Re: Syncing iptables rules between two servers

[Ayaz Ahmed Khan <ayaz () pakcon org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Lars Solberg typed:

> Is there anyone that know about how I can "sync" iptables rules on
> two different servers? The plan is to have (on one of the servers) a
> script that automaticly block ip adresses with iptables depending on
> different conditions. When that ip adress is blocked I want it to
> automaticly be blocked on another server to.
>
> One idea is to change the script that is adding the block rule to
> iptables to make it soo it can send the rule to the other server,
> but this is not an option, the iptables rules must be synced after
> the iptables rule have been added.  Another idea is to get the
> iptables to use an sql database of some sort to load the rules, but
> I dont know how, and this whould be somehow ruining the whole thing
> of having a firewall if you make it dependent an sql server (i
> think).. But afterall, if this is possible this is option.

Have a look at the man pages for iptables-save(8) and
iptables-restore(8).  One can create a script to dump iptables rules
via iptables-save(8) at some intervals, contrast the dump output with
a previously saved copy of the dumped rules, extract the differences
into a file, move the file over to the other system, and use the '-n'
or "--noflush" option to iptables-restore(8) to include the extra
rules into the ruleset.  That might well work.

- -- 
Ayaz Ahmed Khan

Indifference will be the downfall of mankind, but who cares?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: For info see http://quantumlab.net/pine_privacy_guard/

iQEVAwUBRDpdNQFi6bOwa2ADAQKfZAf/ViJZAZ9PqYTtnprgCAU12YIjvQBsfIaj
FGF9yeOlkLU9Y9Sw/S6QV4k6bGBELY+gJzmV+tsRvV4jBPS4f95pCdBIBO0MVMgE
YMrAI5B6Xroj9N8c9UDPrkag5kEggLrDr301q7/bZA+EmnSefpkAzSPmmdNQxQz2
yHHQIsNqv9XN94x7D4O6VokKPTsSPDiCrhCMTf5+vJqvy2aVtOWeWpfT1paxXjPg
vr+q5bkFhuUDs4xB9Mjh2jrwqiFBe1xOwRpWpsOryIzoKEKB693xImkopPjF+Nf+
QHs1pSb3Uk2DcKszbYKvBS4k8fRmbfUONMPiVED0c+ey0aFoFg/lRg==
=rfc6
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected. 
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no 
obligation. See why so many companies trust Spy Sweeper Enterprise to 
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------