Re: shorewall maintainance?

"Brian J. Murrell" <[email protected]> Mon, 03 Feb 2025 17:38:34 -0500

Newsgroups	gmane.comp.security.shorewall
Message-ID	<[email protected]>

On Mon, 2025-02-03 at 23:06 +0200, Tuomo Soini via Shorewall-users
wrote:
> 
> That way you unfortunately loose all dynamic firewall changes like
> dns
> resolving.

Can you expand on that?  How does foomuuri utilize DNS in it's rules? 
Is it simply resolving names to IP addresses at rule generation time or
is it more sophisticated than that?  You said "dynamic" so I am
suspecting it's more sophisticated than that.

> It is easy to manage firewall rules with ansible or similar.

I think ansible is pretty heavy (python) for embedded platforms.

> I think one of the most prominent features is ability to handle all
> ipv6
> and ipv4 rules in same config.

Yeah, that does sound attractive.  I have for years been meaning to
merge my Shorewall and Shorewall6 configurations but never have gotten
around to it.

Does foomuuri transparently handle the need for IPv4 [D]NAT (to
traverse into a NATted network) along with it's single IPv4/IPv6
configuration syntax?

Cheers,
b.

signature.asc (application/pgp-signature, 488 B)