RE: [gentoo-dev] NAT iptables info

[Sherman Boyd]

What about a configuration packages?  I think that the default settings of an ebuild should be conservative and secure, but when you start talking about ebuilds with lots of configuration options you see a need for a what Chad is talking about.  How about:
 
emerge rusty_impervious_firewall.x.y.z.econf
 
or maybe it should be a separate tool:
 
econfig tonys_sweet_gnome_setup.x.y.z.econf
 
That way we can keep configuration and installation in separation.
 
-sherman
 

	-----Original Message-----
From: Chad Huneycutt <chad.huneycutt@×××.org> 
Sent: Monday, October 01, 2001 7:30 PM
To: <gentoo-dev@××××××××××.org>
Subject: Re: [gentoo-dev] NAT iptables info



	Donny Davies wrote: 

	>To provide some kind of gentoo firewall is, hmm, well silly. Its %100 
>configuration. This is not the domain of a 'package', 'rpm' or ebuild.
>
I don't completely agree with this.  While questions like "How do I set 
up a firewall?" are not completely germaine to this mailing list, the 
above statement is your opinion and open for discussion here.  I think 
that it is a very good idea to provide several basic scripts for common 
configurations.  If they are already out there, then great!, we should 
include them in an ebuild.  It is a much better policy to have the 
network default to a secure state (such as the Rusty's script that 
allows no incoming connections) than to leave it wide open, and let the 
potentially newbie sysadmin get hacked. 

	It would be nice to bring up a semi secure,  masquerading (or whatever 
they are calling it these days)  firewall box with little effort.  From 
there, one can learn about iptables and such things to customize it further. 

	Just some thoughts from someone who hasn't delved into iptables yet, 

	   Chad 


	_______________________________________________ 
gentoo dev mailing list 
gentoo dev@××××××××××.org 
http://cvs.gentoo.org/mailman/listinfo/gentoo dev