I have to completely remove ipchains to make the conversion. This obviously involves a security risk during the conversion.

Thanks.

Re: Converting from ipchains to iptables

Kodjo Agbenu — Wed, 16 Oct 2002 20:12:20 GMT

Hello,

First, you need to make sure that iptables is fully supported by the running kernel. Normally, it should be the case with RedHat 7.3 and kernel 2.4.18.

Also make sure that the iptables userspace utilities are installed (rpm -q iptables). With my RedHat 7.3 I'm using version 1.2.5.

Then, if your biz is 24x7 and critical, consider doing changes on a test machine before going on the production server.

The changes from old to new firewall configuration may not be so risky because if your new configuration file is OK and has been tested before, you just need to type something like :

/etc/init.d/ipchains stop ; /etc/init.d/iptables start

Of course you will have to definitely enable iptables and disable ipchains :

chkconfig --del ipchains
chkconfig --add iptables

Good luck.

Kodjo

Re: Converting from ipchains to iptables

Steven E. Protter — Thu, 17 Oct 2002 16:14:42 GMT

Yes, iptables is installed and the kernel is up to date.

Question: Are you saying there is no change required in the configuration files?

Re: Converting from ipchains to iptables

Steven E. Protter — Wed, 23 Oct 2002 19:21:13 GMT

Note: I have completed the conversion. The ipchains configuration file can not be mirgrated to iptables.

It is a good guide for making changes to the iptables files and has a similar syntax. I did this on a test server, not production.

STeve