Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We currently use a number of linux routers, and currently a number of the team tend to jump into servers and change the routing rules when needed, and the auditing is becoming incredibly tedious.

For all other server configs we store in a git repository, and are migrating to using puppet. I haven't been able to figure out how to manage the iproute2 configuration however, as all changes are done live.

This was a similar question for cisco routers: managing and auditing existing cisco firewall access control and routing rules I'm wondering if something like this can be done in linux iproute2?

share|improve this question

Rather than doing changes live you can create scripts which remove all current routing tables and create new fresh tables as per requirement. This script can also be added to system start-up. Backing of this script using some version control system should solve the problem.

share|improve this answer
Thanks for the comment, I was planning on doing something like this originally, but I was wondering if there was some already built package that wraps around it, like ferm for iptables rules. If not, definitely the best solution, thanks :) – bobinabottle Nov 12 '10 at 22:41

While you could use the iptables-{save,restore} syntax, it won't diff well.

You need some language to generate the rules.

I am happy with shorewall, but since you are used to the iptables command, ferm would be more suited to your use case. ferm is syntactic sugar that adds nesting to iptables rules.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.