Firewall builder


 



Firewall Builder
I built this little tool back in the late-1900s when I started hosting
ary.com, it has served me well over the years.

Configuring firewalls is a critical operation since one mistake can allow
public access to vulnerable systems.  Command line firewall configuration is 
mistake prone due to the tedious nature of firewalls and the lack of 
understanding of network traffic and how firewalls work. A single blocking may
require several actual rules.  The firewall's flexibility acts to be it's own
worst enemy since it complicates configuration, increasing the incidence of 
errors.

When building a firewall tool you must be familiar with the IPTABLES Transition table.

Firewall builder is addressed to this premise.

Firewall builder is a simple way to build an iptables firewall without needing
to understand the ins and outs of iptables.  To this end, we have defined a 
"firewall builder language" to describe what we want done.

It is assumed that Firewall builder will stop any packet that we don't
specifically allow.

We are only interested in IP and it's sub-protocols since others are blocked by
the firewall.
Firewall builder language contains a number of keywords each followed by a 
consistent set of arguments.

All but the NIC and CIDR keywords (defines) have the same argument list in
the same order. 
Arguments are frequently omitted but they are always in the same order.
In general, the more arguments present, the more we restrict the group of
packets the rule affects.
A crunch '#' (poundsign) denotes a comment contained in the remainder of the
line, hence may follow a keyword argument set.
The firewall definition is in a file with the extension of '.def' and contains 
the rules governing packet flow through the firewall.




Argument List:
	[ifc] [proto] [cidr] [:port] [TO [ifc] [cidr] [:port]]
The arguments are broken int two sets of 4.
The elements of each set are:
The 1st set are normally source description set followed by 'TO' and the 
destination set.  Please note the destination set is identical to the source 
set with 'proto' (protocol) omitted.




Key Words:
IPTABLES TRANSITION DIAGRAM