I use Shorewall and Shorewall-lite. On the master server I have the following arrangement:
- /etc/shorewall - firewall configuration for the server
- /etc/shorewall/common - common files such as standard zone definitions, policies, macros, etc.
- /etc/shorewall/hostname - definition for each host.
Using the common directory allows me to avoid repeating definitions for each server. The config file has a path variable which can be used to specify a list of directories containing common files. If you have a lot of servers with the same rule set you could place the rules in the common
directory, or a different shared directory for that class of servers.
I use make
to build the firewall scripts firewall
and firewall.conf
. These are then distributed and executed using ssh
.
I've tried some of the graphical firewall builders, but find shorewall with its config files easier to work with and verify. I keep the whole configuration directory in git
to allow me to easily verify changes before implementation.