|
||||||||
Il 07/09/2011 17:08, Lee Sharp ha scritto: > On 09/07/2011 07:19 AM, Tonix (Antonio Nati) wrote: >> OUT rules >> >> Possibility to choose if all rules apply to incoming or outgoing >> connections: >> If incoming, rules would apply as now. Now, with more interfaces, we >> are forced to write same rules on all interfaces, in order to >> protect services. >> If outgoing, rules would be applied on outgoing interface. This >> would semplify management of more interfaces, because rules would be >> written only once and only on outgoing interface. >> As alternative, mantaining actual incoming rules, it would be nice >> to have one PRE-RULES panel which rules would be applied to any >> interface, before interface local rules. > > I see this as a disadvantage, since you no longer have the granular > control. It is granular in the same way, but more easy to manage, and with less rules to be written. Actually, if you want to know who is permitted to use a service, you must walk through all interfaces, while in the way I propose you have all the rules on the service's interface. With output rules, you write rule only once. With incoming rules, you have to write (and manage, and execute run time) a number of rules with is multiplied for the number of interfaces. Outgoing interface eth5: enable from any port any to: 100.100.100.100 port 25 With actual system, you have to write same rule for every incoming interface: Incoming interface eth0: enable from any port any to: 100.100.100.100 port 25 Incoming interface eth1: enable from any port any to: 100.100.100.100 port 25 Incoming interface eth2: enable from any port any to: 100.100.100.100 port 25 ............. Incoming interface ethX: enable from any port any to: 100.100.100.100 port 25 If you want complex exceptions, you write them only in one place. If you want to examine who accesses a service, see rules on service interface. This is the point of view of a ISP, which can opposite to other points of view. For such reason I suggest someone can choose the general behaviour of his/her installation: input or output rules. > However, I can see your trouble with making the same rule twice. (Or > more) But did you know you can copy a rule to another interface? You > just have to change the interface drop down and source dropdown. Of course now I'm forced to copy rules, but when I need to change order or add rules/exceptions it is really troublesome. I have about 20 vlans (interfaces), most of which are DMZ which publish only some services to all the world (Internet + DMZs), so I have to replicate each change on all 20 interfaces. With this small change manageability would become fantastic for ISP environments. Rules would be much less, and general speed of monowall would be better. Regards, Tonino > > Lee > > --------------------------------------------------------------------- > To unsubscribe, e-mail: m0n0wall dash unsubscribe at lists dot m0n0 dot ch > For additional commands, e-mail: m0n0wall dash help at lists dot m0n0 dot ch > > -- ------------------------------------------------------------ Inter@zioni Interazioni di Antonio Nati http://www.interazioni.it tonix at interazioni dot it ------------------------------------------------------------ |