README.md in shutter-0.0.3 vs README.md in shutter-0.0.4
- old
+ new
@@ -1,25 +1,68 @@
# Shutter
-TODO: Write a gem description
+Shutter is a tool that enables system administrators the ability to manage
+iptables firewall settings through simple lists instead of complex iptables commands. Please note:
+This application currently only works with Red Hat based distributions, as the need arrises more
+distributions will be added.
## Installation
-Add this line to your application's Gemfile:
+Instalation is through the gem package management program.
- gem 'shutter'
+ $ gem install shutter
-And then execute:
+## Usage
- $ bundle
+#### Install the gem.
+
+ $ gem install shutter
-Or install it yourself as:
+#### Create the initial configuration files.
- $ gem install shutter
+ $ shutter --init
-## Usage
+#### Modify the files to meet your required settings.
-TODO: Write usage instructions here
+There are several files that you can modify:
+* **base.ipt:** The one file to rule them all. Modifying this file is optional as
+it is the template that is used to build the firewall. If you do modify the file,
+just make sure you include the appropriate placeholder directives to allow
+shutter to dynamically fill in the rules. It is possible to leave out any unwanted
+placeholders. By default the files are will be found in the */etc/shutter.d* directory
+* **iface.dmz:** Enter any private interfaces that will be unprotected by the firewall. One per line.
+* **ip.allow:** A list of IP addresses and ranges that are allowed to access the 'private' ports
+* **ip.deny:** A list of IP addresses and ranges that are denied access to both public and private ports.
+* **ports.private:** A list of ports and protocols that are available to traffic that passes through the AllowIP chain
+* **ports.public:** A list of ports and protocols that are available publically to everyone except the 'Bastards' listed in ip.deny
+
+Shutter was designed to work with the Fail2ban access monitoring/management tool. It includes a
+special chain called 'Jail' which is used to insert the jump rules that fail2ban uses to deny access 'on-the-fly'.
+To work correctly, you configure fail2ban to use the Jail chain instead of INPUT.
+
+#### To check your firewall you can run:
+
+ $ shutter --save
+
+This command mimics the 'iptables-save' command which prints the rules out to the screen.
+This does not modify the firewall settings.
+
+#### To implement the changes, use:
+
+ $ shutter --restore
+
+This command uses 'iptables-restore' under the hood to update the firewall. You can use the '--persist' option
+to make the changes permanent and survive reboots.
+
+#### Useful environment variables:
+**SHUTTER_CONFIG:** Use this variable to set the location to the configuration files.
+
+**SHUTTER_PERSIST_FILE:** Use this variable to set the location of the 'persist' file. i.e. /etc/sysconfig/iptables (default for Redhat)
+
+**SHUTTER_MODE:** Sets the mode of operation. Currently only used for testing, but in the future it will include a development mode for increased log output for automated runs
+
+More documentation to come...
+
## Contributing
1. Fork it
2. Create your feature branch (`git checkout -b my-new-feature`)