Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using iptables for years, because it is a straightforward solution without any magic. But now I'm building a router for myself, I found there are many useful features provided by Shorewall.

Is it possible to use iptables and Shorewall on the same time? I know Shorewall is just a frontend of iptables. But I don't know whether cause a conflict.

Also, I need to block tons of addresses, so ipset is the perfect solution. Is it safe to use all these three firewalls?

share|improve this question

As you said :

Shorewall is just a frontend of iptables

So, in your opinion, what could be a very good reason to use both ?

Furthermore, ipsets can be used with pure iptables, but Shorewall also supports ipsets : http://www.shorewall.net/ipsets.html

So, i would say : use iptables OR Shorewall (as front-end).

Using both makes no sense.

share|improve this answer

Shorewall and ipsets are totally complementary, shorewall is like is said above a front-end tool to manage iptables correctly. Ipsets is a tool to whitelist/blacklist big sets of ips much more efficiently, so they are can work together and mostly all sysadmin, that I know, recommend it.

The main consideration to be taken care of, is that in order to get shorewall working with ipsets, your kernel needs to support ipset match (IPSET_MATCH). To check if your server has support for it, run:

$ shorewall show -f capabilities | grep IPSET_MATCH

you should see:

IPSET_MATCH=Yes

In order to being able to use shorewall with ipset. This support depends totally on your kernel and your OS.

My experience was that, in order to make it working, I need to update iptables and ipset package to the last version:

iptables v1.6.0
ipset v6.27, protocol version: 6

because in that version the support to ipset match is added by the package. You can read the changelog of ipset. But it is possible that your kernel already support it. As this package version are not in Jessie repository (at this moment at least), I needed to install them from testing repository, which is not the most recommendable approach, but it worked perfectly.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.