Re: CONFIG_NETFILTER_ADVANCED

[Patrick McHardy <kaber@trash.net>]

Jan Engelhardt wrote:
> On Nov 17 2007 17:08, Patrick McHardy wrote:
>> Amos Jeffries wrote:
>>> Patrick McHardy wrote:
>>>>
>>>> I agree. It would be useful if some users of a distribution that
>>>> includes a firewall script could check which modules it requires.
>>>>
>>> All right.
>>> Here is the fairly common shorewall 3.4's default dependencies as taken from
>>> /usr/share/shorewall/modules .
>>> These are not likely to change per-system without a clueful administrator.
>> This looks like basically everything. What I'm looking for is a list of
> 
> The problem is: you never know when they gonna change it!
> 
> 
>> modules required for the firewall scripts included in SuSE, RH, ...
> 
> SUSE:
> 
> DNAT LOG MARK MASQUERADE REDIRECT REJECT TCPMSS esp
> icmp icmpv6 limit pkttype policy
> state tcp udp

Thanks. Any RH/Fedora users?

> But - surprise, surprise - it allows to load a file of custom rules,
> so that basically means {ipt,ip6t,xt}_*, aka allmodconfig, like I said!
> :)

Well, the point of the avanced option is to handle *advanced*
cases, so we don't need to cover manual adjustments (including
things like shorewall which are usually installed manually). The
default cases for people not having touched their *firewall*
configuration is enough. I wasn't able to find the SuSE-script,
but from a screenshot I could see that they do optionally handle
IPsec. So what I'm saying is that we should include f.i. the policy
match, and all other modules needed without manually attending
to the firewall, but nothing more.

IOW, its for people like Linus, presumably not touching their
default configuration, but unwilling to go through the 50+
options to decide themselves.

For people who want to compile-test them all (like me), we
still can have a CONFIG_NETFILTER_ALL option hidden under
CONFIG_NETFILTER_ADVANCED for simplicity, but that is a
different topic.