Re: Syncing iptables rules between two servers



Hi Lars et al,

One thing that I would recommend if you go this way is to have these shared
rules separate and distinct from the rest of your firewall rules. So if
something goes wrong with the transfer, hopefully the rest of your firewall
will come up fine.

So call them what you want, but on host A and host B have:

/etc/init.d/firewall.host{A,B}
/etc/init.d/firewall.common

firewall.hostA and B does the standard initialisation of firewall modules,
sets table policies and sets the basic rules. They then set whatever rules
are appropriate to that host.

After this they call in the firewall.common file. They then continue with
the rest of their stuff.

The firewall.common file isn't named well in this example. It should NOT
contain all the common firewall definition: it should only contain the
automatically generated rules. If for some reason the transfer gets
botched, the firewall should be complete except for the blocked IPs.

I'm making a few assumptions here. First, I assume your policies are DROP
for anything not explicitly allowed (at least on the INPUT table, probably
on the FORWARD, maybe not on the OUTPUT table). Second, the rest of your
iptables rules don't change (why would they). Third, I forget what the rest
of my assumptions were.

Other people have said this but I would concur on use of 'rsync -ae ssh' to
keep them sync'd through ssh. Another slightly more complicated option, but
more secure and kind of neat, is the following:

If you are concerned about opening up root access between the boxes you may
be interested in using the "command" field of the authorized_keys file in
OpenSSH (see 'man sshd'). You could use this to set up a key that on the
receiving host may only be used to run a single command: in this case, a
script that accepts the blocked IP's over STDIN, pipes them to the
firewall.common file, does some basic sanity testing and then restarts
iptables using the new definition. Then you simply pipe the updated blocked
IPs to the ssh call: cat blocked_ips | ssh hostB. If it's properly set up
on hostB, this is basically all you need to do.

I like this way because then you don't have passwordless root access from
one host to another, except for this very limited context.


Hope that's of some use to you.
Drew.


Lars Solberg wrote:
Hi

Is there anyone that know about how I can "sync" iptables rules on two
different servers? The plan is to have (on one of the servers) a
script that automaticly block ip adresses with iptables depending on
different conditions. When that ip adress is blocked I want it to
automaticly be blocked on another server to.

One idea is to change the script that is adding the block rule to
iptables to make it soo it can send the rule to the other server, but
this is not an option, the iptables rules must be synced after the
iptables rule have been added.
Another idea is to get the iptables to use an sql database of some
sort to load the rules, but I dont know how, and this whould be
somehow ruining the whole thing of having a firewall if you make it
dependent an sql server (i think).. But afterall, if this is possible
this is option.

Any ideas?
Hope someone can help out..

Thanks
Lars

--
Drew Leske :: Systems Group/Unix, Computing Services, University of Victoria
dleske@xxxxxxx / +1250 472 5055 (office) / +1250 588 4311 (cel)



Relevant Pages

  • RE: Items within XP SP2 and Win2003
    ... The need to shut down additional services that are not used on a server ... since I will assume you have a border firewall ... I have no need for a host based firewall on my server ... I do agree that you should not be browsing the internet ...
    (Focus-Microsoft)
  • IPTable Rule to allow NTP thru ?
    ... I am hoping that someone can explain to me what I need to add or change to my firewall settings to allow ntp to synchronize to an outside time source. ... My objective is to have a server in my office synchronize to an outside time server, then the desktop PC's would synchronize to the server. ... It appears that the IPtables rules on the server is blocking the ntp communication. ...
    (comp.protocols.time.ntp)
  • RE: How to detect whether firewall service is provided by server or by ISP?
    ... generated by the host itself or the intermediate firewall. ... also help you identify how far away the responding host is. ... In the first case the router 10.2.2.1 responded with an ICMP TLL Exceeded ... How to detect whether firewall service is provided by server or by ...
    (Security-Basics)
  • Re: Syncing iptables rules between two servers
    ... Is there anyone that know about how I can "sync" iptables rules on two ... automaticly be blocked on another server to. ... What's the problem of having your firewall be dependent on a sql server? ... Or have the firewall script run in two stages.. ...
    (Focus-Linux)
  • Re: Marina Help! Cant send mail!
    ... I did create a new host, for the IP, that I'm ... not the internal IP assigned to the server. ... >> When you say firewall port 25, ... >> router and in front of our switch. ...
    (microsoft.public.windows.server.sbs)