Re: location based firewall

[Dan Williams <dcbw redhat com>]

On Sat, 2011-03-05 at 10:52 +0100, Ma Begaj wrote:
> 2011/2/28 Matej Kovacic <matej kovacic owca info>:
> > Hi,
> >
> >> I have that setup. I solved it with scripts in
> >> /etc/NetworkManager/dispatcher.d/.
> > ...
> >> you find UUIDs on command line with "nmcli con".
> >
> >
> > That is very nice and opens possibilities for developing location based
> > firewalls. For instance, when I am at home, I want to have my samba
> > share open, but when I am on wireless connection, I want to have
> > everything closed.
> 
> 
> I have exactly that. I have a collection of scripts which do similar
> thing with my setup:
> 
> Wireless connection to HOME is established:
> - start VPN connection to XXX
> - start SSH tunnels
> - open firewall for some external connections
> - rsync backup my /home folder with a server
> 
> And when wireless connection is gone ssh tunnels will be "killed",
> firewall closed, vpn stopped...

We've talked about this sort of vague plan in the past, tweaking the
firewall settings based on your location.  Obviously that doesn't work
so well for wired because you're never 100% what network you're
connected to, but for wifi if the AP requires a passphrase or is WPA
Enterprise, you're pretty sure you can trust your location.

The UUID goes a long way towards helping with this, but there are
fundamentally two approaches:  either we have some sort of NM plugin
manipulate the firewall, or we have the firewall listen to NM... either
are doable.

Dan