This is a problem because it forces the use of black-lists.
An example follows:
A network with 6 segments. Each with different policy and access between each other. There should be possible to access the internet from some or all this segments. What we do not want is to have free access between the segments. Therefore the segments
With astaro today this seems to be done in an utterly ugly and insecure fasion.
To have access to internet one have to use the destination any. But this is not right!
One then have to add deny-rules before this rule to avoid uncontrolled access to the other segments.
This adding of deny-rules is called a black-list. Astaro is supposed to use white-lists but this falls apart when you have a couple of segments.
In the case of 6 segments one need not 6 rules to give them access to the internet. One need 6*6 = 36!
Have i missed sometihing or is astaro just not meant to be used for more than internet-dmz-internal?
By the way, what happened to the filter number in the logs?
This thread was automatically locked due to age.
