Re: [gentoo-server] an alternate firewall solution for Gentoo

[Ken Tossell]

Kurt Lieber wrote:

>From a server perspective, I have never been very happy with the way Gentoo
>handles iptables.  If you're not familiar with the Gentoo/iptables
>solution, it basically uses an 'iptables-save' script to save your current
>ruleset each time you /etc/init.d/iptables stop and/or reboot the box.  The
>next time iptables is started, it uses that saved state.
>
>
I wasn't aware of this... I hand-edit my /var/lib/iptables/rules-save 
file, and it's not touched when I reboot or /etc/init.d/iptables stop... 
Do you mean /etc/init.d/iptables save ? My comments don't get wiped out, 
so the default-ish setup isn't saving my environment automatically...

Ken

>The reason I don't like this is because, often times when debugging, I'll
>add a temporary iptables rule to see if that fixes the problem at hand.
>Being human, I don't always remember to clean that rule out later.  With
>the current solution, this means that rule will always be there and will
>survive reboots.
>
>Instead, I much prefer a solution where the box starts from a known set of
>rules that are hard-coded.  You can still add ad-hoc iptables rules as
>needed, but when you reboot the box, you'll be back to a "known-good"
>state.
>
>
That's how my setup works.

>So, Andrea Barisani was kind enough to help write a new set of init scripts
>and conf files that works this way.  He and I have worked together to debug
>them (though he's spent more time debugging my mistakes :) and I feel
>pretty comfortable recommending them for production use.  They're running
>on three of Gentoo's infrastructure boxes and will soon be running on all
>of them.
>
>Documentation:
>http://www.gentoo.org/proj/en/infrastructure/firewall/server-firewall.xml
>
>Scripts:
>http://dev.gentoo.org/~lcars/fw/
>
>Note that those scripts do not make use of ulogd.  If you're a ulogd user
>like I am, some simple modifications to the init.d script will allow you to
>use that instead of syslog.
>
>Comments, questions and feedback are welcome.  I'd also like to thank
>Andrea for his hard work in writing these scripts.
>
>--kurt
>
>