Testing new iptables policy compiler fwb_ipt


First of all, download and install package fwbuilder-ipt-1.0.2-1.i386.rpm (actual package name may vary as I add suffixes to distinguish packages built for different distributions). This package installs binary /usr/bin/fwb_ipt and man page fwb_ipt(1).

Do not deinstall old compiler package fwbuilder-iptables just yet! Having the old compiler provides you with a simple way to regenerate the old firewall script should something go wrong with the new one, or if new compiler has bugs and produces wrong iptables code. In that case simply revert changes made in your data per instructions on this page and regenerate and reinstall your firewall script.

Using new compiler does not make any changes to your data file, except program stores the name of the compiler if you test through the GUI. This change is easy to revert and does not affect your objects and firewall policy in any way. However always remember to make backup copy of your data file before you start experimenting!

Testing can be done in two ways: running compiler from within the GUI or on the command line.

Testing using GUI


Start the GUI and load your data file. Next, open firewall object and switch to dialog tab called "Compile / Install". Locate entry field called "Compiler (if different from default)" and type there "fwb_ipt" without quotes. Here is how it looks like:

Command line option -v makes policy compiler print messages that indicate operation progress on the console.

Once this change has been done and applied in the GUI, save data file using menu "File/Save" and compile your policy as usual using menu "Rules/Compile".

Testing on the command line

To test on the command line simply run new policy compiler manually, supplying it with the following parameters:

     fwb_ipt [-v] -f data_file.xml firewall_object_name
    

More information about command line parameters can be found in the man page fwb_ipt(1).

Compiler creates file in the current directory with the name the same as that of the firewall object, plus suffix ".fw". This file contains produced firewall script.