Hi all, ?What iptables do you use to manage iptables? ?Or maybe not? Simply curiosity, so I'm coming from openSUSE and in that distro there is a YaST module front-end (YaST firewall). TIA. -- Jordi Espasa Clofent PGP id 0xC5ABA76A #http://pgp.mit.edu/ FSF Associate Member id 4281 #http://www.fsf.org/ -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 254 bytes Desc: OpenPGP digital signature URL: <http://lists.centos.org/pipermail/centos/attachments/20061129/38029a13/attachment-0002.sig>
On 29/11/06, Jordi Espasa Clofent <jordi.listas at multivia.com> wrote:> Hi all, > > ?What iptables do you use to manage iptables? ?Or maybe not? > > Simply curiosity, so I'm coming from openSUSE and in that distro there > is a YaST module front-end (YaST firewall).Our perimeter firewalls are appliances but I run a tailored copy of the bastion firewall script from the Linux Server Security book on every internal host too to provide another additional layer. http://examples.oreilly.com/linuxss2/ Basically use their example as a template and tailor the incoming and outgoing traffic allowed for each type of host to *only* let them to do what they need. Will.
On 11/29/06, Jordi Espasa Clofent <jordi.listas at multivia.com> wrote:> Hi all, > > ?What iptables do you use to manage iptables? ?Or maybe not? > > Simply curiosity, so I'm coming from openSUSE and in that distro there > is a YaST module front-end (YaST firewall).A tiny package called quicktables allows me to set up a simple policy for a gateway, quickly and understandably. I will tailor it by hand later. I'm not much into dynamically changing policies, so quicktables does a very good job for me. Perhaps your scenario is different. -- Eduardo Grosclaude Universidad Nacional del Comahue Neuquen, Argentina
Quoting Jordi Espasa Clofent <jordi.listas at multivia.com>:> Hi all, > > ?What iptables do you use to manage iptables? ?Or maybe not? > > Simply curiosity, so I'm coming from openSUSE and in that distro there > is a YaST module front-end (YaST firewall).There's this system-config-security-level GUI application that is part of distribution. However it provides only very very very basic functionality. You can only specify ports to open (and than all traffic on those ports is allowed, both incomming and forwarded), and select trusted interfaces (all traffic comming from them is allowed). It doesn't even support NAT (AFAIK). For very simple firewall it may suffice. There are much better 3rd party GUI interfaces, ranging from simple (for managing single firewall), to medium (managing multiple firewalls, but each separately) to complex (for managing multiple firewalls (and everything else security related) by using high level abstractions). Some I can think of, in no particular order would be: - fwbuilder: http://www.fwbuilder.org/ - firestarter: http://www.fs-security.com/ - integrated secure communications system: http://iscs.sourceforge.net/ And of course, if you are not affraid of command line, you can always use firewall editors such as ed, vi, emacs or any other fine tool available out there (there's too many to choose from). I'm sure folks on the list will have many many more suggestions.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jordi Espasa Clofent wrote:> > ?What iptables do you use to manage iptables? ?Or maybe not? >I've heard of this simple utility from Dag's repo: <http://dag.wieers.com/home-made/dwall/> Max -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) Comment: Using GnuPG with CentOS - http://enigmail.mozdev.org iD8DBQFFbcSAHoeeepPau2ERAungAJ9E/ER/KU/eI73lxqiPX7kZL0/3MgCeOJgw 0ahqfptBSN/+iVfXYdB904w=BTBH -----END PGP SIGNATURE-----
Jordi Espasa Clofent musste am 29.11.2006 16:41 dies kund tun:> Hi all, > > ?What iptables do you use to manage iptables? ?Or maybe not? > > Simply curiosity, so I'm coming from openSUSE and in that distro there > is a YaST module front-end (YaST firewall). > > TIA.I use shorewall (http://www.shorewall.net). There is a RPM for it, I think it was in Dag's repo. Greets Ren? -- GEEKCODE: GIT$ d- s+: a- C+++ UL++++$ P+ L++ E--- W+++ N+ !o K- w+ O- M-- V- PS+ PE Y+ PGP++ t++ 5++ X+ R tv+ b DI D++ G e+ h--- r++ y+++ PGP-Key and more available at http://www.standfest.net My Blog is at http://www.gaudidiecher.de