On 10/26/2014 6:48 PM, James Andrewartha wrote:
> On 24/10/14 21:59, Tom Eastep wrote:
>> Other than the installation part which would need some work, is there
>> any reason to believe that Shorewall-lite wouldn't run on VyOS?
>
> VyOS has its own iptables setup that I'd prefer to integrate with. The
> configuration is very verbose, e.g.:
>
> name BLOCK_DEV {
> default-action accept
> description "Block access from eth3 to the core network"
> rule 1 {
> action accept
> log disable
> protocol all
> source {
> address 192.168.0.0/24
> }
> state {
> established enable
> invalid disable
> new disable
> related disable
> }
> }
>
> I'm actually using EdgeOS (a VyOS fork for Ubiquiti EdgeMAX routers)
> which has a GUI, but being able to generate these rules from Shorewall
> would be nice. Obviously it's a lot of work which I don't have time for
> at the moment, but I was hoping there would be an appropriate layer
> within Shorewall that this translation could be done.There isn't such a layer; Shorewall is designed from top to bottom to generate iptables rules. So I can see no value in generating an intermediate form that is then used to generate iptables rules. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
