Firewall section - Revision history

Saruman!: added config example

2008-07-19T15:44:38Z

added config example

← Older revision		Revision as of 15:44, 19 July 2008
Line 15:		Line 15:
	* Iceditch is based on a single Bash script and some configuration files, and thus has a fairly simple '''[[Iceditch file structure \| file structure]]'''.		* Iceditch is based on a single Bash script and some configuration files, and thus has a fairly simple '''[[Iceditch file structure \| file structure]]'''.
	* For full reference, we've created this '''[[Iceditch Command Reference]]'''.		* For full reference, we've created this '''[[Iceditch Command Reference]]'''.
			* Here is an [[Iceditch configuration example]]

	Now, obviously there are many more firewalls to choose from, ranging from advanced [http://www.shorewall.net/ \| configure-it-yourself firewall] to [http://www.smoothwall.org/ pret-a-porter OS-and-firewall-into-one] solutions (and we're not even starting on proprietary solutions, be they hardware and/or software). The main reason for us to create our own firewall script (besides the obvious reasons of fun and learning) is [[Iceditch design targets \| flexibility]].		Now, obviously there are many more firewalls to choose from, ranging from advanced [http://www.shorewall.net/ \| configure-it-yourself firewall] to [http://www.smoothwall.org/ pret-a-porter OS-and-firewall-into-one] solutions (and we're not even starting on proprietary solutions, be they hardware and/or software). The main reason for us to create our own firewall script (besides the obvious reasons of fun and learning) is [[Iceditch design targets \| flexibility]].

	Should you be in any way interested in this project of ours, feel free to [mailto:iceditch@saruman.biz contact us].		Should you be in any way interested in this project of ours, feel free to [mailto:iceditch@saruman.biz contact us].

Saruman!: Jump page rewrite

2008-07-14T19:25:28Z

Jump page rewrite

← Older revision		Revision as of 19:25, 14 July 2008
Line 2:		Line 2:
	You may not have realised it, but Linux comes with an incredible powerful and flexible [http://searchnetworking.techtarget.com/sDefinition/0,,sid7_gci214173,00.html TCP/IP] [http://www.tech-faq.com/firewall.shtml packet filtering firewall], named [http://www.netfilter.org/ Netfilter]. With a minimum amount of effort, we can create just about any packet filter you can imagine. The Linux solution is so powerful, even commercial firewall vendors like [http://www.watchguard.com/ Watchguard] use it in their products. In fact, Watchguard has paid the main developer early on in the project (see [http://www.netfilter.org/about.html here]).		You may not have realised it, but Linux comes with an incredible powerful and flexible [http://searchnetworking.techtarget.com/sDefinition/0,,sid7_gci214173,00.html TCP/IP] [http://www.tech-faq.com/firewall.shtml packet filtering firewall], named [http://www.netfilter.org/ Netfilter]. With a minimum amount of effort, we can create just about any packet filter you can imagine. The Linux solution is so powerful, even commercial firewall vendors like [http://www.watchguard.com/ Watchguard] use it in their products. In fact, Watchguard has paid the main developer early on in the project (see [http://www.netfilter.org/about.html here]).

	To create a truly magnificent firewall, there are many [[Firewall problems \| problems]] ~~to overcome; however~~, the SaruWiki admin team have created their own "solution" to these problems: the Iceditch firewall script. ~~It handles~~ the many problems firewalls face ~~with~~ the following elements:		However, to create a truly magnificent firewall, there are many problems to overcome; we'll discuss them in this section:<br>
	* Iceditch defines a [[Iceditch IPtables language \| "language"]] to more easily read & write IPtables commands; this mainly solves the problems of auditability (partly) and eases maintainability, although it does not by itself solve the problem of documentation.		'''[[Firewall problems \| Generic discussion on firewall problems]]'''.
	* It offers a standardised way to start the firewall at boot time;
	* ~~It offers a way~~ to audit the firewall, both while it's running and when you've edited (but not yet implemented) it;		Fortunately for YOU, my friend, the SaruWiki admin team have created their own "solution" to these problems: the Iceditch firewall script.
	* ~~It offers~~ a reasonably failsafe way to change firewall settings from afar.
			By consistent focus on a small set of '''[[Iceditch design targets \| sensible design targets]]''', we feel we've succeeded in creating a firewall script that alleviates most of the many problems firewalls face. Our Iceditch solution has the following elements and properties:
			* Iceditch defines a '''[[Iceditch IPtables language \| "language"]]''' to more easily read & write IPtables commands; this mainly solves the problems of auditability (partly) and eases maintainability, although it does not by itself solve the problem of documentation.
			* It offers '''[[Iceditch functionality \| much functionality]]''', like
			** a standardised way to start the firewall at boot time,
			** ways to audit the firewall, both while it's running and when you've edited (but not yet implemented) it,
			** a reasonably failsafe way to change firewall settings from afar.
			* Iceditch is based on a single Bash script and some configuration files, and thus has a fairly simple '''[[Iceditch file structure \| file structure]]'''.
			* For full reference, we've created this '''[[Iceditch Command Reference]]'''.

			Now, obviously there are many more firewalls to choose from, ranging from advanced [http://www.shorewall.net/ \| configure-it-yourself firewall] to [http://www.smoothwall.org/ pret-a-porter OS-and-firewall-into-one] solutions (and we're not even starting on proprietary solutions, be they hardware and/or software). The main reason for us to create our own firewall script (besides the obvious reasons of fun and learning) is [[Iceditch design targets \| flexibility]].

			Should you be in any way interested in this project of ours, feel free to [mailto:iceditch@saruman.biz contact us].

Saruman!: Iceditch introduction started

2008-06-22T20:43:31Z

Iceditch introduction started

New page

==Firewalling under Linux==
You may not have realised it, but Linux comes with an incredible powerful and flexible [http://searchnetworking.techtarget.com/sDefinition/0,,sid7_gci214173,00.html TCP/IP] [http://www.tech-faq.com/firewall.shtml packet filtering firewall], named [http://www.netfilter.org/ Netfilter]. With a minimum amount of effort, we can create just about any packet filter you can imagine. The Linux solution is so powerful, even commercial firewall vendors like [http://www.watchguard.com/ Watchguard] use it in their products. In fact, Watchguard has paid the main developer early on in the project (see [http://www.netfilter.org/about.html here]).

To create a truly magnificent firewall, there are many [[Firewall problems | problems]] to overcome; however, the SaruWiki admin team have created their own "solution" to these problems: the Iceditch firewall script. It handles the many problems firewalls face with the following elements:
* Iceditch defines a [[Iceditch IPtables language | "language"]] to more easily read & write IPtables commands; this mainly solves the problems of auditability (partly) and eases maintainability, although it does not by itself solve the problem of documentation.
* It offers a standardised way to start the firewall at boot time;
* It offers a way to audit the firewall, both while it's running and when you've edited (but not yet implemented) it;
* It offers a reasonably failsafe way to change firewall settings from afar.