I don't like this: http://www.debian-administration.org/articles/445
because every time there is slight change in firewall rules, all that would have to be done again and again.

is there a simpler way?

Well, that's entirely up to you of course...

Well, that's not really true...you could edit your ruleset and save it, to your rule-save-location. That's easy, it works.

But it isn't the only way to do things by any means.

Oh, yes. But first, you don't want the advantage of the way that you don't like, do you? That is, about the only sensible (?) way of getting the packet counters to survive across reboots is to use the iptables-save and iptables-restore route, so if you want that 'feature', than you might want to reconsider how much you don't like it.

So, then you have the option of using one of the graphical front-ends to generate a ruleset. Now I never managed to find one that I really liked, but YMMV.

Alternatively (and I think that this is the best solution), run a script on start up that generates your ruleset. this implies that you can write a bash script (other shells are available) that generates a set of rules that gives you the firewall that you want.

1 members found this post helpful.

I don't know what 'packet counters' are, but ok.
I had put the script that starts iptables (output from 'Firewall Builder') into startup, will do it your way if it so much better.

Ahhh, something I can explain.

Packet counters are counters that count packets. You can count the packets that are processed by each chain, and maintain a count that just goes up and up as traffic passes. Most people don't use them, but they can be quite handy in certain circumstances. What would be more difficult would be if you have a box that does get re-booted every so often (in the way that most servers don't, except by accident), and need the counts of packets to carry on accumulating after the re-boot.

It sounds as if you don't need that, but, if you did, you would have to look at iptables-save and iptables-restore for the appropriate options. Documented in the man pages.

Better? Worse? More a case of 'appropriate' or 'inappropriate'. Getting a bash shell script to generate your ruleset for you is flexible and relatively easy and, with thought, the issue of minor changes (for example, if you have to change subnet addresses) can be almost trivial. See examples:
http://www.yolinux.com/TUTORIALS/Lin...rkGateway.html
http://www.linuxhomenetworking.com/w...Using_iptables

and, if you wanted closer to a manual:
http://iptables-tutorial.frozentux.net/

if you google (other search engines are available) on 'iptables' and 'tutorial', you will find more information than you can read.

1 members found this post helpful.