3 ms·

It is possible the maintainers of the various OS distribution packages will band together and maintain development. BTW, what's the general recommendation for

It is possible the maintainers of the various OS distribution packages will band together and maintain development. BTW, what's the general recommendation for people looking to migrate to another Linux firewall package?

sadris 8y ago
iptables-persistent on Debian. Or iptables-services on redhat
- mirimir 8y ago
  I love it, but it's not a wrapper. It's just a dead-simple mechanism for making iptables persistent. The cool thing is that /etc/iptables/rules.v4 and /etc/iptables/rules.v6 get loaded at bootup. So if you're living dangerously, you just use /etc/iptables/test-rules.v4 or whatever. If you get locked out, just reboot the server. Or have it rebooted, if you don't have a management console.
  - sadris 8y ago
    Test with the live iptables state. Then you can save it with iptables-save > rules.v4 Why do you need a wrapper at all? I looked at shorewall ten years ago and it just made everything more complicated than just doing it raw. Term is also nice because it still uses iptables syntax.
    - mirimir 8y ago
      I'm sure that there are other ways to manage multiple sets of iptables rules. I've just found iptables-persistent to be the easiest. I do agree on the iptables vs wrapper issue. I started out using Shorewall, and then ufw. But once I started learning iptables, I decided that it was simpler to just use it.
- sliken 8y ago
  Bleah, iptables is rather hostile. Sure, you have a webserver, add a rule to allow TCP over 80. Later you revisit, decide you need to add 443. So you do the obvious and change "80" to "80,443". Which fails. Turns out there's a completely different way to match multiple ports. Or you could write a rule per port... making mistakes much more likely and much harder to spot.
- benkillin 8y ago
  personally I use a script I developed a while ago for doing iptables directly, using awk to parse some txt files to apply the firewall config and then adding a script to execute the iptables script on boot: https://github.com/benkillin/linux-firewall https://github.com/benkillin/linux-firewall the ip6 section needs some further development though - I have no need for it in my scenario at the moment.
rhizome 8y ago
fwbuilder will export rules from its GUI to a whole bunch of different firewalls. When you change firewalls, just re-export/compile. http://fwbuilder.sourceforge.net/4.0/features.shtml http://fwbuilder.sourceforge.net/4.0/features.shtml

sadris 8y ago

iptables-persistent on Debian. Or iptables-services on redhat

mirimir 8y ago
I love it, but it's not a wrapper. It's just a dead-simple mechanism for making iptables persistent. The cool thing is that /etc/iptables/rules.v4 and /etc/iptables/rules.v6 get loaded at bootup. So if you're living dangerously, you just use /etc/iptables/test-rules.v4 or whatever. If you get locked out, just reboot the server. Or have it rebooted, if you don't have a management console.
- sadris 8y ago
  Test with the live iptables state. Then you can save it with iptables-save > rules.v4 Why do you need a wrapper at all? I looked at shorewall ten years ago and it just made everything more complicated than just doing it raw. Term is also nice because it still uses iptables syntax.
  - mirimir 8y ago
    I'm sure that there are other ways to manage multiple sets of iptables rules. I've just found iptables-persistent to be the easiest. I do agree on the iptables vs wrapper issue. I started out using Shorewall, and then ufw. But once I started learning iptables, I decided that it was simpler to just use it.
sliken 8y ago
Bleah, iptables is rather hostile. Sure, you have a webserver, add a rule to allow TCP over 80. Later you revisit, decide you need to add 443. So you do the obvious and change "80" to "80,443". Which fails. Turns out there's a completely different way to match multiple ports. Or you could write a rule per port... making mistakes much more likely and much harder to spot.
benkillin 8y ago
personally I use a script I developed a while ago for doing iptables directly, using awk to parse some txt files to apply the firewall config and then adding a script to execute the iptables script on boot: https://github.com/benkillin/linux-firewall https://github.com/benkillin/linux-firewall the ip6 section needs some further development though - I have no need for it in my scenario at the moment.

rhizome 8y ago

fwbuilder will export rules from its GUI to a whole bunch of different firewalls. When you change firewalls, just re-export/compile. http://fwbuilder.sourceforge.net/4.0/features.shtml http://fwbuilder.sourceforge.net/4.0/features.shtml