Managing iptables the Easy Way with Shorewall

Raw iptables is powerful but easy to get wrong — one mistyped rule and you're locked out or exposed. Shorewall (the Shoreline Firewall) sits on top of iptables/netfilter and lets you describe your firewall in a handful of readable configuration files. It compiles those into iptables rules for you, so you get the power of iptables with far less risk of a silly mistake.

How Shorewall thinks: zones

Shorewall models your network as zones — named groups of interfaces or hosts. A typical single server has two: the firewall itself and the internet. You then define a policy (the default between zones) and rules (the specific exceptions).

Install it

sudo apt install shorewall

Define zones

# /etc/shorewall/zones
#ZONE   TYPE
fw      firewall
net     ipv4

Map interfaces to zones

# /etc/shorewall/interfaces
#ZONE   INTERFACE   OPTIONS
net     eth0        tcpflags,nosmurfs,routefilter

Set default policies

# /etc/shorewall/policy
#SOURCE  DEST   POLICY   LOG
fw       net    ACCEPT
net      fw     DROP     info
net      all    DROP     info

This says: the server may talk out to the internet freely, all inbound internet traffic is dropped by default (and logged), and we'll open specific ports with rules.

Open the ports you need

# /etc/shorewall/rules
#ACTION      SOURCE   DEST   PROTO   DPORT
SSH(ACCEPT)  net      fw
HTTP(ACCEPT) net      fw
HTTPS(ACCEPT) net     fw
Ping(ACCEPT) net      fw

Shorewall ships with named macros like SSH, HTTP and HTTPS so you don't have to remember port numbers.

Check and apply safely

sudo shorewall check          # validate config
sudo shorewall safe-start     # apply, auto-rollback if you don't confirm

safe-start is the killer feature: it applies the new rules but rolls back automatically after a timeout unless you confirm — so a mistake can't permanently lock you out. Once you're happy, enable it at boot with sudo systemctl enable shorewall.