4 ms·

IMO just learn the real iptables commands. They're seriously one-liners with just a few args, and then you'll know how to set up a basic firewall on most distro

IMO just learn the real iptables commands. They're seriously one-liners with just a few args, and then you'll know how to set up a basic firewall on most distros. https://fedoraproject.org/wiki/How_to_edit_iptables_rules https://fedoraproject.org/wiki/How_to_edit_iptables_rules is the fedora guide. There are others. Here's how to disable firewalld: https://fedoraproject.org/wiki/FirewallD#Using_static_firewall_rules_with_the_iptables_and_ip6tables_services https://fedoraproject.org/wiki/FirewallD#Using_static_firewa... Note here that if everyone just spent the 5 minutes it takes to learn the few basic iptables commands, we wouldn't have ufw and firewalld and firehol and vuurmuur and Crazy Bob's Super Simple VBA-to-XML iptables rule generator. Every attempt at making iptables "easy", I consider harmful, as it's a basic systems administration skill that people continually hurt themselves by not learning. iptables is not hard, but all of these wrappers make it hard by introducing their own dumb syntax while adding complexity and quashing any hope of a standard interface between distros to control networking rules, which iptables already was before they tried to "fix" it.

cheiVia0 10y ago
iptables is obsolete btw, Linux kernel developers replaced it with nftables.
- Nux 10y ago
  From their docs, nftables is "available upstream since Linux kernel 3.13. It supports 3/4 of the existing iptables features" - 3/4 is still a long way to obsoleting iptables.
beagle3 10y ago
I used to hold the same opinion as you, but I've recently changed my opinion of firehol; it's a little higher level than ufw and friends, and highly encourages good practices which are easy to forget or get wrong if you iptables all the way. I've realised that when I noticed that the comments I wrote for others on my iptable configs were comparable in length and content to firehol (but not verifiable or executable). Unlike ufw, firehol actually saved me significant time and effort even though I know (and use) iptables directly.
- ktsaou 10y ago
  nice you like firehol. iptables is still very hard in certain context. Try for example to setup a load balancer for non-sibling IPs, with client affinity, or use SYNPROXY together with NAT. I have spent 3 weeks in fulltime to handle all these cases properly in firehol.
  - beagle3 10y ago
    Thank you very much for firehol, it is great! Haven't had time to use netdata, but it looks great as well!

cheiVia0 10y ago

iptables is obsolete btw, Linux kernel developers replaced it with nftables.

Nux 10y ago
From their docs, nftables is "available upstream since Linux kernel 3.13. It supports 3/4 of the existing iptables features" - 3/4 is still a long way to obsoleting iptables.

beagle3 10y ago

I used to hold the same opinion as you, but I've recently changed my opinion of firehol; it's a little higher level than ufw and friends, and highly encourages good practices which are easy to forget or get wrong if you iptables all the way. I've realised that when I noticed that the comments I wrote for others on my iptable configs were comparable in length and content to firehol (but not verifiable or executable). Unlike ufw, firehol actually saved me significant time and effort even though I know (and use) iptables directly.

ktsaou 10y ago
nice you like firehol. iptables is still very hard in certain context. Try for example to setup a load balancer for non-sibling IPs, with client affinity, or use SYNPROXY together with NAT. I have spent 3 weeks in fulltime to handle all these cases properly in firehol.
- beagle3 10y ago
  Thank you very much for firehol, it is great! Haven't had time to use netdata, but it looks great as well!