I have been doing modifications and customization of sme server firewalls for some years, and my experience from now, is that the SME server firewall can do and will be capable of doing all kind of firewalling and firewall modifications that the Linux kernel is capable of including also, of cource VPN arrangements, as required.
During the years I have changed and used different ways of doing these modifications.
One comman factor up trogh the years have been that giving advices or asking questions about how to make firewall solutions often leads to "no answer at all" or heated discussions with flaming, etc.
During the early ears I certainly did "brake the rules" by simply flushing out the template generated firewall configuration and applying a new firewall configuration, to be able to focus on the firewall side of the problem, and because I did not know the SME server well enough to do it in any other way.
Today I do not brake the rules any more technically, as they are described in the original e-smith design documents. Actually I use some the original e-smith design documents as basis for how I does the firewall modifications today. This will mean that the firewall modifications is done via the template system.
Even though the way I does the firewall modifications might be correct enough according to the original e-smith design documents, it still might not be considered to be "ideological correct" for the sme server of today. (As it open up for the option that the local administrator can take the full controll of the firewall behaviour and apply any kind of modifications, including bridge mode firewalling, more than two network adapters, impementation of wireless cards and wireless card firewalling, all kind of VPN arrangements, etc, etc.)
There are arguments, I think, why local administrators should not have such a freedom. One of them is that such a "full control" og the firewall nessesarely will lead to a situation where a number of SME servers will be incorrectely configured so that an adequate security level is lost. One other argument is that incorrect configured firewall often will lead to a incorrect believe that it is something wrong with the server configurations, so there will be a number of "false positive" bug reports, where the real bug is only an incorrect firewall modification.
So the situation is that anything that can be done without any "limitation" and with the full freedom can also be done wrong. With a firewall this will often be "bad".
If there is an agreement that it is ok to inform how to do firewall modifications with the full freedom and within the framework of the template system, and as discribed in the original e-smith documentation, I think I can mention it.
If the negative sides of such information is considered to be greater than the positive, I can also keep this information for myself.
As I in the end managed to get out the information I neded to do any kind of firewall modification I need, using the template system, and the automated configuration system, I don't need any more discussion on this subject for my own part.
There is on the other side a lot of new things that could be done, if it were a free and open discussion on this item, without any bad or negative feelings or emotions.
Such a discussion would lead to a situation where the sme server can do anything on "the firewall side" that the Linux kernel can do, while also it will lead to a situation where a nuber of sme servers might be incorrect configured, while local administrators are learning Linux firewalling the hard way, while some sme servers might be hacked due to reduced and even destroyed security.
I think that there is some good arguments not to have such a free and open discussion, and to keep the secret "how to take the full control over the firewall via the template system" as it is "a secret from the old e-smith days".
I simply don't know.
One thing that also is fore sure is that doing the modifications only as described in this tread, above, will lead to some situations with "no solution at all", while the solution actually and technically, easy could have been there. So will also the option of destroying the security of each of the sme server installations. That is the small dillemma.
So when administratior of this board are flaming or locking out such information, they actually have good reasons, but it is more easy to just say: "Don't post it."
Can any firewall modification be rather easily done, including any VPN adaption and configuration ? Yes and no, that depends on a number of factors.
On the other side it is a bit strange to se a firewall question that could easy be solved staying there as unsolved, because information can not be given, in an open source forum.
13 Replies
1447 Views