Migration from Linux iptables to pfsense. How'd you do that?

senseless

Hi list,

I have an old linux fw (kernel 2.4.x) with iptables and want to set up pfsense with CARP bases on those rules. There are more that 600. I set up two boxes with CARP already a while ago. So I'm kind of familiar with it.

The questions are 1. How to migrate and 2. How to manage 600 rules in the GUI.

I found two promising approaches.

https://doc.pfsense.org/index.php/Adding_Rules_With_easyrule
Maybe someone has a script or an idea?

http://www.fwbuilder.org/index.shtml
That looks even better. Has someone tried that out? Kernel 2.4.x is supported though.

Now managing the rules. A typical task for example is to find a particular host and grant access to ftp or ssh. As far as I saw it that could be quite tiresome given that you have hundreds of hosts. Am I just missing something here?

Greetings,

senseless

jimp

Sounds like a good time to re-evaluate the ruleset and make use of Aliases to reduce that to a manageable set. It's unlikely that 600 unique rules would truly be required.

easyrule might help but it's probably not flexible enough to do the whole job.

senseless

Well, the current rules on the Linux box are like this. host1 is allowed ftp and http, host2 ssh from 2 different addresses and https, host3 mysql to another host and so on. All that adds up to 600 rules. Maybe just 500 after cleansing.

OK, then I try fwbuilder first.

senseless

heper

i think it might be better to create groups ?
as in an http-group with all hosts that are allowed to use http | and ftp-group with all hosts that are allowed to use ftp | ….
that way you could seriously limit your FW-rules.

btw replace "groups" with 'aliases' for use in pfSense

senseless

Thanks. I just played with aliases and rules a bit. I got the concept. That way I might have a few standard rules and a bunch of special ones and that's it.

senseless

I just had a look at fwbuilder. Alas it is too complicated and prone to flaws if you try to transform iptables to pf. Next problem is having a pf file which needs to be merged into the pfsense file. I read you shouldn't edit rules within the according file.

Back to aliases. Often there is a host which is allowed http and https and ssh and ftp. In that case I have to put the same IP into four aliases? Is there a better approach?

Sorry, but I really have a lot of hosts and hence rules which apparently need to be typed in by hand. Thus I want it to be as painless as possible.