-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Lars Solberg typed:
Is there anyone that know about how I can "sync" iptables rules on
two different servers? The plan is to have (on one of the servers) a
script that automaticly block ip adresses with iptables depending on
different conditions. When that ip adress is blocked I want it to
automaticly be blocked on another server to.
One idea is to change the script that is adding the block rule to
iptables to make it soo it can send the rule to the other server,
but this is not an option, the iptables rules must be synced after
the iptables rule have been added. Another idea is to get the
iptables to use an sql database of some sort to load the rules, but
I dont know how, and this whould be somehow ruining the whole thing
of having a firewall if you make it dependent an sql server (i
think).. But afterall, if this is possible this is option.
Have a look at the man pages for iptables-save(8) and
iptables-restore(8). One can create a script to dump iptables rules
via iptables-save(8) at some intervals, contrast the dump output with
a previously saved copy of the dumped rules, extract the differences
into a file, move the file over to the other system, and use the '-n'
or "--noflush" option to iptables-restore(8) to include the extra
rules into the ruleset. That might well work.
- --
Ayaz Ahmed Khan
Indifference will be the downfall of mankind, but who cares?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: For info see http://quantumlab.net/pine_privacy_guard/
iQEVAwUBRDpdNQFi6bOwa2ADAQKfZAf/ViJZAZ9PqYTtnprgCAU12YIjvQBsfIaj
FGF9yeOlkLU9Y9Sw/S6QV4k6bGBELY+gJzmV+tsRvV4jBPS4f95pCdBIBO0MVMgE
YMrAI5B6Xroj9N8c9UDPrkag5kEggLrDr301q7/bZA+EmnSefpkAzSPmmdNQxQz2
yHHQIsNqv9XN94x7D4O6VokKPTsSPDiCrhCMTf5+vJqvy2aVtOWeWpfT1paxXjPg
vr+q5bkFhuUDs4xB9Mjh2jrwqiFBe1xOwRpWpsOryIzoKEKB693xImkopPjF+Nf+
QHs1pSb3Uk2DcKszbYKvBS4k8fRmbfUONMPiVED0c+ey0aFoFg/lRg==
=rfc6
-----END PGP SIGNATURE-----
