Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shorewall – The End of the Road

sourceforge.net

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Shorewall – The End of the Road

#61

Post by dmix »

dmix wrote: post #43
kiallmacinnes wrote: post #20

Earlier quoted context omitted.

Wrapper or not, building a wrapper that works for as many use cases for as long a time as Shorewall has is something. Frankly, it sounds like your suggesting that because he didn't invent the underlying network stack, or network protocols, that makes it a quick and dirty half day or so project. 99.9% of development work in recent years hasn't been inventing new stuff, it's been building wrappers. Wrappers that compos…

All software is built on abstractions. I’m sure IPTablss is a giant “wrapper” around the Linux OS networking stack. Nothing wrong with a wrapper of the underlying system has had the real world field testing, longetivity, and adoption that IPTablws has.

wrote this last night when I was half asleep. I do know how to type "IPTables" :p

Re: Shorewall – The End of the Road

#62

Post by albeec13 »

noir_lord wrote: post #30
albeec13 wrote: post #28

Earlier quoted context omitted.

High likelihood it was this: https://wiki.archlinux.org/index.php/Router The Arch Wiki is pretty awesome, generally, and I used this pretty heavily as a reference. I will say, this was not 100% perfect and I had to use some other outside sources, but most of the info is here. I did consider writing my own step-by-step post (if for no other reason than for me to not have to remember it), but haven't gotten around to i…

I've never installed Arch and know virtually nothing about it but often the first link I click after googling is the arch one, their documentation is fabulous and pretty often bang up to date (Since I track Fedora N/N-1 the package versions are usually close enough).

I've been running Arch as my main home server for going on 11 years now. I love it. In that time span, the biggest hurdles have been the sysvinit/systemd transition and a handful of issues with mongodb feature deprecations that required manual intervention.

My original impetus for using it was to "re-learn Linux" after a hiatus out of college, and because it's not as bloated as something like a full Ubuntu install, but doesn't require the full compiling of packages like Gentoo, it seemed like a good choice. Unless I want a GUI right out of the box, I don't use anything else.

As you noted, the wiki is fantastic as well.

Re: Shorewall – The End of the Road

#63

Post by albeec13 »

tylerjl wrote: post #45
pard68 wrote: post #23

Earlier quoted context omitted.

I stumbled across a blog post that used Arch and Shorewall to roll a diy router. Any chance you used a blog post for inspiration and if so do you have the link still? I have been trying to find it ever since...

Was it my blog post? https://blog.tjll.net/building-my-perfect-router/

Nice write-up. I have a very similar setup, only I didn't delve into the netflow montioring/traffic shaping because it seemed a bit overkill for my needs.

Have you given any thought about what you might do with respect to Shorewall, given the this news?

Re: Shorewall – The End of the Road

#64

Post by tylerjl »

albeec13 wrote: post #63
tylerjl wrote: post #45

Earlier quoted context omitted.

Was it my blog post? https://blog.tjll.net/building-my-perfect-router/

Nice write-up. I have a very similar setup, only I didn't delve into the netflow montioring/traffic shaping because it seemed a bit overkill for my needs. Have you given any thought about what you might do with respect to Shorewall, given the this news?

Even assuming the worst - that is, that Shorewall development completely stalls - the firewall is fully functional for me and I haven't hit any show-stopping bugs, so my plan is to continue using it until it breaks somewhere down the line. After the many years of development that've gone into Shorewall, the dividends it pays now are the years and years of hardening that have let it age into a solid, reliable tool. My needs aren't really pushing the envelope of what Shorewall can do (just a home network gateway), so my hope is that I won't bump into anything esoteric in the meantime.

Re: Shorewall – The End of the Road

#65

Post by albeec13 »

tylerjl wrote: post #64
albeec13 wrote: post #63

Earlier quoted context omitted.

Nice write-up. I have a very similar setup, only I didn't delve into the netflow montioring/traffic shaping because it seemed a bit overkill for my needs. Have you given any thought about what you might do with respect to Shorewall, given the this news?

Even assuming the worst - that is, that Shorewall development completely stalls - the firewall is fully functional for me and I haven't hit any show-stopping bugs, so my plan is to continue using it until it breaks somewhere down the line. After the many years of development that've gone into Shorewall, the dividends it pays now are the years and years of hardening that have let it age into a solid, reliable tool. My…

That's a good point. I suppose as long as I'm careful with updates, I should be able to leave it alone until there's a long-lost security bug found.

Re: Shorewall – The End of the Road

#66

Post by noir_lord »

albeec13 wrote: post #62
noir_lord wrote: post #30

Earlier quoted context omitted.

I've never installed Arch and know virtually nothing about it but often the first link I click after googling is the arch one, their documentation is fabulous and pretty often bang up to date (Since I track Fedora N/N-1 the package versions are usually close enough).

I've been running Arch as my main home server for going on 11 years now. I love it. In that time span, the biggest hurdles have been the sysvinit/systemd transition and a handful of issues with mongodb feature deprecations that required manual intervention. My original impetus for using it was to "re-learn Linux" after a hiatus out of college, and because it's not as bloated as something like a full Ubuntu install, b…

Yeah I know a bunch of programmers who love it, I use Fedora out of inertia, when I got the Ryzen at work it was very soon after they launched and they had better out of the box support so I switched to it from Xubuntu and liked it enough it stuck.

Re: Shorewall – The End of the Road

#67

Post by srmatto »

tylerjl wrote: post #45
pard68 wrote: post #23

Earlier quoted context omitted.

I stumbled across a blog post that used Arch and Shorewall to roll a diy router. Any chance you used a blog post for inspiration and if so do you have the link still? I have been trying to find it ever since...

Was it my blog post? https://blog.tjll.net/building-my-perfect-router/

I used your post, thanks for your hard work!

Re: Shorewall – The End of the Road

#68

Post by teh_klev »

svnpenn wrote: post #22

With all due respect, maybe he would have had better luck moving the community to another site github certainly has its problems (feature bloat), but gitlab and bitbucket are options - as well as the new sourcehut i have tried sourceforge a few times over the years and its just absolute garbage - from the forums to the issues to the source code - the only parts thats worth a damn is the binary downloads - and you can…

> With all due respect, maybe he would have had better luck moving the community to another site

I think you're missing the point of his announcement and nowhere has Tom complained about visibility, contributor pool etc. The maintainer is in his 70's and likely kinda done with the project and fancies a change of pace, as evidenced by:

"I am now departing on an extended trip to visit some of the places in the world that I have always dreamed of seeing."

Not all projects need to level up to GitHub and the unwashed masses blasting you with issues and pull requests. SourceForge, despite its past transgressions, likely suited his cadence of work.

Re: Shorewall – The End of the Road

#69

Post by benkillin »

sadris wrote: post #19
ansible wrote: post #8

Earlier quoted context omitted.

It is possible the maintainers of the various OS distribution packages will band together and maintain development. BTW, what's the general recommendation for people looking to migrate to another Linux firewall package?

iptables-persistent on Debian. Or iptables-services on redhat

personally I use a script I developed a while ago for doing iptables directly, using awk to parse some txt files to apply the firewall config and then adding a script to execute the iptables script on boot:

https://github.com/benkillin/linux-firewall

the ip6 section needs some further development though - I have no need for it in my scenario at the moment.

Re: Shorewall – The End of the Road

#70

Post by pard68 »

tylerjl wrote: post #45
pard68 wrote: post #23

Earlier quoted context omitted.

I stumbled across a blog post that used Arch and Shorewall to roll a diy router. Any chance you used a blog post for inspiration and if so do you have the link still? I have been trying to find it ever since...

Was it my blog post? https://blog.tjll.net/building-my-perfect-router/

that's the one! much thanks
Post reply on HN