Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to manage linux server.

We have many dedicated server in different regions. Some of them serve mysql and allow access each other.

I can modify iptables configuration to add rule accepting port 3306 requests from some server in iptables by myself. Is there other way to manage many iptables efficiently ?

share|improve this question
up vote 5 down vote accepted

Check out Firewall builder or you can also use puppet iptables module.

Firewall Builder supports GUI based firewall policy configuration and management on the following firewalls:

  • Linux iptables - 2.4 & 2.6 kernels
  • Cisco router access control lists (ACL)
  • Cisco ASA/PIX
  • Cisco Firewall Service Module (FWSM)
  • OpenBSD pf
  • FreeBSD ipfw and ipfilter
  • HP ProCurve ACL
share|improve this answer

Use puppet chef or cfengine to distribiute rules and restart iptables.

share|improve this answer

I use Shorewall and Shorewall-lite. On the master server I have the following arrangement:

  • /etc/shorewall - firewall configuration for the server
  • /etc/shorewall/common - common files such as standard zone definitions, policies, macros, etc.
  • /etc/shorewall/hostname - definition for each host.

Using the common directory allows me to avoid repeating definitions for each server. The config file has a path variable which can be used to specify a list of directories containing common files. If you have a lot of servers with the same rule set you could place the rules in the common directory, or a different shared directory for that class of servers.

I use make to build the firewall scripts firewall and firewall.conf. These are then distributed and executed using ssh.

I've tried some of the graphical firewall builders, but find shorewall with its config files easier to work with and verify. I keep the whole configuration directory in git to allow me to easily verify changes before implementation.

share|improve this answer

For chef on Ubuntu you can use the UFW cookbook.

Beware: UFW doesn't work on Open VZ without many modifications.

share|improve this answer

I was facing the same problem of remotely administering iptables on many servers. Since no satisfying solution existed we developed rfw

With rfw (remote firewall) you can add and delete iptables rules on many servers from a single point of control using any HTTP client via REST API.

See the rfw tutorial

The project is open source and released under MIT License.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.