Skip to content

Automatic Firewall, taking into account the observations from the previous PR#2

Open
mircevski wants to merge 6 commits intomadic-creates:masterfrom
mircevski:AutoFirewall2
Open

Automatic Firewall, taking into account the observations from the previous PR#2
mircevski wants to merge 6 commits intomadic-creates:masterfrom
mircevski:AutoFirewall2

Conversation

@mircevski
Copy link
Copy Markdown

Hello,

This time I've simplified it quite a lot in terms of lines of code (1 script only / 2 config files) and I've taken into account 2 of your observations:

  1. Your observation: if you have one Wired Connection Network Manager (NM) Profile. This gets activated as soon as a cable is plugged into the device. If you configure to trust this NM profile, it will never create firewall rules. Although, you are possibly connected to an untrusted / unknown network.
    My change: I've created another config file that represents another level of decision, basically types of networks that are NOT to be trusted by default. For example WIFI's are not trusted by default, therefore any new WIFI connection gets its Firewall enabled. The old configuration file that represents individual networks that ARE trusted is still in place. This represents the second level of decision, in which a previously NEW/untrusted network can be listed as trusted.

  2. Your observation: NetworkManager provides a firewalld integration. You can configure the firewalld zone per connection. Don't know about other firewall backends.
    My change: no more iptables rules and a long script implementing it, but using firewalld's "block"/"public" profiles as the case may be.

Please see if this fits your requirements.

Regards,

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant