There is a great article by Marco Marongiu over on the Free Software Magazine site today. In the article Marco talks about how he uses Firewall Builder to keep his policies consistent across multiple firewalls. He also touches on using Firewall Builder to manage policies controlling traffic to VM servers by configuring iptables in dom0 on Xen. Enjoy!
FSM - Firewall Consistency with Firewall Builder
Tuesday, September 20, 2011
Wednesday, September 7, 2011
The team over at Security by Default wrote up a nice blog post about Firewall Builder recently. Here's a link to the original article which is in Spanish:
And, if like me you can't read Spanish, here's a link to a translated version in English. It's not perfect, but the key messages come across.
http://bit.ly/pAu1hF (English translation via Babel Fish)
Always great to hear about how people use Firewall Builder and what they like about it!
Wednesday, July 27, 2011
The team at NetCitadel is happy to share that today we released our latest version called Firewall Builder 5. This release includes several enhancements to the GUI and adds a number of new features designed to make it easier for users with large data files to manage their objects.
New features in this release include:
- User defined subfolders
- Keywords for tagging objects
- Dynamic groups with smart filters
- Multiple operations per filter rule
- Attached Networks object
- Import support for PF configuration files
Thanks to everyone that helped beta test Firewall Builder 5. You can find more information about this release in the release notes.
Sunday, July 17, 2011
An article I wrote for the May 2011 issue of the Linux Journal is now available in the free online LJ content. The article gives detailed step-by-step instructions for implementing High Availability (HA) Linux firewall pairs using iptables, keepalived, conntrackd and of course Firewall Builder.
Tuesday, July 5, 2011
Firewall Builder 5 includes a new feature called Attached Network objects. These new objects are child objects of firewall interface objects and act like a group object that automatically includes all of the IP networks that are associated the IP addresses assigned to the interface that the Attached Network object was created under.
Once created the Attached Network object can be used in firewall rules just like regular group objects and can be created under interfaces that are configured with either static or dynamic IP addresses. This makes it easy to refer to all the networks that are directly attached to a particular firewall interface.
Let's look at a quick example. Suppose I have a firewall that includes interface eth0 which is configured with static IP addresses 192.168.2.1/24 and 10.10.10.1/24. If I want to create a rule that allows traffic from the local network on eth0 to the firewall itself currently I could either use two network objects in the rule's Source or create a Group object that includes these networks and use that in the rule's Source.
Now with Attached Networks I can simply create a new Attached Network child object under eth0 and use that in the rule's Source. This Attached Network object will include both the 192.168.2.0/24 and 10.10.10.0/24 networks and if I add a new static IP address to eth0 the Attached Network object will automatically update with the IP network of the new IP address.
You can find more information about creating and using Attached Networks in the Firewall Builder 5 Users Guide here.
Wednesday, June 29, 2011
If your Firewall Builder configuration includes lots of objects then you will probably like user defined subfolders. This feature was added in v5, which is currently in beta, and lets users create subfolders below any of the standard predefined system folders.
After the subfolder has been created you can drag-and-drop objects from the system folder into the subfolder. These subfolders make it convenient to organize objects by region, location, function or whatever grouping makes sense in your environment.
The image below shows an example of using subfolders in the Firewalls system folder to organize firewalls by the city that they are located in.
More information about creating and managing subfolders can be found on the preliminary documentation here.
Wednesday, June 22, 2011
We are happy to announce that the first version of Firewall Builder v5 is now ready for beta testing. Overall the theme of v5 is to help make it easier to organize and manage large numbers of objects as well as adding support for new features like attached networks and PF configuration imports.
Here's a quick overview of some of the new features that are included in the initial beta version of v5:
- User defined system folders. Add your own sub-folders to existing folders like Firewalls, Networks, etc.
- Object Keywords. Assign keywords to objects and filter the object tree using those keywords.
- Dynamic Groups. Create Dynamic Group objects using the keywords and object type as filters.
- Multiple operations per rule. Specify multiple operations, like tag and classify, in a single rule.
- Attached Networks. Use new Attached Network object to refer to the networks directly attached to interface.
- Improved GUI behavior. Multiple enhancements to make the GUI easier to use.
- PF Import. Import pf.conf configuration files into Firewall Builder.
Over the coming days and weeks I'll be posting more information about each of these features as well as announcing as new Firewall Builder v5 features are added and ready for testing.
This guide includes more information about these new features, including links to updated Users Guide documentation where available.