2

There is a complex live system - few vlans. In each of them there are linux servers, and on every server there are services. Services connect together - for example service http on host A connect to service mysql on host B to port 3306/tcp.

I would like to automated mapping this type of configuration to a database and create firewall rules for each server - to allow only necessary connections between hosts.

I thought about:

  • getting list of connections using netstat on each server (or logging connections from iptables?), and then putting it into database,
  • visualise it using graphvis or something like it,
  • create firewall rules based on rules from database
  • create iptables rule to log connections which doesn't fit to previous rules and warn about them.

Is something what can be do better/faster/more automate way? Maybe there is no need to reinventing the wheel?

update: "hard" part is not creating firewall rules, but automated creating , and then manager list of needed connections.

3

In my opinion your best bet will be to use a configuration management tool like Puppet, Chef, CFEngine or Ansible so you can define your policies based on the host type and apply it to any new host.

  • ok - but i would like to do that more automated way - without writing "by hand" ansible/puppet rules. I don't know how system works - i would like to create rules more "live" - with information when system behaviour change (for example when server A instead connecting only to server B/mysql start to connect to server C/ssh) – undefine Mar 30 '15 at 8:38
2

Some time ago I used ferm and a custom and simple bash script to generate rulesets and insert it in the correct order vía "include" directive in ferm.

If you want logging connections, etc... you can use ulog-mysql, and save specific data matched with a specific iptables rule in mysql and graph whatever you want from this point forward.

Another possibility is use a iptables role in ansible, probably you'll find the better role for your scenary.

1

Consider to use fwbuilder (http://www.fwbuilder.org/). It's an opensource tool that manage a sort of kinds of firewall.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.