I am looking for a solution to be able to distribute and sync firewall rule-sets to multiple devices. There are a few solutions out there such as Playbook by Matasano but it comes with an expensive price tag.

Is anyone familiar with any other solutions that are cheaper or ideally free and allow for the syncing of Cisco and iptables rule-sets?


A couple engineers I know are using puppet to maintain iptables rule sets.


  • Puppet looks really interesting. Going to give it a go next week. – Mark Davidson Nov 27 '10 at 20:19
  • I'm one of those 'engineers'. I use the first method, and it works great. I have on my list testing the second. – Scott Pack Dec 11 '10 at 4:40

Most enterprise class firewalls (I know Check Point and MS ISA, I'm sure others too - but not iptables) allow you to distribute rulesets etc to all the managed firewalls, from a single management console.

Of course, thats each for a single vendor's product... For different types of firewalls, I'm familiar with Tufin, but I think they're pretty high-end - and expensive.


FWbuilder might be of interest to you http://www.fwbuilder.org/

This is a GUI tool to help you configure and distribute (i.e. push) firewall configurations for various firewall implementations.

It 'compiles' network access rules and firewall configuration options into version specific syntax and can push it through SSH to many firewall implementations like Cisco ACL's, iptables, and openbsd PF.

Central management of various devices in combination with version control of the rulesets of these nodes is a production quality feature that can also be seen in enterprise firewall management applications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.