At the moment I'm using a Python script to generate iptables rules. Each set of changes gets committed to a git repository before deployment so there's a trace of who changed what and why.

What tools/processes do other people use to manage changes to their firewall rules? Is there a guide on best practice for firewall change control that anyone likes?

UPDATE: I guess what I'm asking is for tools/processes around the area. For instance I find testing large firewall scripts quite difficult. Anyone use/written a test script or know of a unit testing type approach that's possible with iptables?

3 Answers 3


You could use a higher-level software that generates iptables rules, like shorewall. It has a command 'shorewall check' that checks the consistency and errors in your rules.

  • Now that does look interesting! I'll be giving this one a good read. Thanks! Commented Aug 25, 2010 at 17:17

I don't think change control for firewalls is much different than for anything else, so standard source control would work. Use git or svn and automate the checkins in your script.

  • That's what I figured. At the moment the script we use commits the changes to git, uploads firewall rules to the specified firewall server and runs in the changes so it's all fairly robust. Just seems like it could be better? Commented Aug 25, 2010 at 12:34

Standard source control tools are likely perfectly adequate for this. One thing you might also consider if you're automating this is adding validity checks (like the 'shorewall check' Luc mentioned) to your checkin hooks to provide a level of protection against deploying a bad config.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .