{"action":"created","issue":{"url":"https://api.github.com/repos/firehol/firehol/issues/294","repository_url":"https://api.github.com/repos/firehol/firehol","labels_url":"https://api.github.com/repos/firehol/firehol/issues/294/labels{/name}","comments_url":"https://api.github.com/repos/firehol/firehol/issues/294/comments","events_url":"https://api.github.com/repos/firehol/firehol/issues/294/events","html_url":"https://github.com/firehol/firehol/issues/294","id":283353209,"number":294,"title":"PR proposal: Don't flush rules from tables not used in firehol.conf","user":{"login":"vboufleur","id":16310611,"avatar_url":"https://avatars3.githubusercontent.com/u/16310611?v=4","gravatar_id":"","url":"https://api.github.com/users/vboufleur","html_url":"https://github.com/vboufleur","followers_url":"https://api.github.com/users/vboufleur/followers","following_url":"https://api.github.com/users/vboufleur/following{/other_user}","gists_url":"https://api.github.com/users/vboufleur/gists{/gist_id}","starred_url":"https://api.github.com/users/vboufleur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vboufleur/subscriptions","organizations_url":"https://api.github.com/users/vboufleur/orgs","repos_url":"https://api.github.com/users/vboufleur/repos","events_url":"https://api.github.com/users/vboufleur/events{/privacy}","received_events_url":"https://api.github.com/users/vboufleur/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-12-19T20:04:54Z","updated_at":"2017-12-28T07:25:47Z","closed_at":null,"author_association":"NONE","body":"Hi all,\r\n\r\nI'm currently working with a VPN infrastructure and we decided to use FireHOL as our Firewall tool. The only issue we found is that our VPN program dynamically sets some rules in the `nat` table for the VPN to work correctly and when we start/stop firehol these rules are all flushed, disconnecting the users.\r\n\r\nI reasoned that this happens because I've set no `nat` rules on firehol.conf, so firehol interprets this as \"set this table to empty\" and flushes everything that's already there.\r\n\r\nI searched through the FireHOL variables and found nothing similar to \"USE_ONLY_FILTER_TABLE\" or \"DONT_FLUSH_UNCONFIGURED_TABLES\". Then I thought, wouldn't it be nice if FireHOL had this functionality? I'm up to develop a PR to do this, but I thought it would be better if we discuss it here first on this issue.\r\n\r\nIs there an alternative to this that natively uses FireHOL functionality? Currently I'm managing FireHOL in my VPN servers through a script that saves the `nat` table, starts/stops FireHOL and then restores it, but it would be way better to use FireHOL natively, either through a feature implemented in a PR or some other way that I don't know yet.\r\n\r\nHere's the script:\r\n\r\n```bash\r\nlog 'info' \"Saving iptables rules to $FIREWALL_FOLDER_PATH/iptables-save/nat-table.iptables\"\r\nsudo iptables-save --counters --table nat > $FIREWALL_FOLDER_PATH/iptables-save/nat-table.iptables\r\n\r\ncase \"$1\" in\r\n  start)\r\n    log 'info' \"Starting FireHOL\"\r\n    sudo firehol start\r\n    ;;\r\n  stop)\r\n    log 'info' \"Stopping FireHOL\"\r\n    sudo firehol stop\r\n    ;;\r\nesac\r\n\r\nlog 'info' \"Restoring iptables rules on $FIREWALL_FOLDER_PATH/iptables-save/nat-table.iptables\"\r\nsudo iptables-restore --counters --table nat < $FIREWALL_FOLDER_PATH/iptables-save/nat-table.iptables\r\n```\r\n\r\nWhat do you guys think? The PR is a good idea? What is the best approach to tackle this issue?"},"comment":{"url":"https://api.github.com/repos/firehol/firehol/issues/comments/354242825","html_url":"https://github.com/firehol/firehol/issues/294#issuecomment-354242825","issue_url":"https://api.github.com/repos/firehol/firehol/issues/294","id":354242825,"user":{"login":"philwhineray","id":1271051,"avatar_url":"https://avatars2.githubusercontent.com/u/1271051?v=4","gravatar_id":"","url":"https://api.github.com/users/philwhineray","html_url":"https://github.com/philwhineray","followers_url":"https://api.github.com/users/philwhineray/followers","following_url":"https://api.github.com/users/philwhineray/following{/other_user}","gists_url":"https://api.github.com/users/philwhineray/gists{/gist_id}","starred_url":"https://api.github.com/users/philwhineray/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philwhineray/subscriptions","organizations_url":"https://api.github.com/users/philwhineray/orgs","repos_url":"https://api.github.com/users/philwhineray/repos","events_url":"https://api.github.com/users/philwhineray/events{/privacy}","received_events_url":"https://api.github.com/users/philwhineray/received_events","type":"User","site_admin":false},"created_at":"2017-12-28T07:25:47Z","updated_at":"2017-12-28T07:25:47Z","author_association":"OWNER","body":"First of all, sorry for the very slow reply. I have very little time to devote to any programming at the moment and I think Costa is very busy too.\r\n\r\nPRs are always welcome and are probably the best way of expressing your intentions but I do appreciate it can mean quite a lot of work with an uncertain outcome.\r\n\r\nThe main problem I see is that firehol assumes it is in total control of the tables. It can write to the NAT table in normal operation so adding your functionality would likely interfere with that; either firehol rules will wind up duplicated (saved, restored and re-generated), dropped (if you restore over them) or anything that generates NAT will need to be disabled and the user told why.\r\n\r\nCan your VPN generate the rules on-demand or to a specific chain? If it can do the former then you could include a call within the firehol config itself and the rules can be loaded on restart. If the latter then you could include a jump within the firehol config and just save and restore a subset of the NAT table, both of which would be safer. When you look in the firehol program you will find it has some undocumented and unused hooks which might be usable for the save and restore steps.\r\n\r\nWith virtualisation and container orchestration systems all wanting to be able to add rules dynamically I certainly think some sort of solution to managing 3rd-party rules would be nice. It would be great to have some general way of managing these."}}
{"actor":{"display_login":"philwhineray"}}