16 Oct
2012
16 Oct
'12
1:07 p.m.
Hey there list,
I'd be grateful if someone could recommend please a front-end for iptables?
Arno's iptables seems well-regarded.
I've set up some basic iptables rules on my VPS that allow/block various
ports etc but want to be able to use iptable's state module too and would
like to use a script that's been proved through use.
Thanks in advance for any help/ideas.
Barry
16 Oct
16 Oct
1:08 p.m.
On 16/10/12 14:07, Barry Watson wrote:
Hey there list,
I'd be grateful if someone could recommend please a front-end for
iptables? Arno's iptables seems well-regarded.
I've set up some basic iptables rules on my VPS that allow/block
various ports etc but want to be able to use iptable's state module
too and would like to use a script that's been proved through use.
Thanks in advance for any help/ideas.
Barry
UFW
https://help.ubuntu.com/community/UFW
I like this
5:31 p.m.
On Tue, Oct 16, 2012 at 02:08:29PM +0100, Simon Bell wrote:
On 16/10/12 14:07, Barry Watson wrote:
I'm also using UFW, but my needs are extremely simple:
* block all ports except for 53 UDP.
* block all traffic to port 22 except for $IPs
UFW makes this *really* simple.
-Jeremy
Hey there list,
I'd be grateful if someone could recommend please a front-end for
iptables? Arno's iptables seems well-regarded.
I've set up some basic iptables rules on my VPS that allow/block
various ports etc but want to be able to use iptable's state
module too and would like to use a script that's been proved
through use.
Thanks in advance for any help/ideas.
Barry
UFW
https://help.ubuntu.com/community/UFW 
5:40 p.m.
I really like ufw, it's simple and does basic configuration great.
For more complicated setups, I've normally used shorewall, though not sure how well
that is currently supported. That said, I did use ufw the other week to setup a wireless
access point managed, that gave the administrator the ability to kick off MAC addresses
that were using too much bandwidth.
Regards,
Andy
On 16 Oct 2012, at 18:31, Jeremy Kitchen <kitchen(a)kitchen.io> wrote:
On Tue, Oct 16, 2012 at 02:08:29PM +0100, Simon Bell
wrote:
On 16/10/12 14:07, Barry Watson wrote:
I'm also using UFW, but my needs are extremely simple:
* block all ports except for 53 UDP.
* block all traffic to port 22 except for $IPs
UFW makes this *really* simple.
-Jeremy
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users Hey there list,
I'd be grateful if someone could recommend please a front-end for
iptables? Arno's iptables seems well-regarded.
I've set up some basic iptables rules on my VPS that allow/block
various ports etc but want to be able to use iptable's state
module too and would like to use a script that's been proved
through use.
Thanks in advance for any help/ideas.
Barry
UFW
https://help.ubuntu.com/community/UFW 
7:59 p.m.
On 16/10/2012 18:40, Andrew Loughran wrote:
For more complicated setups, I've normally used
shorewall, though not sure how well that is currently supported.
Another vote for shorewall here. Makes the bog-standard stuff pretty
straightforward, allows you to do more complicated stuff when you need
it. Still pretty well supported by the looks of things.
--
Phil Stewart
1:41 p.m.
Hi,
On Tue, Oct 16, 2012 at 3:07 PM, Barry Watson <barry.watson23(a)gmail.com> wrote:
I'd be grateful if someone could recommend please
a front-end for iptables?
Arno's iptables seems well-regarded.
I use ferm:
http://ferm.foo-projects.org/
Example config:
http://ferm.foo-projects.org/download/examples/webserver.ferm
Best regards,
Daniel
9:53 p.m.
On 16/10/12 14:41, � wrote:
Hi,
On Tue, Oct 16, 2012 at 3:07 PM, Barry Watson <barry.watson23(a)gmail.com> wrote:
I like ferm too. You still have to write some rules (in ferm's own
notation), but ferm takes away the tedious repetitiveness of doing it
all by hand.
cheers
Chris
--
Chris Dennis cgdennis(a)btinternet.com
Fordingbridge, Hampshire, UK
I'd be grateful if someone could recommend
please a front-end for iptables?
Arno's iptables seems well-regarded.
I use ferm:
http://ferm.foo-projects.org/
Example config:
http://ferm.foo-projects.org/download/examples/webserver.ferm 
7:04 p.m.
On 16/10/12 14:07, Barry Watson wrote:
Hey there list,
I'd be grateful if someone could recommend please a front-end for iptables?
Arno's iptables seems well-regarded.
vim :)
I've set up some basic iptables rules on my VPS
that allow/block various
ports etc but want to be able to use iptable's state module too and would
like to use a script that's been proved through use.
Thanks in advance for any help/ideas.
Barry
(sorry, couldn't resist)
Stuart
--
Stuart Sears RHCA etc.
"It's today!" said Piglet.
"My favourite day," said Pooh.
7:22 p.m.
On 16 October 2012 20:04, Stuart Sears <stuart(a)sjsears.com> wrote:
(sorry, couldn't resist)
Amar
(tekacs)
On 16/10/12 14:07, Barry Watson wrote:
He means emacs of course.
Hey there list,
I'd be grateful if someone could recommend please a front-end for
iptables?
Arno's iptables seems well-regarded.
vim :)
I've set up some basic iptables rules on my
VPS that allow/block various
ports etc but want to be able to use iptable's state module too and would
like to use a script that's been proved through use.
Thanks in advance for any help/ideas.
Barry
(sorry, couldn't resist)
Stuart
--
Stuart Sears RHCA etc.
"It's today!" said Piglet.
"My favourite day," said Pooh.
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
17 Oct
17 Oct
8:21 a.m.
On 16/10/12 20:22, Amar Sood wrote:
<shudders>
Surely noone ever *actually* means emacs? :) [fight! fight! fight!]
In all seriousness, though, I do write all my firewall rules in vim and
load them before the network starts, using the 'iptables-restore' command
RH-type distros already have an init script that does this for you.
Netfilter syntax really isn't that complicated and understanding it does
no harm. I would recommend learning it.
On 16 October 2012 20:04, Stuart Sears
<stuart(a)sjsears.com> wrote:
> On 16/10/12 14:07, Barry Watson wrote:
>>
>> Hey there list,
>>
>> I'd be grateful if someone could recommend please a front-end for
>> iptables?
>> Arno's iptables seems well-regarded.
okay, time to take this more seriously...
which distro are you running? many of them have their own tools already.
Do you want a graphical or CLI interface?
/me suspects CLI, but you never can tell
vim :)
He means emacs of course. >> I've set up some basic iptables rules on
my VPS that allow/block various
>> ports etc but want to be able to use iptable's state module too and would
>> like to use a script that's been proved through use.
How have you added the rules that you already use?
ip_conntrack state matching rules aren't particularly complicated
Most of those rules look a bit like the following
iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
- This is a general "allow stuff in if it's part of an existing or
related connection" rule (there are other options, like NEW or INVALID)
- it would be the first rule (because of the -I)
These rules can have protocol and port specifications, too.
It doesn't sound like you have very complex requirements.
My experience with netfilter frontends is they tend to err on the side
of complexity, certainly in terms of the rules they generate, with
multiple custom chains. I like my rules to be readable.
I also find that managing the rules with an editor allows me to add
comments where necessary (and/or use a VCS to permit rollback)
Yes, I realise this wasn't exactly what you asked for, but it Works For
Me (tm)
>> Thanks in advance for any help/ideas.
>>
>> Barry
Regards,
Stuart
--
Stuart Sears RHCA etc.
"It's today!" said Piglet.
"My favourite day," said Pooh.
9:19 a.m.
On 17 October 2012 09:21, Stuart Sears <stuart(a)sjsears.com> wrote:
On 16/10/12 20:22, Amar Sood wrote:
He means emacs of course.
<shudders>
Surely noone ever *actually* means emacs? :) [fight! fight! fight!]
In all seriousness, though, I do write all my firewall rules in vim and
load them before the network starts, using the 'iptables-restore' command
RH-type distros already have an init script that does this for you.
Netfilter syntax really isn't that complicated and understanding it does
no harm. I would recommend learning it.
I've set up some basic iptables rules on my VPS that allow/block various
Thanks for the replies all of you!
My VPS runs Debian Squeeze - I'm perfectly happy using the command line.
It's perfectly possible to write my own commands I suppose. It's just a
question of practicality - it's something else I should learn but in the
meantime (time is short) I'd be happy to use a script to configure a
firewall that I know would do the job.
Some good ideas here - I appreciate the help!
Thanks again,
Barry
On 16 October 2012 20:04, Stuart Sears
<stuart(a)sjsears.com> wrote:
> On 16/10/12 14:07, Barry Watson wrote:
>
>>
>> Hey there list,
>>
>> I'd be grateful if someone could recommend please a front-end for
>> iptables?
>> Arno's iptables seems well-regarded.
>>
>
okay, time to take this more seriously...
which distro are you running? many of them have their own tools already.
Do you want a graphical or CLI interface?
/me suspects CLI, but you never can tell
vim :)
>> ports etc but want to be able to use
iptable's state module too and
>> would
>> like to use a script that's been proved through use.
>>
>
How have you added the rules that you already use?
ip_conntrack state matching rules aren't particularly complicated
Most of those rules look a bit like the following
iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
- This is a general "allow stuff in if it's part of an existing or related
connection" rule (there are other options, like NEW or INVALID)
- it would be the first rule (because of the -I)
These rules can have protocol and port specifications, too.
It doesn't sound like you have very complex requirements.
My experience with netfilter frontends is they tend to err on the side of
complexity, certainly in terms of the rules they generate, with multiple
custom chains. I like my rules to be readable.
I also find that managing the rules with an editor allows me to add
comments where necessary (and/or use a VCS to permit rollback)
Yes, I realise this wasn't exactly what you asked for, but it Works For Me
(tm)
Thanks in advance for any help/ideas.
>>
>> Barry
>>
>
Regards,
Stuart
--
Stuart Sears RHCA etc.
"It's today!" said Piglet.
"My favourite day," said Pooh.
______________________________**_________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/**mailman/listinfo/users<https://lists.bitfolk…
1:43 p.m.
On Tue, 16 Oct 2012 20:22:10 +0100
Amar Sood <mail(a)amarsood.com> wrote:
nano is the default editor in Debian so no need to install vim or
emacs.
It is even usable before the DI finishes installing the basic OS
For example I have frequently found that the installer cannot find a
mirror because the DNS servers are incorrect. Going to the
console at that stage and running nano to edit /etc/resolv.conf has
enabled me to use my default servers and so continue running 'Net
Install' .
Vim is usable but you need to go to a university or similar to learn
to use emacs :-(
--
John Lewis
Debian & the GeneWeb genealogical data server
vim :)
He means emacs of course. 
1:59 p.m.
On Wed, Oct 17, 2012 at 02:43:00PM +0100, john lewis wrote:
nano is the default editor in Debian so no need to
install vim or
emacs.
Bare hands are the default tools provided by evolution, so there is
no need to eat with utensils.
--
http://bitfolk.com/ -- No-nonsense VPS hosting
2:06 p.m.
On 17 October 2012 14:59, Andy Smith <andy(a)bitfolk.com> wrote:
On Wed, Oct 17, 2012 at 02:43:00PM +0100, john lewis
wrote:
...Something about butterflies...
nano is the default editor in Debian so no need
to install vim or
emacs.
Bare hands are the default tools provided by evolution, so there is
no need to eat with utensils. 
2:14 p.m.
On 17/10/12 14:59, Andy Smith wrote:
On Wed, Oct 17, 2012 at 02:43:00PM +0100, john lewis
wrote:
Well, quite.
nano is the default editor in Debian so no need
to install vim or
emacs.
Bare hands are the default tools provided by evolution, so there is
no need to eat with utensils.
7:27 p.m.
On 17 October 2012 15:14, Nigel Rantor <wiggly(a)wiggly.org> wrote:
On 17/10/12 14:59, Andy Smith wrote:
I used ufw in the end but will look into writing my own commands at some
point. My requirements aren't complex, there's just a bit of background
reading I need to do first.
Thanks again.
Barry
On Wed, Oct 17, 2012 at 02:43:00PM +0100, john
lewis wrote:
Well, quite.
______________________________**_________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/**mailman/listinfo/users<https://lists.bitfolk…
nano is the default editor in Debian so no need
to install vim or
emacs.
Bare hands are the default tools provided by evolution, so there is
no need to eat with utensils.
18 Oct
18 Oct
7:21 a.m.
On 17/10/2012 14:59, Andy Smith wrote:
On Wed, Oct 17, 2012 at 02:43:00PM +0100, john lewis
wrote:
So Minecraft teaches us.
;-)
--
Phil
nano is the default editor in Debian so no need
to install vim or
emacs.
Bare hands are the default tools provided by evolution, so there is
no need to eat with utensils.
7:32 a.m.
New subject: Minecraft (Was tedious editor wars, was Re: iptables front-end?)
Hello,
On Thu, Oct 18, 2012 at 08:21:48AM +0100, Phil Stewart wrote:
On 17/10/2012 14:59, Andy Smith wrote:
Speaking of which, in case you are not aware, BitFolk provides a
Minecraft server for customer enjoyment:
https://tools.bitfolk.com/wiki/Minecraft
The map was reset by request just this weekend gone. If you do
play Minecraft then please drop by and say hi.
Cheers.
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
Bare hands are the default tools provided by
evolution, so there is
no need to eat with utensils.
So Minecraft teaches us. 
8:15 a.m.
New subject: Minecraft (Was tedious editor wars, was Re: iptables front-end?)
(And apologies to Andy 'cause this will be a double post for him...)
I'd forgotten you'd set up a Minecraft server Andy. Will drop by after work
(u: PantsManUK) and see if I can find a Plains/Desert/Swamp intersection to
make a house at.
Kind regards
Murray Crane
On 18 October 2012 08:32, Andy Smith <andy(a)bitfolk.com> wrote:
Hello,
On Thu, Oct 18, 2012 at 08:21:48AM +0100, Phil Stewart wrote:
On 17/10/2012 14:59, Andy Smith wrote:
Speaking of which, in case you are not aware, BitFolk provides a
Minecraft server for customer enjoyment:
https://tools.bitfolk.com/wiki/Minecraft
The map was reset by request just this weekend gone. If you do
play Minecraft then please drop by and say hi.
Cheers.
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
Bare hands are the default tools provided by
evolution, so there is
no need to eat with utensils.
So Minecraft teaches us. 
8:54 a.m.
New subject: Minecraft (Was tedious editor wars, was Re: iptables front-end?)
On Thu, 18 Oct 2012 09:15:26 +0100
Murray Crane <murray.crane(a)gmail.com> wrote:
I'd forgotten you'd set up a Minecraft server
Andy. Will drop by
after work (u: PantsManUK) and see if I can find a
Plains/Desert/Swamp intersection to make a house at.
I was going to say sad!! but remembered I have just finished reading
REAMDE by Neal Stephenson which to a large extent involves an online
multi-user game call T'rain.
--
John Lewis
"Kingsclere Families" website uses the GeneWeb genealogy data server
9:37 a.m.
New subject: Editors was Re: iptables front-end?
Free softweare zealots look away now.
I recently got pointed in the direction of Sublime Text:
http://www.sublimetext.com/
I have found it to be an absolutely superb programmer's editor.
(GUI-based, I should point out).
It is nagware, but the nag screen doesn't pop up all that often
and I have come to the conclusion that it's well worth ~40 quid.
(The "evaluation" period is indefinite).
I'll be buying a licence as soon as the Round Tuit becomes available.
9:52 a.m.
New subject: Editors was Re: iptables front-end?
I too am very pleased with Sublime and have purchased a full license. The
autocomplete is marvelous, and the tools for multiple selection make
refactoring a breeze. Highly recommended.
Cheers,
Vic
On Thu, Oct 18, 2012 at 10:37 AM, Dom Latter <bitfolk-users(a)latter.org>wrote;wrote:
Free softweare zealots look away now.
I recently got pointed in the direction of Sublime Text:
http://www.sublimetext.com/
I have found it to be an absolutely superb programmer's editor.
(GUI-based, I should point out).
It is nagware, but the nag screen doesn't pop up all that often
and I have come to the conclusion that it's well worth ~40 quid.
(The "evaluation" period is indefinite).
I'll be buying a licence as soon as the Round Tuit becomes available.
______________________________**_________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/**mailman/listinfo/users<https://lists.bitfolk…
17 Oct
17 Oct
1:44 p.m.
On Tue, 16 Oct 2012 20:22:10 +0100
Amar Sood <mail(a)amarsood.com> wrote:
nano is the default editor in Debian so no need to install vim or
emacs.
It is even usable before the DI finishes installing the basic OS
For example I have frequently found that the installer cannot find a
mirror because the DNS servers are incorrect. Going to the
console at that stage and running nano to edit /etc/resolv.conf has
enabled me to use my default servers and so continue running 'Net
Install' .
Vim is usable but you need to go to a university or similar to learn
to use emacs :-(
--
John Lewis
"Kingsclere Families" website uses the GeneWeb genealogy data server
vim :)
He means emacs of course.
2:14 p.m.
Enough editor religious war trolling.
I was thinking of moving to use Shorewall instead of editing iptables
script files* directly, mainly because of the IPSec VPN stuff in it, and
because I modify them so little that every time I do I have to go and
re-learn the IP tables commands.
Thoughts on shorewall, especially wrt IPSec VPN anyone?
n
*with an editor
On 17/10/12 14:44, john lewis wrote:
On Tue, 16 Oct 2012 20:22:10 +0100
Amar Sood <mail(a)amarsood.com> wrote:
nano is the default editor in Debian so no need to install vim or
emacs.
It is even usable before the DI finishes installing the basic OS
For example I have frequently found that the installer cannot find a
mirror because the DNS servers are incorrect. Going to the
console at that stage and running nano to edit /etc/resolv.conf has
enabled me to use my default servers and so continue running 'Net
Install' .
Vim is usable but you need to go to a university or similar to learn
to use emacs :-(
vim :)
He means emacs of course.
4216
days inactive
4218
days old
23 comments
17 participants
participants (17)
-
Amar Sood -
Andrew Loughran -
Andy Smith -
Barry Watson -
Chris Dennis -
Daniel Néri -
Dom Latter -
Jeremy Kitchen -
john lewis -
john lewis -
Murray Crane -
Nigel Rantor -
Phil Stewart -
Philip Veale -
Simon Bell -
Stuart Sears -
Vic Smith