{"id":8,"date":"2005-01-05T17:08:00","date_gmt":"2005-01-06T01:08:00","guid":{"rendered":"http:\/\/outflux.net\/blog\/archives\/2005\/01\/05\/suse-firewall\/"},"modified":"2005-01-06T03:23:36","modified_gmt":"2005-01-06T11:23:36","slug":"suse-firewall","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2005\/01\/05\/suse-firewall\/","title":{"rendered":"SuSE Firewall"},"content":{"rendered":"

Started looking at the SuSE firewall scripts today. They’re quite nice, actually. So far, they look like they’ll support everything I want to do without any trouble. What’s really nice about it is the resulting script is much more readable than a string of iptables<\/code> commands (where I’d have to specify the ACCEPT, NAT, and FORWARD for inbound services generally in different places).<\/p>\n

What I’d really like to see would be an m4<\/code>-based version of the script. It’s good enough for sendmail<\/code> and autoconf<\/code>, why not iptables<\/code>? :) That would totally rock, because then I’d be able to see the resulting list of iptables<\/code> commands. I bet there’s a place somewhere to see them now; but I just haven’t looked.<\/p>\n

I’m hoping that this firewall configuration will play nice with heartbeat<\/code>, which I’ll be using to do some high-availability work on the firewall pair. I’ve had to fight a little with SuSE over the interface names (I want to name the network interfaces after their function, not their boot order). udev<\/code> has been quite friendly, but SuSE seems to have special meanings for various separator characters. I wanted to have “eth-internal”, etc, but it seems to strip “eth-“. And “eth_internal” turns into “eth\/internal”. So, I’m just using “etinternal” instead. :P<\/p>\n

© 2005, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
\"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"

Started looking at the SuSE firewall scripts today. They’re quite nice, actually. So far, they look like they’ll support everything I want to do without any trouble. What’s really nice about it is the resulting script is much more readable than a string of iptables commands (where I’d have to specify the ACCEPT, NAT, and […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,6],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/8"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=8"}],"version-history":[{"count":0,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/8\/revisions"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=8"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=8"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=8"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}