Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We currently use a number of linux routers, and currently a number of the team tend to jump into servers and change the routing rules when needed, and the auditing is becoming incredibly tedious.

For all other server configs we store in a git repository, and are migrating to using puppet. I haven't been able to figure out how to manage the iproute2 configuration however, as all changes are done live.

This was a similar question for cisco routers: managing and auditing existing cisco firewall access control and routing rules I'm wondering if something like this can be done in linux iproute2?

share|improve this question
add comment

2 Answers

Rather than doing changes live you can create scripts which remove all current routing tables and create new fresh tables as per requirement. This script can also be added to system start-up. Backing of this script using some version control system should solve the problem.

share|improve this answer
    
Thanks for the comment, I was planning on doing something like this originally, but I was wondering if there was some already built package that wraps around it, like ferm for iptables rules. If not, definitely the best solution, thanks :) –  bobinabottle Nov 12 '10 at 22:41
add comment

While you could use the iptables-{save,restore} syntax, it won't diff well.

You need some language to generate the rules.

I am happy with shorewall, but since you are used to the iptables command, ferm would be more suited to your use case. ferm is syntactic sugar that adds nesting to iptables rules.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.