Firewall change control

Question

At the moment I'm using a Python script to generate iptables rules. Each set of changes gets committed to a git repository before deployment so there's a trace of who changed what and why.

What tools/processes do other people use to manage changes to their firewall rules? Is there a guide on best practice for firewall change control that anyone likes?

UPDATE: I guess what I'm asking is for tools/processes around the area. For instance I find testing large firewall scripts quite difficult. Anyone use/written a test script or know of a unit testing type approach that's possible with iptables?

Answer 1

You could use a higher-level software that generates iptables rules, like shorewall. It has a command 'shorewall check' that checks the consistency and errors in your rules.

Answer 2

I don't think change control for firewalls is much different than for anything else, so standard source control would work. Use git or svn and automate the checkins in your script.

Answer 3

Standard source control tools are likely perfectly adequate for this. One thing you might also consider if you're automating this is adding validity checks (like the 'shorewall check' Luc mentioned) to your checkin hooks to provide a level of protection against deploying a bad config.