[gentoo-dev] NAT iptables info

[Donny Davies <woodchip@gentoo.org>]

Nope. Sorry. Im not in agreement in this at all. Of course, its open to debate,
Im not saying I know everything, nor Im 100% right. Go ahead, debate away.
But I dont want any part of it, Ill tell you that!

If you dont understand the ramnifications of packet filetering, NAT, etc then
you have *no* business running this software. We are not Microsoft or Wingate,
opening yuor machine to a wider world.

What if somebodys iptables script is made into an ebuild, and said script turns
out to be flawed, perhaps seriously? Then its "hey, yeah those guys at gentoo
have a firewall setup like swiss cheese.". What interfaces are yuo going to
configure this ebuild for? eth0 and eth1? how about ppp? maybe an isdn
interface? How do yuo choose? Im going to say this again, it is %100
configuration. This is *not* the domain of a package. It is the domain of
a system administrator. This is 1 file we're talking about here people, not
a series of docs, scripts, config files. *most* of them anyway. There *are*
some that come with external configs. But thats all beside the point. The
script needs to be edited. This whole thing started because we basically had
a post to the devel list of the flavour: "I need an iptables HOWTO".

What are you going to do about the kernel modules? Did you know that
the netfilter modules are built at the kernel level? How are you going to
DEPEND on that?

This is bad policy. A distribution should *not* be dictating *policy*. To
not understand that is a big mistake. Listen, Redhat and Mandrake are
the kinds of distros doing this stuff! Making Linux into a 1-click affair.
This is not our primary intention. Not at this stage anyway!

So feel free to debate it all you want, I wont be having *any* part in it
Ill tell you that!

Cheers!
--
Donny