Re: Syncing iptables rules between two servers

Hi,

On Sun Apr 09 2006, Lars Solberg <sunberg@xxxxxxxxx> wrote:
Hi

Is there anyone that know about how I can "sync" iptables rules on two
different servers? The plan is to have (on one of the servers) a
script that automaticly block ip adresses with iptables depending on
different conditions. When that ip adress is blocked I want it to
automaticly be blocked on another server to.

Not that I am aware of, but I suppose when you're running something like
portsentry, you could rsync the blocked files (heck, if you keep a
logfile anyways of blocked ip addresses...) between the servers and have
a script/trigger/cronjob running in the background checking for changes
in the files and grabbing the last added ipaddresses and dump it into an
iptables -A INPUT -J DROP -i [iface] -s [ip] kinda rule.

One idea is to change the script that is adding the block rule to
iptables to make it soo it can send the rule to the other server, but
this is not an option, the iptables rules must be synced after the
iptables rule have been added.

rsync... but you would have a bit of a time delay, I guess you want it
realtime? You need some way of notifying a background process that an IP
has been added.

Cook up a small C/S program and have your program/script which creates
the actual drop statement to send out a ping to the other program which
needs to update the rules?

Another idea is to get the iptables to use an sql database of some
sort to load the rules, but I dont know how, and this whould be
somehow ruining the whole thing of having a firewall if you make it
dependent an sql server (i think).. But afterall, if this is possible
this is option.

What's the problem of having your firewall be dependent on a sql server?
flatfile based sql engines would be great, mysql can be great, any other
flavour of sql engine could be great. Just make sure it doesn't listen
to the outside world and lock down access to 1 ip address'n'stuff like
that.

(and probably make sure the server starts before you init the firewall
scripts? Or have the firewall script run in two stages.. at start up
block all traffic, after everything has been fired up... let it grab the
additional rules from the sql server and build up the firewall into the
eh, last known state)

Any ideas?
Hope someone can help out..

Just some ideas, no real code or scripts to support my ideas, but they
sound easy enough to implement :)

When you already have logfiles of blocked ip's, a little scripting can
get you a long way.

If you really want to sync iptable rules which go beyond simple IP
blocking, eh.. you just need a bit more scripting and cook up your own
protocol / syntax for transporting the correct commands to the other
firewall.

Thanks
Lars

Cheers,

Gerald

Relevant Pages

  • Re: MS Security CD, wsh topic buried, non automated post (promise)
    ... Their stuff is for server is seems. ... you most likely want to script your 'access'. ... the firewall still inserted stuff in about every ... > Saying that you network drives may cease working. ...
    (microsoft.public.scripting.wsh)
  • Re: RFC: my firewall ruleset(s)
    ... IPFW numbers rules that increment by 1. ... > The reasoning behind this is so I have a single firewall script for all ... Depending on the rc.conf entries on that server, the firewall ...
    (freebsd-questions)
  • RE: NETFW.INF, Preconfigured Firewall settings and dialogs
    ... You want to pre-configure lots of the firewall settings ... some ports are open by default and others ... has a NETFW.INF that includes all the normal Server 2003 services. ... For this issue, the function can be fulfilled by using script, if you want ...
    (microsoft.public.windows.server.networking)
  • Re: Syncing iptables rules between two servers
    ... rules separate and distinct from the rest of your firewall rules. ... So call them what you want, but on host A and host B have: ... Is there anyone that know about how I can "sync" iptables rules on two ... automaticly be blocked on another server to. ...
    (Security-Basics)
  • Re: Remote MySQL Server
    ... The server with the script is on an outside network, ... $open = mysql_select_db($database, $connection) ... One obvious problem could be the firewall. ...
    (comp.lang.php)