Fwd: Critque of IPTables Firewall

Fwd: Critque of IPTables Firewall

[Idgarad]

[-- Attachment #1: Type: text/plain, Size: 498 bytes --]

There are many guides on how to write a firewall script functionally,
but form is disregarded. Is the following a decent, well written
firewall (Form, not function)? It's is clear and easy to follow? In
the event that I get hit by a bus would someone else with IPTables
experience be able to pick up where I left off?

Has anyone from the Netfilter's list thought about writing a
Best-Practices guide not from the functional side, but rather the form
side of writing IPTABLES scripts and what not?

[-- Attachment #2: firewall.sh --]
[-- Type: application/x-sh, Size: 22602 bytes --]

Re: Fwd: Critque of IPTables Firewall

[Gáspár Lajos]

Idgarad írta:
> There are many guides on how to write a firewall script functionally,
> but form is disregarded. Is the following a decent, well written
> firewall (Form, not function)? It's is clear and easy to follow? In
> the event that I get hit by a bus would someone else with IPTables
> experience be able to pick up where I left off?
Hopefully an experienced firewall professional would understand it... :)
Not because it is too complicated but not everyone uses the same 
programing technics and style.

> Has anyone from the Netfilter's list thought about writing a
> Best-Practices guide not from the functional side, but rather the form
> side of writing IPTABLES scripts and what not?
Well... I published my firewall script two months before...
( https://lists.netfilter.org/pipermail/netfilter/2006-August/066404.html )

Let me quote Jan Engelhardt's reply:

"No one ever reads through that mess, really. There are so many scripts floating
around, the number is just too outstanding, and it makes tired after a while.

Jan Engelhardt"

Well... I think this is okay but anyway I would be glad if a guide would exist.
So I am a bit interested ...
 


For example I would propose the following format:

iptables -t <table> <command> -j <jump_target> [filters]

table: mangle, nat, filter...
command: -A, -I, -P...
jump_target: ACCEPT, DROP ...
filters: -p tcp, -p tcp -s 192.168.0.1....

There could be other rules like separating the tables and so on...

Swifty