There is a complex live system - few vlans. In each of them there are linux servers, and on every server there are services. Services connect together - for example service http on host A connect to service mysql on host B to port 3306/tcp.
I would like to automated mapping this type of configuration to a database and create firewall rules for each server - to allow only necessary connections between hosts.
I thought about:
- getting list of connections using netstat on each server (or logging connections from iptables?), and then putting it into database,
- visualise it using graphvis or something like it,
- create firewall rules based on rules from database
- create iptables rule to log connections which doesn't fit to previous rules and warn about them.
Is something what can be do better/faster/more automate way? Maybe there is no need to reinventing the wheel?
update: "hard" part is not creating firewall rules, but automated creating , and then manager list of needed connections.