Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a couple Linux machines that act as routers/firewalls for my networks and I have a script that runs all the iptables commands to set my rules. This seems to me like a really silly way to do it though.

How do you do this? Is there a program with config files that are a bit easier to manage? Does it have a GUI or web interface?

share|improve this question
up vote 5 down vote accepted

I use firehol combined with a web interface that I developed to manage the configuration file.

I really like firehol, it provides a simplier syntax then using iptables directly.

  • You can use the firehol debug command to exactly what iptables commands are generated
  • If you have an error in your configuration and you start the firewall, firehol detects the error and reverts to the previous state.
  • Firehol has a 'try' command which you can use to start the firewall remotely, if your changes kill your connection, firehol will revert to the previous state, if you didn't kill your connection then it will ask you to confirm the change.
  • Firehol has a large set of services pre-defined so you don't have to remember exactly what ports you have to have what ports to open for some obscure protocol.
share|improve this answer

I've used Firewall Builder and I quite like it - it's a GUI program that's designed for managing firewall configurations, primarily on remote hosts which could be servers, routers, whatever. The interface looks a little intimidating at first but in my experience, it's worth the couple of hours or so it takes to figure it out. (And apparently they just recently released version 3 since I last checked, so quite possibly the GUI has gotten more intuitive)

share|improve this answer

For RedHat and related OSs (and perhaps for others), you can use the script to create the firewall, and then service iptables ... to handle it from there. This is what I do. When I change my iptables configuration, I use a script. Then I save it with

service iptables save

At this point, the machine will now always come up with the new rules. You can dump a brief version of your current rules with

service iptables status
share|improve this answer

We've used shorewall - "iptables made easy". A GUI is available via Webmin 1.060 and later

The Shoreline Firewall, more commonly known as “Shorewall”, is high-level tool for configuring Netfilter. You describe your firewall/gateway requirements using entries in a set of configuration files. Shorewall reads those configuration files and with the help of the iptables, iptables-restore, ip and tc utilities, Shorewall configures Netfilter and the Linux networking subsystem to match your requirements. Shorewall can be used on a dedicated firewall system, a multi-function gateway/router/server or on a standalone GNU/Linux system.

share|improve this answer

I can't see anything wrong with your method, assuming each machine has different rules.

The way I normally setup firewall rules is by entering them normally on the command line and then running iptables-save > /etc/iptables_rules, I'll then insert the following into /etc/network/if-pre-up.d/iptables so when the network interface starts the rules are automatically imported.

/sbin/iptables-restore < /etc/iptables_rules
share|improve this answer

I do exactly what you have described, except separating the rules into several sub-files (private, dmz, vpn), and setting up a file of variables to make the rules more readable.

share|improve this answer

You could use pfSense instead for your router, it has many features:

  • Firewall
  • Network Address Translation (NAT)
  • Redundancy
  • Load Balancing Reporting and Monitoring
  • RRD Graphs

    The RRD graphs in pfSense maintain historical information on the following.

    • CPU utilization
    • Total throughput
    • Firewall states
    • Individual throughput for all interfaces
    • Packets per second rates for all interfaces
    • WAN interface gateway(s) ping response times
    • Traffic shaper queues on systems with traffic shaping enable
  • VPN
    • IPsec
    • PPTP
    • OpenVPN
  • Dynamic DNS


    • DynDNS
    • DHS
    • DyNS
    • easyDNS
    • No-IP
    • ZoneEdit
  • Captive Portal
  • DHCP Server and Relay

It has a nice, easy to use web-based configuration, just look at the screen-shots.

Best of all you can build it yourself with commodity hardware, and it's Open Source.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.