Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #236034

Re: How to manage a firewall script with minor tweaks for different machines?

Show all headers | View raw

On 6/12/2021 6:02 PM, Anssi Saari wrote:
>
> I've recently setup nftables firewalls on the machines of my little home
> network. I was a little optimistic and thought I could get by with a
> simple one that only allows ssh and nfs in i.e. two TCP ports and mDNS
> with its slightly more complex rules.
>
> But then... One machine has a radius server that needs UDP port 1812
> open. And another is a print server with CUPS and SMB which apparently
> need at least TCP ports 631 and 137 open.
>
> How could I neatly incorporate these minor tweaks in a single nft
> script? I was thinking of git branches where I can make changes to the
> "main" firewall and merge those changes to the slightly tweaked
> branches. Or possibly also some preprocessor type of thing that
> generates three versions of the firewall script. Or just generate the
> whole nft scripts with the small variants. Just wondering what other
> people are doing with this sort of thing?
>
> I also need some way of pushing these firewall scripts and other config
> stuff over to the machines too. It's not a huge network but manually
> logging into each machine, overwriting /etc/nftables.conf and restarting
> nftables.service is a pain. cdist looks interesting and simple, does
> anyone have experience with it?
>

You could have one common file that includes a custum file (1).
You would have one custum file per host (custum-cups, custum-smb ...).

This approach would require to always push two files(common and
custum-*) using SSH for example.

To automate that pushing step and reloading of the rules, you would have
to create a litle script that would do that based on argument:

$ push.sh cups

$ cat push.sh
#!/bin/sh

case $1 in
     cups)
         remote_ip = '<REMOTE-IP-OF-CUPS-SERVER>'
         scp common-cups custum $remote_ip:<REMOTEPATH>
         ;;
     smb)
         remote_ip = '<REMOTE-IP-OF-SMB-SERVER>'
         scp common custum-smb $remote_ip:<REMOTEPATH>
         ;;
esac

ssh $server_ip "<REMOTE-COMMAND-TO-EXECUTE>"



Note 1: I'm not using nftables, so I don't know the actual command to
reload your newly pushed config nor the location for the rules files! :)

Note 2: The script is an example only and should not be used as such.

HTH.

1)  https://wiki.nftables.org/wiki-nftables/index.php/Scripting

--
John Doe

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

How to manage a firewall script with minor tweaks for different machines? Anssi Saari <as@sci.fi> - 2021-06-12 18:10 +0200
  Re: How to manage a firewall script with minor tweaks for different machines? deloptes <deloptes@gmail.com> - 2021-06-12 18:30 +0200
  Re: How to manage a firewall script with minor tweaks for different  machines? john doe <johndoe65534@mail.com> - 2021-06-12 19:30 +0200
    Re: How to manage a firewall script with minor tweaks for different machines? Anssi Saari <as@sci.fi> - 2021-06-12 21:40 +0200
  Re: How to manage a firewall script with minor tweaks for different  machines? Andy Smith <andy@strugglers.net> - 2021-06-12 21:30 +0200
    Re: How to manage a firewall script with minor tweaks for different machines? Anssi Saari <as@sci.fi> - 2021-06-19 16:30 +0200

csiph-web