From: Gerald Raucamp (caveycaveymon.com)
Date: Mon Apr 10 2006 - 09:47:27 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi,

On Sun Apr 09 2006, Lars Solberg <sunberggmail.com> wrote:
> Hi
>
> Is there anyone that know about how I can "sync" iptables rules on two
> different servers? The plan is to have (on one of the servers) a
> script that automaticly block ip adresses with iptables depending on
> different conditions. When that ip adress is blocked I want it to
> automaticly be blocked on another server to.
>
Not that I am aware of, but I suppose when you're running something like
portsentry, you could rsync the blocked files (heck, if you keep a
logfile anyways of blocked ip addresses...) between the servers and have
a script/trigger/cronjob running in the background checking for changes
in the files and grabbing the last added ipaddresses and dump it into an
iptables -A INPUT -J DROP -i [iface] -s [ip] kinda rule.

> One idea is to change the script that is adding the block rule to
> iptables to make it soo it can send the rule to the other server, but
> this is not an option, the iptables rules must be synced after the
> iptables rule have been added.
>
rsync... but you would have a bit of a time delay, I guess you want it
realtime? You need some way of notifying a background process that an IP
has been added.

Cook up a small C/S program and have your program/script which creates
the actual drop statement to send out a ping to the other program which
needs to update the rules?

> Another idea is to get the iptables to use an sql database of some
> sort to load the rules, but I dont know how, and this whould be
> somehow ruining the whole thing of having a firewall if you make it
> dependent an sql server (i think).. But afterall, if this is possible
> this is option.
>
What's the problem of having your firewall be dependent on a sql server?
flatfile based sql engines would be great, mysql can be great, any other
flavour of sql engine could be great. Just make sure it doesn't listen
to the outside world and lock down access to 1 ip address'n'stuff like
that.

(and probably make sure the server starts before you init the firewall
scripts? Or have the firewall script run in two stages.. at start up
block all traffic, after everything has been fired up... let it grab the
additional rules from the sql server and build up the firewall into the
eh, last known state)

> Any ideas?
> Hope someone can help out..
>
Just some ideas, no real code or scripts to support my ideas, but they
sound easy enough to implement :)

When you already have logfiles of blocked ip's, a little scripting can
get you a long way.

If you really want to sync iptable rules which go beyond simple IP
blocking, eh.. you just need a bit more scripting and cook up your own
protocol / syntax for transporting the correct commands to the other
firewall.

> Thanks
> Lars

Cheers,

Gerald

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]