Firewalls - Ease of Use and Maintenance?
Jonathan Lassoff
jof at thejof.com
Thu Nov 10 16:30:46 UTC 2011
On Wed, Nov 9, 2011 at 12:44 PM, Nick Hilliard <nick at foobar.org> wrote:
> On 09/11/2011 19:07, C. Jon Larsen wrote:
>>
>> put the main portion of the conf in subversion as an include file and
>> factor out local differences in the configs with macros that are defined
>> in
>> pf.conf
>>
>> Easy.
>
> As I said, it's not a pf problem. Commercial firewalls will do all this
> sort of thing off the shelf. It's a pain to have to write scripts to do
> this manually.
Agreed. This is rather a pain to have to do manually each time (either
scp'ing or scripting). It's unfortunate that there's not a
conventional script or mechanism for doing this.
I have plenty of scripts from past commercial work that do this, but
they're sadly tied up license-wise.
I've had good luck, pf-wise, with creating a ruleset that is just
identical between hosts. By keeping the interface naming/numbering
scheme consistent across two hosts, the same configuration can just
"work" on both.
Cheers,
jof
More information about the NANOG
mailing list