I use Shorewall and Shorewall-lite. On the master server I have the following arrangement:
- /etc/shorewall - firewall configuration for the server
- /etc/shorewall/common - common files such as standard zone definitions, policies, macros, etc.
- /etc/shorewall/hostname - definition for each host.
Using the common directory allows me to avoid repeating definitions for each server. The config file has a path variable which can be used to specify a list of directories containing common files. If you have a lot of servers with the same rule set you could place the rules in the
common directory, or a different shared directory for that class of servers.
make to build the firewall scripts
firewall.conf. These are then distributed and executed using
I've tried some of the graphical firewall builders, but find shorewall with its config files easier to work with and verify. I keep the whole configuration directory in
git to allow me to easily verify changes before implementation.