Creating rules without the /sbin/iptables command?

Creating rules without the /sbin/iptables command?

[Victor Julien]

Hi,

I'm writing a tool for creating a rulesset. It's meant for users who do 
understand the way a firewall works, but don't have any 
netfilter-specific knowledge. It can output a bash-script or create the 
rules itself.

My program (written in c) creates rules by opening a pipe to 
/sbin/iptables. However this is quite slow with large rulessets and on 
slow hardware. Is there another way, like an iptables librarycall or 
something? I'm going to release the tool under the GPL soon, so that 
shouldn't be a problem.

Regards,
Victor

Re: Creating rules without the /sbin/iptables command?

[Cedric Blancher]

Le mer 17/03/2004 à 19:46, Victor Julien a écrit :
> My program (written in c) creates rules by opening a pipe to 
> /sbin/iptables. However this is quite slow with large rulessets and on 
> slow hardware. Is there another way, like an iptables librarycall or 
> something?

You could use iptables libs that stand in /usr/lib/iptables, just like
iptables does.

You should however ask netfilter developpers mailing list.

Cc : netfilter-devel@lists.netfilter.org

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: Creating rules without the /sbin/iptables command?

[Victor Julien]

Hi Cedric,

Okay, thanx i will do that. I thought that netfilter-devel was only for 
development of netfilter itself. My bad ;)

By the way, are the iptables libs in /usr/lib/iptables meant for use by 
third party tools, or is this considered a dirty hack?

Regards,
Victor

Cedric Blancher wrote:
> Le mer 17/03/2004 à 19:46, Victor Julien a écrit :
> 
>>My program (written in c) creates rules by opening a pipe to 
>>/sbin/iptables. However this is quite slow with large rulessets and on 
>>slow hardware. Is there another way, like an iptables librarycall or 
>>something?
> 
> 
> You could use iptables libs that stand in /usr/lib/iptables, just like
> iptables does.
> 
> You should however ask netfilter developpers mailing list.
> 
> Cc : netfilter-devel@lists.netfilter.org
> 

Re: Creating rules without the /sbin/iptables command?

[Cedric Blancher]

Le mer 17/03/2004 à 21:59, Victor Julien a écrit :
> Okay, thanx i will do that. I thought that netfilter-devel was only for 
> development of netfilter itself. My bad ;)

No, you can discuss third party tools development around iptables stuff
also.

> By the way, are the iptables libs in /usr/lib/iptables meant for use by 
> third party tools, or is this considered a dirty hack?

They are meant to be used by iptables itself. But you can use them with
your own soft. That's no dirty hack.

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: Creating rules without the /sbin/iptables command?

[Henrik Nordstrom]

On Wed, 17 Mar 2004, Cedric Blancher wrote:

> Le mer 17/03/2004 à 19:46, Victor Julien a écrit :
> > My program (written in c) creates rules by opening a pipe to 
> > /sbin/iptables. However this is quite slow with large rulessets and on 
> > slow hardware. Is there another way, like an iptables librarycall or 
> > something?
> 
> You could use iptables libs that stand in /usr/lib/iptables, just like
> iptables does.

Or actually the preferred interface for this type of operations is to use 
iptables-restore, the batch version of iptables. The speed difference from 
using iptables-restore and direct calls is pretty minimal by any means.

libiptc is an internal interface of the iptables source tree and is
subject to change at any time. This should not be used directly unless you 
have very good reasons.

Regards
Henrik

Re: Creating rules without the /sbin/iptables command?

[John A. Sullivan III]

On Wed, 2004-03-17 at 14:25, Cedric Blancher wrote:
> Le mer 17/03/2004 à 19:46, Victor Julien a écrit :
> > My program (written in c) creates rules by opening a pipe to 
> > /sbin/iptables. However this is quite slow with large rulessets and on 
> > slow hardware. Is there another way, like an iptables librarycall or 
> > something?
> 
> You could use iptables libs that stand in /usr/lib/iptables, just like
> iptables does.
> 
> You should however ask netfilter developpers mailing list.
> 
> Cc : netfilter-devel@lists.netfilter.org
The above solution is probably better than mine but I write out my new
rules to a file in iptables-save format and then use iptables-restore -n
<filename>.  This is dramatically faster than calling iptables - John
-- 
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net