RE: Syncing iptables rules between two servers

["Burton Strauss" <Burton () FelisCatus org>]

Most distro's of Linux include some form of an iptables-save and
iptables-restore script.  Would that do what you need?

You might want to put the to-be-synced rules into a separate chain so you
could use grep to strip the appropriate lines out of the -save file...

-----Burton

-----Original Message-----
From: Lars Solberg [mailto:sunberg () gmail com] 
Sent: Saturday, April 08, 2006 5:26 PM
To: focus-linux () securityfocus com; security-basics () securityfocus com
Subject: Syncing iptables rules between two servers

Hi

Is there anyone that know about how I can "sync" iptables rules on two
different servers? The plan is to have (on one of the servers) a script that
automaticly block ip adresses with iptables depending on different
conditions. When that ip adress is blocked I want it to automaticly be
blocked on another server to.

One idea is to change the script that is adding the block rule to iptables
to make it soo it can send the rule to the other server, but this is not an
option, the iptables rules must be synced after the iptables rule have been
added.
Another idea is to get the iptables to use an sql database of some sort to
load the rules, but I dont know how, and this whould be somehow ruining the
whole thing of having a firewall if you make it dependent an sql server (i
think).. But afterall, if this is possible this is option.

Any ideas?
Hope someone can help out..

Thanks
  Lars


-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected. 
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no 
obligation. See why so many companies trust Spy Sweeper Enterprise to 
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------