Firewall UI for policy rules

[alefattorini (Alessio Fattorini)]

It’s not just a question about “fake NethServer”. yes, we have to improve it with many features by web interface but I don’t like exploding NethServer with zillions of confusing settings, we’d rather have sensible out-of-box defaults that work for 90% of users and can be tweaked. But in some cases the needs are so divergent that a new setting must be added. This should be a method of last resort in my opinion. Don’t you think?
We have discussed it in many topics, for example:

RFC: interface complexity level

I don’t like very much the ability to change the listening port from the web interface except for few exceptions. A good example of this exceptions can be SSH or OpenVPN (as pointed out by @stephdl (https://github.com/nethesis/nethserver-openvpn/pull/2). Changing ports for these kind of daemon is a well-known practice. But if we want to give this chance to the user, I don’t see any problem for non-critical services like FTP, but I’d strongly discourage for other important services (like IMAP/…

How about we move forward there?

[Jim]

In what showing all the rules will add complexity?

It will add informations to display, it will add transparency about the configuration… But complexity, no.

[GG_jr (Gabriel GHEORGHIU)]

@alefattorini

It’s not just a question about “fake NethServer”

Sorry for “fake NethServer”. Is not about the meaning of “fake”.
In that moment I didn’t find a word for “not fully functional NethServer”! Neither now!

@alefattorini

community.nethserver.org

RFC: interface complexity level

I don’t like very much the ability to change the listening port from the web interface except for few exceptions. A good example of this exceptions can be SSH or OpenVPN (as pointed out by @stephdl (* Sun May 10 2015 stephane de Labrusse <stephdl@de-labrusse.fr> - 1.2… by stephdl · Pull Request #2 · NethServer/nethserver-openvpn · GitHub). Changing ports for these kind of daemon is a well-known practice. But if we want to give this chance to the user, I don’t see any problem for non-critical services like FTP, but I’d strongly discourage for other important services (like IMAP/…

How about we move forward there?

It’s OK for me but I maintain my opinions!

The sysadmin, by definition, must do everything. It is her/his job!
Why do you think that a sysadmin can damage a server only from GUI and from CLI cannot?
Why somebody who is not sysadmin can reach the NS settings?
The users have their own GUI, without interfere with NS settings.

[stephdl (Stéphane de Labrusse)]

@GG_jr

The sysadmin, by definition, must do everything. It is her/his job!

That’s sound me something : NethSever-HijackSettings

The purpose will be to bring to light all hidden settings, but the module whose purpose is to parameterize all services will be quickly a giant octopus

[GG_jr (Gabriel GHEORGHIU)]

@stephdl

The purpose will be to bring to light all hidden settings, but the module whose purpose is to parameterize all services will be quickly a giant octopus

You are right. But others did it! We compare NS with others. From where? From what? Which is the “level” from where we will start to compare?

I like to compare NethServer with Sophos and Endian as UTM and with Zentyal as Email server and DC.

[Francenildo]

This policy-based routing is running perfectly. Approved!