Alpine Wall - Revision history

Prabuanand: changed to :Category:Firewall

2025-04-09T11:21:58Z

← Older revision		Revision as of 11:21, 9 April 2025
Line 145:		Line 145:
	* [[Zero-To-Awall]]		* [[Zero-To-Awall]]
	* [[How-To Alpine Wall]]		* [[How-To Alpine Wall]]

	~~[[Category:Networking]]~~
	~~[[Category:Security]]~~
	[[Category:Development]]		[[Category:Development]]
			[[Category:Firewall]]

Sertonix: update link

2023-08-25T11:42:21Z

update link

← Older revision		Revision as of 11:42, 25 August 2023
Line 102:		Line 102:
	we select this approach and model the data using XML, we could use XML		we select this approach and model the data using XML, we could use XML
	Schema as the basis. There is also an (expired) Internet Draft on		Schema as the basis. There is also an (expired) Internet Draft on
	[https://~~tools~~.ietf.org/html/draft-zyp-json-schema-03 JSON Schema], but		[https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-03 JSON Schema], but
	there seems to be no existing validator implementation in C or Lua.		there seems to be no existing validator implementation in C or Lua.

Zcrayfish: Rescued a dead link. Changed other links to https. Marked an http-only link.

2023-07-26T20:31:53Z

Rescued a dead link. Changed other links to https. Marked an http-only link.

Arrogance at 07:31, 30 May 2023

2023-05-30T07:31:22Z

← Older revision		Revision as of 07:31, 30 May 2023
Line 1:		Line 1:
			{{obsolete}}
	This page is a design and implementation plan for a new firewall		This page is a design and implementation plan for a new firewall
	management framework. The new framework addresses the limitations		management framework. The new framework addresses the limitations

John3-16: Added internal link to awall package; added See also: Zero-To-Awall, How-To Alpine Wall

2017-10-12T02:07:38Z

Added internal link to awall package; added See also: Zero-To-Awall, How-To Alpine Wall

← Older revision		Revision as of 02:07, 12 October 2017
Line 20:		Line 20:
	Framework]]		Framework]]
	(ACF). The framework is hereafter referred to as the Alpine Wall		(ACF). The framework is hereafter referred to as the Alpine Wall
	(awall).		({{Pkg\|awall}}).

	== Design ==		== Design ==
Line 140:		Line 140:
	will be stored in the target files, so there will be no need to		will be stored in the target files, so there will be no need to
	resolve anything when activating the configuration during boot.		resolve anything when activating the configuration during boot.

			== See also ==
			* [[Zero-To-Awall]]
			* [[How-To Alpine Wall]]

	[[Category:Networking]]		[[Category:Networking]]
	[[Category:Security]]		[[Category:Security]]
	[[Category:Development]]		[[Category:Development]]

Dubiousjim: add Category:Security

2012-06-01T13:03:12Z

add Category:Security

← Older revision		Revision as of 13:03, 1 June 2012
Line 141:		Line 141:
	resolve anything when activating the configuration during boot.		resolve anything when activating the configuration during boot.

	[[Category:Networking]] [[Category:Development]]		[[Category:Networking]]
			[[Category:Security]]
			[[Category:Development]]

Jiufpt: /* Implementation Considerations */

2012-05-16T18:41:39Z

Implementation Considerations

← Older revision		Revision as of 18:41, 16 May 2012
Line 100:		Line 100:
	requirements on the language, e.g. support for complex data types. If		requirements on the language, e.g. support for complex data types. If
	we select this approach and model the data using XML, we could use XML		we select this approach and model the data using XML, we could use XML
	Schema as the basis. There is also an (expired) Internet Draft on		Schema as the basis. There is also an (expired) Internet Draft on
	[http://tools.ietf.org/html/draft-zyp-json-schema-03 JSON Schema], but		[http://tools.ietf.org/html/draft-zyp-json-schema-03 JSON Schema], but
	there seems to be no existing validator implementation in C or Lua.		there seems to be no existing validator implementation in C or Lua.

Jiufpt: /* Base Model */

2012-05-16T18:40:18Z

Base Model

← Older revision		Revision as of 18:40, 16 May 2012
Line 73:		Line 73:

	Subnets in zone definitions can be declared using IPv4/IPv6 addresses		Subnets in zone definitions can be declared using IPv4/IPv6 addresses
	(CIDR notation), domain names, or as references to		(CIDR notation), domain names, or as references to
	[http://ipset.netfilter.org/ipset.man.html ipsets]. A domain name can		[http://ipset.netfilter.org/ipset.man.html ipsets]. A domain name can
	resolve to one or more IP addresses. The referred ipsets may be		resolve to one or more IP addresses. The referred ipsets may be
Line 80:		Line 80:
	If a packet with source address ''a'' arrives on interface ''i'', it		If a packet with source address ''a'' arrives on interface ''i'', it
	is considered to originate from zone ''Z = (I, S)'' (where ''I'' is		is considered to originate from zone ''Z = (I, S)'' (where ''I'' is
	the set of interfaces and ''S'' is the set of subnets) if and only if		the set of interfaces and ''S'' is the set of subnets) if and only if
	''I'' includes ''i'', and ''a'' belongs to any subnet of ''S''. In		''I'' includes ''i'', and ''a'' belongs to any subnet of ''S''. In
	zone definitions, ''I'' would default to the set of all interfaces and		zone definitions, ''I'' would default to the set of all interfaces and
	''S'' to {0.0.0.0/0, ::}. The destination zone would be defined in a		''S'' to {0.0.0.0/0, ::}. The destination zone would be defined in a
	similar way based on the packet's destination address and interface.		similar way based on the packet's destination address and interface.

Dubiousjim: Category:Network/ing

2012-03-12T09:04:09Z

Category:Network/ing

← Older revision		Revision as of 09:04, 12 March 2012
Line 141:		Line 141:
	resolve anything when activating the configuration during boot.		resolve anything when activating the configuration during boot.

	[[Category:~~Network~~]] [[Category:Development]]		[[Category:Networking]] [[Category:Development]]

Dubiousjim: Categories

2012-03-12T09:00:56Z

← Older revision		Revision as of 20:31, 26 July 2023
Line 34:		Line 34:
	would also borrow some useful concepts from other firewall solutions		would also borrow some useful concepts from other firewall solutions
	we evaluated, such as the Service concept as defined in the		we evaluated, such as the Service concept as defined in the
	[http://www.turtlefirewall.com/manual-en/x161.html Turtle Firewall]		[https://web.archive.org/web/20170903195133/http://www.turtlefirewall.com/manual-en/x161.html Turtle Firewall]
	(but generalized a bit). Awall plug-ins can contain schema extension		(but generalized a bit). Awall plug-ins can contain schema extension
	modules augmenting the basic model provided by the framework.		modules augmenting the basic model provided by the framework.
Line 75:		Line 75:
	Subnets in zone definitions can be declared using IPv4/IPv6 addresses		Subnets in zone definitions can be declared using IPv4/IPv6 addresses
	(CIDR notation), domain names, or as references to		(CIDR notation), domain names, or as references to
	[~~http~~://ipset.netfilter.org/ipset.man.html ipsets]. A domain name can		[https://ipset.netfilter.org/ipset.man.html ipsets]. A domain name can
	resolve to one or more IP addresses. The referred ipsets may be		resolve to one or more IP addresses. The referred ipsets may be
	managed manually or by some other tool.		managed manually or by some other tool.
Line 102:		Line 102:
	we select this approach and model the data using XML, we could use XML		we select this approach and model the data using XML, we could use XML
	Schema as the basis. There is also an (expired) Internet Draft on		Schema as the basis. There is also an (expired) Internet Draft on
	[~~http~~://tools.ietf.org/html/draft-zyp-json-schema-03 JSON Schema], but		[https://tools.ietf.org/html/draft-zyp-json-schema-03 JSON Schema], but
	there seems to be no existing validator implementation in C or Lua.		there seems to be no existing validator implementation in C or Lua.

Line 126:		Line 126:
	using a template language rather than a general-purpose programming		using a template language rather than a general-purpose programming
	language. An example of a firewall-related template language is		language. An example of a firewall-related template language is
	[~~http~~://ferm.foo-projects.org/download/2.1/ferm.html ferm], which		[https://ferm.foo-projects.org/download/2.1/ferm.html ferm]{{insecure url\|Expired self-signed certificate}}, which
	unfortunately is implemented in Perl. Ferm also lacks certain		unfortunately is implemented in Perl. Ferm also lacks certain
	capabilities required to implement e.g. the Zone and Service concepts		capabilities required to implement e.g. the Zone and Service concepts

← Older revision		Revision as of 09:00, 12 March 2012
Line 140:		Line 140:
	will be stored in the target files, so there will be no need to		will be stored in the target files, so there will be no need to
	resolve anything when activating the configuration during boot.		resolve anything when activating the configuration during boot.

			[[Category:Network]] [[Category:Development]]