5 ms·

iptables-persistent on Debian. Or iptables-services on redhat

• mirimir 8y ago
  I love it, but it's not a wrapper. It's just a dead-simple mechanism for making iptables persistent. The cool thing is that /etc/iptables/rules.v4 and /etc/iptables/rules.v6 get loaded at bootup. So if you're living dangerously, you just use /etc/iptables/test-rules.v4 or whatever. If you get locked out, just reboot the server. Or have it rebooted, if you don't have a management console.
  • sadris 8y ago
    Test with the live iptables state. Then you can save it with iptables-save > rules.v4 Why do you need a wrapper at all? I looked at shorewall ten years ago and it just made everything more complicated than just doing it raw. Term is also nice because it still uses iptables syntax.
    • mirimir 8y ago
      I'm sure that there are other ways to manage multiple sets of iptables rules. I've just found iptables-persistent to be the easiest. I do agree on the iptables vs wrapper issue. I started out using Shorewall, and then ufw. But once I started learning iptables, I decided that it was simpler to just use it.
• sliken 8y ago
  Bleah, iptables is rather hostile. Sure, you have a webserver, add a rule to allow TCP over 80. Later you revisit, decide you need to add 443. So you do the obvious and change "80" to "80,443". Which fails. Turns out there's a completely different way to match multiple ports. Or you could write a rule per port... making mistakes much more likely and much harder to spot.
• benkillin 8y ago
  personally I use a script I developed a while ago for doing iptables directly, using awk to parse some txt files to apply the firewall config and then adding a script to execute the iptables script on boot: https://github.com/benkillin/linux-firewall https://github.com/benkillin/linux-firewall the ip6 section needs some further development though - I have no need for it in my scenario at the moment.