Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a distributed application composed of several different components. For example, we have Python app servers, PostgreSQL DB servers, Redis servers, Memcached, etc. Some of these services are in different servers. All of these servers are running CentOS Linux, and we are currently enabling access between servers only on a need-to-connect basis (i.e. instead of opening up port 6379 to all hosts in every Redis destination host, we open it per-host).

My question is: What is a good practice for managing iptables environments where multiple servers are concerned? Is there some other tool that I should be using, or is there a better management scheme for security between several servers? If there is something better than plain firewalls, let me know.

Any suggestions will be appreciated. Thanks very much for your time!

share|improve this question
Puppet or CFEngine? – Hubert Kario Jan 13 '13 at 2:26
If you could elaborate a little bit and formulate an answer, I'd look into it and upvote it. Thanks! – Juan Carlos Coto Jan 13 '13 at 21:33
It was more in the line of "Have you tried Puppet or similar tool? Why are they not applicable?". Besides that, it would be hard for me to add anything to what Jeff Hall already said. – Hubert Kario Jan 14 '13 at 0:17
up vote 3 down vote accepted

It's hard to "do better" than stock iptables on Linux servers, IMHO. The tool is straight forward, effective, and well-known by many Linux sysadmins.

It sounds to me the problem you're really trying to tackle has less to do with the firewall itself and more to do with managing a security policy across multiple hosts. That speaks configuration management to me. There are two classes of software you might use to solve this problem, depending on your skill set and environment constraints: infrastructure automation software like Puppet or Chef; or one of a large array of configuration management software for Linux: see Comparison of Open Source Configuration Management Software.

Define your security policy in terms of the components of your software, their needs, and how various specific hosts map to those "roles". Then you can define that policy in terms of the configuration management or automation software to define which iptables policy should be on which host.

I recognize this answer is not very specific, but I'm happy to clarify if you have questions.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.