3 ms·
I used to hold the same opinion as you, but I've recently changed my opinion of firehol; it's a little higher level than ufw and friends, and highly encourages
by beagle3 10y ago
I used to hold the same opinion as you, but I've recently changed my opinion of firehol; it's a little higher level than ufw and friends, and highly encourages good practices which are easy to forget or get wrong if you iptables all the way.
I've realised that when I noticed that the comments I wrote for others on my iptable configs were comparable in length and content to firehol (but not verifiable or executable). Unlike ufw, firehol actually saved me significant time and effort even though I know (and use) iptables directly.
- ktsaou 10y agonice you like firehol. iptables is still very hard in certain context. Try for example to setup a load balancer for non-sibling IPs, with client affinity, or use SYNPROXY together with NAT. I have spent 3 weeks in fulltime to handle all these cases properly in firehol.
- beagle3 10y agoThank you very much for firehol, it is great! Haven't had time to use netdata, but it looks great as well!