Re: [gentoo-amd64] Re: KISS firewall not working on Gentoo Hardened

[Sebastian Redl <sebastian.redl@getdesigned.at>]

Duncan wrote:
> "P.V.Anthony" <pvantony@singnet.com.sg> posted
> 470438AA.8040502@singnet.com.sg, excerpted below, on  Thu, 04 Oct 2007
> 08:49:46 +0800:
>
>   
>> I was trying to get the KISS firewall working on Gentoo Hardened amd64.
>>     
> Personally, I tried a number of different firewall scripts, but wasn't 
> really satisfied with any of them.  Most of them tried to do too much -- 
> they had all sorts of config options for configuring big commercial 
> networks, options for shutting off net access to a specific segment of 
> the internal network at a specific time, for instance.  I didn't /need/ 
> that sort of complex configuration, and it only made things more 
> confusing, not less.
>
> At the same time, stuff that should have been simple ended up hugely 
> complex.  I was never sure which modules I needed for which options, and 
> since I was configuring scripts that did the actual configuring of the 
> IPTables based firewall, when something didn't work, I was never quite 
> sure whether it was the script, or a bug in the kernel, or a missing 
> module, or my mistake, or...  Well, I'm sure you can identify right about 
> now! =8^(
>   
I have to disagree with this evaluation. In several years, I found that
shorewall makes simple things simple, and difficult things I've never
tried. My network is really, really simple: a
firewall/fileserver/everything with a slightly defective keyboard that I
carry a screen to when it doesn't work, plus a number of other computers
(one desktop, three laptops, usually) for various family members. The
firewall mainly does three things:
1) Block everything except a few services from the outside.
2) NAT.
3) A few direct port forwards to the desktop computer.

Configuring this is easy enough in IPTables (I did learn them somewhat,
out of interest, though I've forgotten a lot, too), but it's really,
really easy in shorewall.

In all the years I've used Gentoo now, I can only say that I'm highly
satisfied with the program. The only negative point I can find is that
it always wants to overwrite all the configuration files on an upgrade.

Sebastian Redl

-- 
gentoo-amd64@gentoo.org mailing list