Idgarad írta:
There are many guides on how to write a firewall script functionally,
but form is disregarded. Is the following a decent, well written
firewall (Form, not function)? It's is clear and easy to follow? In
the event that I get hit by a bus would someone else with IPTables
experience be able to pick up where I left off?
Hopefully an experienced firewall professional would understand it... :)
Not because it is too complicated but not everyone uses the same
programing technics and style.
Has anyone from the Netfilter's list thought about writing a
Best-Practices guide not from the functional side, but rather the form
side of writing IPTABLES scripts and what not?
Well... I published my firewall script two months before...
( https://lists.netfilter.org/pipermail/netfilter/2006-August/066404.html )
Let me quote Jan Engelhardt's reply:
"No one ever reads through that mess, really. There are so many scripts floating
around, the number is just too outstanding, and it makes tired after a while.
Jan Engelhardt"
Well... I think this is okay but anyway I would be glad if a guide would exist.
So I am a bit interested ...
For example I would propose the following format:
iptables -t <table> <command> -j <jump_target> [filters]
table: mangle, nat, filter...
command: -A, -I, -P...
jump_target: ACCEPT, DROP ...
filters: -p tcp, -p tcp -s 192.168.0.1....
There could be other rules like separating the tables and so on...
Swifty
