Skip to content
Register

What do you use for firewall management across many boxes?

General Discussion by jane_ffm 18 replies 2.1K views
jane_ffm

Member OP

10 #1

Hi all — we're managing ~40 edge nodes across three providers (Contabo, plus some legacy at Hetzner and InterServer). Currently using a mix of:
• ufw on Ubuntu 22.04 LTS
• firewalld on Rocky 9
• raw iptables on one ancient Debian 10 box we can't touch

The inconsistency is becoming a pain. Before I build something in-house, what are you all using for firewall management at scale? Happy to check specific setups via DM if helpful.

— Jane @ Contabo

Single mode till I die 💀
haroldgsm

Member

Grumpy Old Sysadmin

#2

Twenty years in this business, and I've watched "solutions" come and go. Kids these days want abstraction over abstraction. Mark my words: your Ansible playbook will rot in eighteen months when someone pins an incompatible Python version, and you'll be debugging Jinja2 templates at 3 AM while the site burns. The pessimist's truth: there is no clean answer, only different messes.

IPv4, IRC, and irssi — fight me
pablo

Member

#3

Wey I use ansible role I found on github, it handles iptables, nftables, ufw, firewalld todo en uno? You write one yaml and it translates. No more mixing wey. I run it on 60 vps no problem. Maybe check it wey, is called "universal-fw" or something. Double check the galaxy tags!

declarative or death
MA

Member

#4

You know I tried puppet for this back in the day. You know it was maybe overkill. You know ansible is lighter but maybe you know someone always forgets to commit the vault password. You know I just use wireguard and call it a day...

garykwh

Member

Inference on a Budget

#5

Ngl for LLM inference clusters I just need port 22 and the API port open, everything else is internal VPC. VRAM math says I'd rather spend brain cycles on batch sizing than firewall rules. That said, @pablo's ansible approach sounds smart for mixed fleets. I stole a similar role for my homelab — handles docker's iptables mess too.

CUDA cores are my love language
haroldgsm

Member

Grumpy Old Sysadmin

#6
jane_ffm said:
~40 edge nodes across three providers

Three providers means three bills, three support queues, and three ways to get burned when one of them "restructures" their API. I've been there. The real problem isn't the firewall tool, it's the heterogeneity. Pick one provider, standardize on one OS, and your "problem" evaporates. But nobody wants to hear that because it involves work.

IPv4, IRC, and irssi — fight me
ana_mad

Member

#7

I manage a similar setup, smaller though — about 15 boxes, mix of Contabo in Nuremberg and some Hetzner Falkenstein leftovers. I went with nftables everywhere and a simple shell script pushed via ssh. No Python, no Jinja2, no galaxy tags. Just 

nft -f
and a file in 
/etc/nftables.conf
. Debian 10 has backports for nftables, by the way. Your "ancient" box might not be as stuck as you think.

swimming upstream since 2019 🐟
garykwh

Member

Inference on a Budget

#8
ana_mad said:
Handles docker's iptables mess too

Yeah so about that — the ansible role I stole actually *broke* docker networking twice because it flushes FORWARD. Had to add a 

keep_docker_chains: true
flag or whatever. Just warning @pablo and anyone else, test your API containers before you pat yourself on the back.

CUDA cores are my love language
pablo

Member

#9
garykwh said:
Test your API containers

Good catch wey. I don't use docker much so I didn't know. The role I use is "universal-fw" by some guy from Netherlands I think? It has 

docker_compat
variable but default is false. I set it true now, gracias.

declarative or death
LI

Member

1 #10

I'm in Tallinn running mostly Hetzner Helsinki and some local Estnoc gear. For my size — 8 boxes — I use Terraform for provisioning and cloud-init to drop a standardized nftables config. The cloud-init part means even if someone reinstalls from rescue, the firewall comes back identical. Not sure if Contabo's rescue mode respects user-data though. Their Munich panel is... basic.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft