Re: [gentoo-server] an alternate firewall solution for Gentoo

[Jonathan S. Romero]

I have been pretty happy with shorewall in general, because it makes moving 
rulesets between machines very easy.  It also has very common sense syntax 
when narrowing rules to specific machines or specific subnets on an 
interface.

Shorewall is a really awesome iptables init.d script that pulls data from 
several shorewall files that you hand edit.

-Jonathan

On Sunday 21 September 2003 10:11 am, Kurt Lieber wrote:
> From a server perspective, I have never been very happy with the way Gentoo
> handles iptables.  If you're not familiar with the Gentoo/iptables
> solution, it basically uses an 'iptables-save' script to save your current
> ruleset each time you /etc/init.d/iptables stop and/or reboot the box.  The
> next time iptables is started, it uses that saved state.
>
> The reason I don't like this is because, often times when debugging, I'll
> add a temporary iptables rule to see if that fixes the problem at hand.
> Being human, I don't always remember to clean that rule out later.  With
> the current solution, this means that rule will always be there and will
> survive reboots.
>
> Instead, I much prefer a solution where the box starts from a known set of
> rules that are hard-coded.  You can still add ad-hoc iptables rules as
> needed, but when you reboot the box, you'll be back to a "known-good"
> state.
>
> So, Andrea Barisani was kind enough to help write a new set of init scripts
> and conf files that works this way.  He and I have worked together to debug
> them (though he's spent more time debugging my mistakes :) and I feel
> pretty comfortable recommending them for production use.  They're running
> on three of Gentoo's infrastructure boxes and will soon be running on all
> of them.
>
> Documentation:
> http://www.gentoo.org/proj/en/infrastructure/firewall/server-firewall.xml
>
> Scripts:
> http://dev.gentoo.org/~lcars/fw/
>
> Note that those scripts do not make use of ulogd.  If you're a ulogd user
> like I am, some simple modifications to the init.d script will allow you to
> use that instead of syslog.
>
> Comments, questions and feedback are welcome.  I'd also like to thank
> Andrea for his hard work in writing these scripts.
>
> --kurt