Firewalls - Ease of Use and Maintenance?

Jonathan Lassoff jof at thejof.com
Thu Nov 10 16:30:46 UTC 2011


On Wed, Nov 9, 2011 at 12:44 PM, Nick Hilliard <nick at foobar.org> wrote:
> On 09/11/2011 19:07, C. Jon Larsen wrote:
>>
>> put the main portion of the conf in subversion as an include file and
>> factor out local differences in the configs with macros that are defined
>> in
>> pf.conf
>>
>> Easy.
>
> As I said, it's not a pf problem.  Commercial firewalls will do all this
> sort of thing off the shelf.  It's a pain to have to write scripts to do
> this manually.

Agreed. This is rather a pain to have to do manually each time (either
scp'ing or scripting). It's unfortunate that there's not a
conventional script or mechanism for doing this.

I have plenty of scripts from past commercial work that do this, but
they're sadly tied up license-wise.

I've had good luck, pf-wise, with creating a ruleset that is just
identical between hosts. By keeping the interface naming/numbering
scheme consistent across two hosts, the same configuration can just
"work" on both.

Cheers,
jof




More information about the NANOG mailing list