Re: How to manage a firewall script with minor tweaks for different machines?
On 6/12/2021 6:02 PM, Anssi Saari wrote:
I've recently setup nftables firewalls on the machines of my little home
network. I was a little optimistic and thought I could get by with a
simple one that only allows ssh and nfs in i.e. two TCP ports and mDNS
with its slightly more complex rules.
But then... One machine has a radius server that needs UDP port 1812
open. And another is a print server with CUPS and SMB which apparently
need at least TCP ports 631 and 137 open.
How could I neatly incorporate these minor tweaks in a single nft
script? I was thinking of git branches where I can make changes to the
"main" firewall and merge those changes to the slightly tweaked
branches. Or possibly also some preprocessor type of thing that
generates three versions of the firewall script. Or just generate the
whole nft scripts with the small variants. Just wondering what other
people are doing with this sort of thing?
I also need some way of pushing these firewall scripts and other config
stuff over to the machines too. It's not a huge network but manually
logging into each machine, overwriting /etc/nftables.conf and restarting
nftables.service is a pain. cdist looks interesting and simple, does
anyone have experience with it?
You could have one common file that includes a custum file (1).
You would have one custum file per host (custum-cups, custum-smb ...).
This approach would require to always push two files(common and
custum-*) using SSH for example.
To automate that pushing step and reloading of the rules, you would have
to create a litle script that would do that based on argument:
$ push.sh cups
$ cat push.sh
#!/bin/sh
case $1 in
cups)
remote_ip = '<REMOTE-IP-OF-CUPS-SERVER>'
scp common-cups custum $remote_ip:<REMOTEPATH>
;;
smb)
remote_ip = '<REMOTE-IP-OF-SMB-SERVER>'
scp common custum-smb $remote_ip:<REMOTEPATH>
;;
esac
ssh $server_ip "<REMOTE-COMMAND-TO-EXECUTE>"
Note 1: I'm not using nftables, so I don't know the actual command to
reload your newly pushed config nor the location for the rules files! :)
Note 2: The script is an example only and should not be used as such.
HTH.
1) https://wiki.nftables.org/wiki-nftables/index.php/Scripting
--
John Doe
Reply to: