[gentoo-server] an alternate firewall solution for Gentoo

[Kurt Lieber]

From a server perspective, I have never been very happy with the way Gentoo
handles iptables.  If you're not familiar with the Gentoo/iptables
solution, it basically uses an 'iptables-save' script to save your current
ruleset each time you /etc/init.d/iptables stop and/or reboot the box.  The
next time iptables is started, it uses that saved state.

The reason I don't like this is because, often times when debugging, I'll
add a temporary iptables rule to see if that fixes the problem at hand.
Being human, I don't always remember to clean that rule out later.  With
the current solution, this means that rule will always be there and will
survive reboots.

Instead, I much prefer a solution where the box starts from a known set of
rules that are hard-coded.  You can still add ad-hoc iptables rules as
needed, but when you reboot the box, you'll be back to a "known-good"
state.

So, Andrea Barisani was kind enough to help write a new set of init scripts
and conf files that works this way.  He and I have worked together to debug
them (though he's spent more time debugging my mistakes :) and I feel
pretty comfortable recommending them for production use.  They're running
on three of Gentoo's infrastructure boxes and will soon be running on all
of them.

Documentation:
http://www.gentoo.org/proj/en/infrastructure/firewall/server-firewall.xml

Scripts:
http://dev.gentoo.org/~lcars/fw/

Note that those scripts do not make use of ulogd.  If you're a ulogd user
like I am, some simple modifications to the init.d script will allow you to
use that instead of syslog.

Comments, questions and feedback are welcome.  I'd also like to thank
Andrea for his hard work in writing these scripts.

--kurt