Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shorewall – The End of the Road

sourceforge.net

Post reply on HN
Print view View original

31–40 of 70 posts

Re: Shorewall – The End of the Road

#31

Post by rhizome »

ansible wrote: post #8
_wmd wrote: post #4

A project of this popularity and maturity essentially announcing they're shuttering because a single long-term contributor is retiring.. if ever there was a damning indictment of modern consumption-driven open source, I don't know what is

It is possible the maintainers of the various OS distribution packages will band together and maintain development. BTW, what's the general recommendation for people looking to migrate to another Linux firewall package?

fwbuilder will export rules from its GUI to a whole bunch of different firewalls. When you change firewalls, just re-export/compile.

http://fwbuilder.sourceforge.net/4.0/features.shtml

Re: Shorewall – The End of the Road

#32

Post by [deleted] »

kiallmacinnes wrote: post #20
sadris wrote: post #18

Earlier quoted context omitted.

It's just a wrapper around iptables...

Wrapper or not, building a wrapper that works for as many use cases for as long a time as Shorewall has is something. Frankly, it sounds like your suggesting that because he didn't invent the underlying network stack, or network protocols, that makes it a quick and dirty half day or so project. 99.9% of development work in recent years hasn't been inventing new stuff, it's been building wrappers. Wrappers that compos…

[deleted]

Re: Shorewall – The End of the Road

#33

Post by nerdbaggy »

_wmd wrote: post #4

A project of this popularity and maturity essentially announcing they're shuttering because a single long-term contributor is retiring.. if ever there was a damning indictment of modern consumption-driven open source, I don't know what is

I feel like most open source projects are like that.

https://github.com/antirez/redis/pulse/monthly

https://github.com/django/django/pulse/monthly

https://github.com/moby/moby/pulse/monthly

Re: Shorewall – The End of the Road

#34

Post by mrmondo »

A real shame, so much nicer that firewalld on the command line / files, I believe firewalld has some usable GUIs now for people that are running it on the desktop though and of course BPF should make things better / easier.

Re: Shorewall – The End of the Road

#35

Post by j45 »

merlincorey wrote: post #2

Very impressive that this software was built and maintained by a mostly solo developer into their 70's. Talk about software lifecycle. I wonder if there is much of a community around this software and if there is someone who may take over the future direction, much like how Emacs' head maintainership was recently (relatively) given up by RMS.

How is it impressive because of age?

Re: Shorewall – The End of the Road

#36

Post by craftyguy »

albeec13 wrote: post #13

Welp. I recently completed an Arch-linux and PCEngines-based DIY router build and stumbled upon Shorewall as an alternative to straight-up IP tables... I'm not looking forward to changing this setup.

I've been running basically this setup since 2015, and I don't think I'm any closer than you are to looking forward to changing this setup.

Re: Shorewall – The End of the Road

#37

Post by mirimir »

sadris wrote: post #19
ansible wrote: post #8

Earlier quoted context omitted.

It is possible the maintainers of the various OS distribution packages will band together and maintain development. BTW, what's the general recommendation for people looking to migrate to another Linux firewall package?

iptables-persistent on Debian. Or iptables-services on redhat

I love it, but it's not a wrapper. It's just a dead-simple mechanism for making iptables persistent.

The cool thing is that /etc/iptables/rules.v4 and /etc/iptables/rules.v6 get loaded at bootup. So if you're living dangerously, you just use /etc/iptables/test-rules.v4 or whatever. If you get locked out, just reboot the server. Or have it rebooted, if you don't have a management console.

Re: Shorewall – The End of the Road

#38

Post by mirimir »

riffraff wrote: post #9
dharmab wrote: post #7

Earlier quoted context omitted.

You're giving me flashbacks to working on ASAs and issuing a "reboot 15" before making config changes, so that the device would reboot into the last config if you locked yourself out. And those were still in the same building!

How would it reboot on the old config if you had just changed it?

Because iptables changes aren't persistent unless you write them to some file that gets loaded at bootup.

Re: Shorewall – The End of the Road

#39

Post by sadris »

mirimir wrote: post #37
sadris wrote: post #19

Earlier quoted context omitted.

iptables-persistent on Debian. Or iptables-services on redhat

I love it, but it's not a wrapper. It's just a dead-simple mechanism for making iptables persistent. The cool thing is that /etc/iptables/rules.v4 and /etc/iptables/rules.v6 get loaded at bootup. So if you're living dangerously, you just use /etc/iptables/test-rules.v4 or whatever. If you get locked out, just reboot the server. Or have it rebooted, if you don't have a management console.

Test with the live iptables state. Then you can save it with iptables-save > rules.v4

Why do you need a wrapper at all? I looked at shorewall ten years ago and it just made everything more complicated than just doing it raw.

Term is also nice because it still uses iptables syntax.

Re: Shorewall – The End of the Road

#40

Post by mirimir »

sadris wrote: post #39
mirimir wrote: post #37

Earlier quoted context omitted.

I love it, but it's not a wrapper. It's just a dead-simple mechanism for making iptables persistent. The cool thing is that /etc/iptables/rules.v4 and /etc/iptables/rules.v6 get loaded at bootup. So if you're living dangerously, you just use /etc/iptables/test-rules.v4 or whatever. If you get locked out, just reboot the server. Or have it rebooted, if you don't have a management console.

Test with the live iptables state. Then you can save it with iptables-save > rules.v4 Why do you need a wrapper at all? I looked at shorewall ten years ago and it just made everything more complicated than just doing it raw. Term is also nice because it still uses iptables syntax.

I'm sure that there are other ways to manage multiple sets of iptables rules. I've just found iptables-persistent to be the easiest.

I do agree on the iptables vs wrapper issue. I started out using Shorewall, and then ufw. But once I started learning iptables, I decided that it was simpler to just use it.

Post reply on HN