There is a complex live system - few vlans. In each of them there are linux servers, and on every server there are services. Services connect together - for example service http on host A connect to service mysql on host B to port 3306/tcp.

I would like to automated mapping this type of configuration to a database and create firewall rules for each server - to allow only necessary connections between hosts.

I thought about:

  • getting list of connections using netstat on each server (or logging connections from iptables?), and then putting it into database,
  • visualise it using graphvis or something like it,
  • create firewall rules based on rules from database
  • create iptables rule to log connections which doesn't fit to previous rules and warn about them.

Is something what can be do better/faster/more automate way? Maybe there is no need to reinventing the wheel?

update: "hard" part is not creating firewall rules, but automated creating , and then manager list of needed connections.

3 Answers 3


In my opinion your best bet will be to use a configuration management tool like Puppet, Chef, CFEngine or Ansible so you can define your policies based on the host type and apply it to any new host.

  • ok - but i would like to do that more automated way - without writing "by hand" ansible/puppet rules. I don't know how system works - i would like to create rules more "live" - with information when system behaviour change (for example when server A instead connecting only to server B/mysql start to connect to server C/ssh)
    – undefine
    Mar 30, 2015 at 8:38

Some time ago I used ferm and a custom and simple bash script to generate rulesets and insert it in the correct order vía "include" directive in ferm.

If you want logging connections, etc... you can use ulog-mysql, and save specific data matched with a specific iptables rule in mysql and graph whatever you want from this point forward.

Another possibility is use a iptables role in ansible, probably you'll find the better role for your scenary.


Consider to use fwbuilder (http://www.fwbuilder.org/). It's an opensource tool that manage a sort of kinds of firewall.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .