[Astlinux-devel] Astlinux Firewall

[Michael K. <mic...@ip...>]

Hi Devs

Just wondering if I could have a bit of a discussion about the Astlinux firewall and the firewall configuration.

With the recent increase in hacking attempts that I am seeing on my systems, I'm having to get more serious about security and I'm finding that the firewall tab and resulting iptables rules are not quite as granular as I would like. As I am planning on changing my architecture to being VPN based, this was highlighted recently with the need to add custom rules for VPN’s.

Now yes I agree that it would be good to learn iptables and adding custom rules but this will be a considerable learning curve for me and certainly my support staff.

So I'm just wondering if there has been or could be a consideration to extend the granularity of the current firewall tab?
Here are some of my thoughts:

  *   Could we add an additional Zone called VPN
  *   Could we separate the Rules Action into three parts: Action (NAT, Pass, Deny etc), Source Zone (EXT, LAN, DMZ, VPN) & Destination Zone (EXT, LAN, DMZ, VPN, Local)
  *   Could we pull out some of the Firewall options and create some default Zone to Zone rules
  *   Maybe look at building out the use of netset rules for Geoblocking etc.

I'm beginning to have a few partners concerned about the security of Astlinux and its going to be more and more difficult to defend as time goes on. I know that Astlinux has the functionality and tools available to meet most security requirements however they just need to be more accessible to the average network person such as myself. I really don't want to get to the stage where I am putting a firewall in front of the system purely to appease my partners or customers or because its easier.

Yes there is probably quite a bit of work here and some big changes but as I have invested heavily into Astlinux being the core of my business, I'm prepared to contribute financially if necessary.

I apologise if I have stirred up a hornets nest as it was certainly not my intention. It is the fact that I believe heavily in this product (and so have many of my partners that are now recommending us) that I am looking to the future of where it is heading.

I look forward to your comments.

Regards
Michael Knill