Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

At the moment I'm using a Python script to generate iptables rules. Each set of changes gets committed to a git repository before deployment so there's a trace of who changed what and why.

What tools/processes do other people use to manage changes to their firewall rules? Is there a guide on best practice for firewall change control that anyone likes?

UPDATE: I guess what I'm asking is for tools/processes around the area. For instance I find testing large firewall scripts quite difficult. Anyone use/written a test script or know of a unit testing type approach that's possible with iptables?

share|improve this question
up vote 0 down vote accepted

You could use a higher-level software that generates iptables rules, like shorewall. It has a command 'shorewall check' that checks the consistency and errors in your rules.

share|improve this answer
Now that does look interesting! I'll be giving this one a good read. Thanks! – Geoff Childs Aug 25 '10 at 17:17

I don't think change control for firewalls is much different than for anything else, so standard source control would work. Use git or svn and automate the checkins in your script.

share|improve this answer
That's what I figured. At the moment the script we use commits the changes to git, uploads firewall rules to the specified firewall server and runs in the changes so it's all fairly robust. Just seems like it could be better? – Geoff Childs Aug 25 '10 at 12:34

Standard source control tools are likely perfectly adequate for this. One thing you might also consider if you're automating this is adding validity checks (like the 'shorewall check' Luc mentioned) to your checkin hooks to provide a level of protection against deploying a bad config.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.