Please add support for Host groups

[Robert Drake]

I was thinking that being able to specify groups of hosts would be very handy and could work like the app list. Basically make a hostgroups.d folder and have entries that look like this:

[Internal]
title=Internal systems
description=This is some servers we generally trust
nets=192.168.1.0/24, 192.168.0.0/24, 172.16.0.0/24

Which would then change into:

$IPTABLES -A Internal -s 192.168.1.0/24 -j ACCEPT
$IPTABLES -A Internal -s 192.168.0.0/24 -j ACCEPT
$IPTABLES -A Internal -s 172.16.0.0/24 -j ACCEPT

It could then be referenced by saying:

ufw allow from hostgroup Internal to any port 22
ufw allow from hostgroup Internal to any port 80,443 (or some other policy)

Which would turn into rules sort of like this:

$IPTABLES -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j Internal
$IPTABLES -A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -j Internal
$IPTABLES -A INPUT -p tcp -m tcp --dport 443 -m state --state NEW -j Internal

I know this is a complicated wishlist request and I hate to ask so much without doing the work. I attempted to start on a patch but my python is pretty pants so I fear it might work but not be what you would want to integrate (I do a bunch of functional programming). I'll attempt to produce something usable if you don't have time but are interested in the idea.

For completeness and following the bug reporting guidelines, I'm running debian 6.0.1 (squeeze) and ufw 0.29.3-1. I checked the changelog on the later versions and don't think this has been added.

[Jamie Strandboge (jdstrand)]

FYI, this could also be achieved with ipsets and using the ufw-framework. See https://bugs.launchpad.net/ufw/+bug/1571579/comments/2 for inspiration.