So I’m a huge fan of fwbuilder, having been a security guy for many years, and having been spoilt by Checkpoint’s SmartDashboard GUI (one of the few things they do well).
Up until recently, I’ve not really needed a GUI for firewall management as we did most firewalling via the CP boxes. Now, with the advent of having to admin over 150 (and growing) Linux VMs, and the
iptables instances therein, fwbuilder fits the bill perfectly.
One of the best things about fwbuilder is its use of XML for configuration files. This means all sorts of useful fun can be had when bulk changes are needed. Still, XML can be hard at the best of times, due to the multi-line structure of it — a topic for another day of hackery.
fwbuilder has a few options in this regard, and I ended up using SNMP, so that the interfaces themselves (and names) are also brought in. The other option was a painful import of the
iptables save/restore stuff, but that would have still meant manual, or automated hackery, to config interfaces.
The issue is that the imports are left pretty raw; you can’t choose a firewall type, which is the management interface, and so on. fwbuilder is lacking in this area of bulk change —
fwbedit gets you some of the way, but not all of the way.
Good ole sed
I’m a Unix guy; always have been, always will be. One of my favourite things is regexps, and with that,
Here’s what I used to at least bulk change
host_OS on the XML:
sed -ie '/platform="unknown" name="au-/s@platform="unknown"@platform="iptables"@; s@host_OS="unknown"@host_OS="linux24"@' yourconfig.fwb
It’s a little lazy, but does the job, using the
unknown text as an anchor. The part of the pattern matching for
au- is just a common starting name for all of our firewalls.
The next issue was bulk-changing the management interface of all the 150+ firewalls.
fwbedit has this capability, but the documentation isn’t the best, hence this blog post.
NoticeThe below is true as of version 220.127.116.1199 of fwbedit (win32).
This format seems to have worked for me:
fwbedit.exe modify -f yourconfig.fwb -o /User/Firewalls/somefirewall -a 0,,1
The syntax for doing modify’s is not all that clear. The doco says:
modify -f file.fwb -o object -c comment [-a attrs]
Modifies object specified by its full path in the tree or object ID. Object can not be renamed using this operation.
-f file.fwb: data file
-o object: object to be deleted, full path or ID
-c txt: specify comment for the new object
-a attribute1[,attribute2…] : specify attributes that
define parameters of the new object (see below)
A few things here — firstly, the comment argument appears entirely optional, but isn’t indicated thusly via the traditional use of square brackets around it. Secondly, the attribute stuff is confusing:
-t Interface -a security level,address type (dynamic or unnumbered),management
It doesn’t show here what arguments are mandatory, their format (boolean, “true/false” etc). After hunting the source, using integers is what seems to work.
Now, with that in mind, we loop over all management interfaces, and set them right:
fwbedit.exe list -f yourconfig.fwb -r -o /FWObjectDatabase/User/Firewalls | grep '.*au-.*/eth0$' | while read id; do fwbedit.exe modify -f yourconfig.fwb -o $id -a 0,,1; done
Here we’re just iterating over the firewalls we’re interested in to get their ID, and then modify accordingly.
I hope this helps someone 🙂