2

My use case is that I deploy arch-linux servers with different services running depending on customer requirements. The services are application specific running on custom ports but for the argument lets say its FTP, WEB and WEB SSL that can be used. In any combination.

For each service I have a custom package that installs that specific service and to make it easy I would like the package to also install an iptables rule making it possible to use the service.

So, by default I want to have a rule that denies everything except SSH. Then when I install for example the WEB package I want that package to install a file containing a rule to open port 80. The FTP package port 21 and so on.

However, I can only see that iptables have built in support for one file in total via the iptables-restore/save utilities.

I could write my own utility that reads several files and manually interact with iptables. But I feel that this must be a "common enough" use case and that such utility surely must exist. However, my google skills did not do me any good this time :)

Basically what I want is to have a folder, say /etc/iptables.d where I can place files 15-http, 10-ftp, 20-ssl. etc where the files and there rules are applied according to the number in the file name.

1 Answer 1

1

You could install ufw on your devices. It has support for defining apps through configuration files (you tell it which ports to open in the file) and then you can enable them (make the firewall take it into account) by running a command.

Make your packages depend on ufw, drop a file in /etc/ufw/applications.d and then using a post-install hook run ufw allow <app name> to enable the rules.

Shorewall seems to be an even advanced front-end for IPtables and I'm sure it would support what you are trying to do. I recommend you check out its documentation and see if it would be a better fit.

2
  • My sincere apology for not accepting this answer until now. I thought I had but must have forgotten. The solution you outline with ufw seems simple and straightforward. Thanks.
    – tkarls
    Feb 8, 2017 at 13:46
  • @tkarls it's alright, don't worry. :) Feb 8, 2017 at 14:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .