Re: Firewalls - Ease of Use and Maintenance?

[Jonathan Lassoff <jof () thejof com>]

On Wed, Nov 9, 2011 at 12:44 PM, Nick Hilliard <nick () foobar org> wrote:
> On 09/11/2011 19:07, C. Jon Larsen wrote:
> > put the main portion of the conf in subversion as an include file and
> > factor out local differences in the configs with macros that are defined
> > in
> > pf.conf
> >
> > Easy.
>
> As I said, it's not a pf problem.  Commercial firewalls will do all this
> sort of thing off the shelf.  It's a pain to have to write scripts to do
> this manually.

Agreed. This is rather a pain to have to do manually each time (either
scp'ing or scripting). It's unfortunate that there's not a
conventional script or mechanism for doing this.

I have plenty of scripts from past commercial work that do this, but
they're sadly tied up license-wise.

I've had good luck, pf-wise, with creating a ruleset that is just
identical between hosts. By keeping the interface naming/numbering
scheme consistent across two hosts, the same configuration can just
"work" on both.

Cheers,
jof