I'm using iptables for years, because it is a straightforward solution without any magic. But now I'm building a router for myself, I found there are many useful features provided by Shorewall.
Is it possible to use iptables and Shorewall on the same time? I know Shorewall is just a frontend of iptables. But I don't know whether cause a conflict.
Also, I need to block tons of addresses, so ipset is the perfect solution. Is it safe to use all these three firewalls?
As you said :
Shorewall is just a frontend of iptables
So, in your opinion, what could be a very good reason to use both ?
Furthermore, ipsets can be used with pure iptables, but Shorewall also supports ipsets : http://www.shorewall.net/ipsets.html
So, i would say : use iptables OR Shorewall (as front-end).
Using both makes no sense.
Shorewall and ipsets are totally complementary, shorewall is like is said above a front-end tool to manage iptables correctly. Ipsets is a tool to whitelist/blacklist big sets of ips much more efficiently, so they are can work together and mostly all sysadmin, that I know, recommend it.
The main consideration to be taken care of, is that in order to get shorewall working with ipsets, your kernel needs to support ipset match (IPSET_MATCH). To check if your server has support for it, run:
$ shorewall show -f capabilities | grep IPSET_MATCH
you should see:
IPSET_MATCH=Yes
In order to being able to use shorewall with ipset. This support depends totally on your kernel and your OS.
My experience was that, in order to make it working, I need to update iptables and ipset package to the last version:
iptables v1.6.0
ipset v6.27, protocol version: 6
because in that version the support to ipset match is added by the package. You can read the changelog of ipset. But it is possible that your kernel already support it. As this package version are not in Jessie repository (at this moment at least), I needed to install them from testing repository, which is not the most recommendable approach, but it worked perfectly.
