Linux Firewall – How to Turn Iptables Stateless

If you're perhaps wanting to make a move from a rule-driven approach to a "describe the final state required" way of doing things, have a look at fwbuilder.

Pros:

• multiple firewalls supported - your core + host-based rules - from 1 set of objects
• SQL-esque "tell me what you want" rather than "tell me how to do it" approach (NB I'm not saying there's any SQL in there! Just that it's descriptive Vs procedural :-)
• It's a GUI, kinda like commercial hardware f/w vendors' interfaces, so it's possible to push some tasks down the employee/skills stack
• supports most "wierd' usage I've tried
• can generate rules for a variety of f/w implementations - BSD/cicso/iptables/etc
• seperates front-end from rule-compiler, which makes me hopeful that speed is a concern to the authors. NB I've nothing near the scale to which you're alluding
• File format isn't binary
• does IPv6
• Creates an iptables-save stylee config for atomic and quick loading

Cons:

• It's a GUI
• Moving your existing ruleset is unlikely to be pain-free
• Whilst GPL and in Debian, Windows+OSX clients are 30-day eval, as no-one's cross-compiled a Free version yet for those OS; hence the commercial arm of the devs has a monopoly on those binaries
• File format is technically XML; NB don't let this put you off: take a look at the tools that they provide (you can use the gui binary to manipulate it via the CLI for example), the CLI XML tools that already exist, and remember that - at your scale - some semblance of meta-data + structure ain't a /bad/ thing! It diffs quite nicely across edits, IIRC.

Link : http://www.fwbuilder.org

Have you tried loading your new rules with the iptables-restore command? This is in theory an atomic operation, which may take care of most of your issues. This does require that you write your rules in the format used by iptables-save.