[Shorewall-users] Configuration for simple ssh forwarding

Scott Jibben
Mon, 27 Oct 2003 15:42:25 -0000

> At 16:14 10/27/2003, you wrote:
> >If you:
> >
> >a) Provide only minimal documentation; and
> >b) Tell everyone who asks a stupid question to get lost
> >
> >then you generally weed out those who aren''t serious.
>
> True, but you also (c) provide a much lower-quality product simply to
> create a fool filter. Bad approach, doing one bad thing to avoid another.
>
> I respect people much more when they take your approach: do it right and
> do
> it thoroughly. You deserve a lot of credit for the work you''ve
done.
> However, if the support job gets somewhat too heavy (part of the price of
> success), you should try to make the FAQ bigger and better, perhaps more
> detailed, and then simply answer fewer questions on the list. Let the
> shorewall community grow and distribute some of that load among its
> members.

I agree with Rodolfo, Shorewall makes iptables within easier reach of the
less qualified admins (that would be me...).  IMHO, the Shorewall interface
is what iptables should have been.

In any case, I would recommend identifying some qualified Shorewall users
who can answer the easier problems in that show up in the list.  I would
think that you could find some people out here that will help with the
support load.

Granted there will be problems that Tom will have to answer.  My problem
involved recompiling the net interface for the reject feature.  I know that
I couldn''t figure that one out on my own.  But having gotten past that,
I
now have a two-interface network firewall and three single-interface
servers.  Hopefully the difficult problems will not occur as often.

With Linux you almost have to expect some of your support will really fall
into what could be considered education.  It is an OS with so many features
it would hard to be a qualified admin in everything.

I honestly don''t know how Tom does the coding and support for Shorewall
(seemingly 24x7) and has a job, too.

sj