[gentoo-user] Re: scripted iptables-restore

[Martin Vaeth]

Michael Orlitzky <michael@××××××××.com> wrote:
>>> [...]
>>> If you have a million rules and you need to wipe/reload them all
>>> frequently you're probably doing something wrong to begin with.
>>
>> I don't know how this is related with the discussion.
>> The main advantage of using iptables-restore is avoidance of
>> race conditions. A secondary advantage is a speed improvement;
>> in my case, the machine boots about 2 seconds faster which can
>> be a considerable advantage if you start virtual machines.
>>
>
> I was just reiterating that there's not much benefit to save/restore if
> you're doing things properly (pontification alert!).

For a laptop of a scientist like me this is not true at all - it must
often be connected in a different environment with different
local nets etc.
Also for other things (like portknocking using the recent module)
you need rather complex rules which are better rewritten by a script,
especially if the length of a portknocking sequence changes.
Like passwords, these sequences should better not stay the same for
too long...

> Race conditions don't really seem that serious to me.

Maybe, but I am not sure:
There might be situations where it might be possible to keep
a port open even when the rule is rewritten later on; then
you need an open system only once...
So, I could imagine that with some clever hacks an attacker
might keep ports open and then do another attack later on.
I am not an experienced hacker to know such attacks, but I
know that races can be very subtle and provide attack vectors
nobody has ever thought off.

> All of security is a trade-off, and in my opinion, having
> human-friendly, easily-readable rules (with error checking)

It is easy to switch to one method for testing and then back
when everything works: If you write $iptables ...
throughout you just have to set
iptables="iptables"
or
iptables="FvwmTables 4"
respectively. In fact, the firewall-mv script does this
(with a different mechanism) depending on a commandline switch.
Moreover, I observed that the error checking works with
iptables-restore as well as with iptables:
It shows you almost the same errors, including a line number.
So the only difference is that you have to count the lines
in the testing output instead of directly seeing the command...