Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #178145

Mixing firewall tools

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi all,

I have a machine with a hand-rolled firewall script, which just runs
iptables commands - all well and good.

The trickiest bits are for my LXC containers; I need to forward ports
etc - but that's ok.

The complications start when I add fail2ban - now I have an extra bit in
my init script that reloads fail2ban after reloading my script, because
my script does a flush of all existing rules. This is now getting ugly,
but it still worked.

Does anyone have better ideas for that stage? Do any of the many
firewall tools cope with this adequately?

I do have a hitch on this machine (but not on another similar one) in
that it hangs on boot ... I'm not sure why, except I suspect running an
init script on a systemd system may be a contributing factor - except
that my other firewall was also upgraded to jessie+systemd, and it
works. I haven't figured that one out yet.

Now the biggie: I want to add Docker. Docker wants to do its own thing
with iptables. Do I need to resort to just telling Docker to keep its
hands off, and do everything myself?

Are there any good tools out there that allow for integration of
multiple firewall systems, and produce reasonably straightforward rule sets?

Any other tips - ie answers to questions I didn't think of asking? :-)

Thanks,
Richard

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Mixing firewall tools Richard Hector <richard@walnut.gen.nz> - 2017-02-25 08:00 +0100
  Re: Mixing firewall tools Dan Ritter <dsr@randomstring.org> - 2017-02-25 15:30 +0100
    Re: Mixing firewall tools Richard Hector <richard@walnut.gen.nz> - 2017-02-25 15:50 +0100
      Re: Mixing firewall tools Dan Ritter <dsr@randomstring.org> - 2017-02-25 16:50 +0100

csiph-web