convert iptables rules to next gen firewall

[RabbieBurns]

Ive inherited a linux box with about 3000 iptables rules, and been tasked with migrating them over to our next gen firewall (its a fortigate..)

 

I was wondering if anyone had a script, or such, or even knew how i could even attempt to write one, that would parse the iptables rules and somehow convert them into a csv or some sort of format that would make it easier for me to import into the new firewall?

 

Any suggestions how to even think about approaching this so I don't have to do this by hand?

 

Thanks in advance.

[Davit2005]

There may be tools to convert from one to another, speak to Fortinet or the partner that supplied the firewall,

 

Personally I'd rather go through the rules and see what is still needed. That's what I done at my last place when migrating firewalls, took a bit more time but prob worth it to clear out the old carp.

 

If you are moving to an application layer firewall from ports you may well be better transferring them over as TCP/UDP ports first and then changing to application in a more gradual fashion.

[RabbieBurns]

there is the FortiConverter app, but doesn't have the source as being iptables..

 

spoke to fortinet PS team locally and they didn't have any suggestions really so I thought maybe Id reach out internationally..

 

Even if i could just parse it to get source and dest details into a CSV, i could script it to then insert into fortiOS format.

[pete]

Dump them to a file using iptables-save (sudo iptables-save ~/iptables-Sep2017

 

Then inspect the filename and grep for themes? say:

 

Source IPs

grep " -s " ~/iptables-Sep2017

 

Destination IPs

grep " -d " ~/iptables-Sep2017

 

etc...

 

You should be able to dump those results to CSV (probably by search/replacing spaces for commas). Just keep an eye on rule order.

 

Of course, I'm assuming you mostly care about rules for specific IPs and connection tracking rules will be done using the Fortigate config.

[Opendium_Steve]

iptables is far more powerful than anything with a friendly UI, so you're going to struggle to find a generic iptables -> something-else converter. You can probably put something together to handle the more restricted subset of iptables' functionality that you're actually using though.

 

I wouldn't mind betting that going through the rules by hand would be better than automating it though - it'll give you chance to review and understand the rules you have in place, remove any that no longer make sense and generally tidy up. We usually migrate firewall rules for new customers by hand and it always turns up a few "WTF?!" moments when it turns up rules that really shouldn't be there!