Converting from ipchains to iptables

[Steven E. Protter]

I want to convert my production Linux system(I have a web hosting biz) from ipchains firewall to iptables.

I am under the impression that iptables is a next step type evolution based on ipchains.

So, can I change my ipchains configuration file /etc/sysconfig/ipchains to /etc/sysconfig/iptables

I pretty much want the same firewall configuration, but I want to eventually add features.

I'm using Linux 7.3 fully patched.

Also, I'd like to know if I have to completely remove ipchains to make the conversion. This obviously involves a security risk during the conversion.

Thanks.

[Kodjo Agbenu]

Hello,

First, you need to make sure that iptables is fully supported by the running kernel. Normally, it should be the case with RedHat 7.3 and kernel 2.4.18.

Also make sure that the iptables userspace utilities are installed (rpm -q iptables). With my RedHat 7.3 I'm using version 1.2.5.

Then, if your biz is 24x7 and critical, consider doing changes on a test machine before going on the production server.

The changes from old to new firewall configuration may not be so risky because if your new configuration file is OK and has been tested before, you just need to type something like :

/etc/init.d/ipchains stop ; /etc/init.d/iptables start

Of course you will have to definitely enable iptables and disable ipchains :

chkconfig --del ipchains
chkconfig --add iptables

Good luck.

Kodjo

[Steven E. Protter]

Yes, iptables is installed and the kernel is up to date.

Question: Are you saying there is no change required in the configuration files?

[Steven E. Protter]

Note: I have completed the conversion. The ipchains configuration file can not be mirgrated to iptables.

It is a good guide for making changes to the iptables files and has a similar syntax. I did this on a test server, not production.

STeve