1. Why is there a difference between groups and inline groups?

2. Why do network configuration (zones, firewall, interfaces) has to be declared in wallfire configuration file?

3. I don't like firewalling systems that add implicit rules. It's obscure, and does not encourage new users to progress.

4. Why did you make the rules description somewhat polymorphic? (allow blocs, making criterias order independant within a rule, etc.). Don't you think it may be a little bit confusing for the user?

1. Why is there a difference between groups and inline groups?

Answer: First, be sure to read the description of groups and inline groups.@@
The notion of group exists in nearly every firewalling backend WallFire uses. But inline groups is mostly a WallFire thing: it enables to write your own macros, with potential arguments.
Note that the rules contained in a macro (inline groups) do not need to contain a target, because inline groups are substituted directly into the rules that uses them.
WallFire ships with a set of powerful macros that cover many common cases (such as DNS access with requests only or zone transfers, Web proxy access, etc.), and you can create your own reusable ones.

2. Why do network configuration (zones, firewall, interfaces) has to be declared in wallfire configuration file?

Answer: Because it is not desirable or not always possible to rely on runtime configuration (stored into the kernel). May that seem redundant in some case, it enables to detect any incoherency (as far as undesired changes) in the runtime configuration.

3. I don't like firewalling systems that add implicit rules. It's obscure, and does not encourage new users to progress.

Answer: WallFire is intented to be used by a large audience. It generates implicit rules for those who don't care about firewalling so much that they probably wouldn't even install any firewall at all if they hadn't any firewall software that keeps things as simple as possible.
But it will also feature a non-implicit mode for those who want one, and specialists will always have the choice to use the underlying native firewalling system if they want, including by taking the template generated as a starting point.

4. Why did you make the rules description somewhat polymorphic? (allow blocs, making criterias order independant within a rule, etc.). Don't you think it may be a little bit confusing for the user?

Answer: It's always the same debate:

• flexibility, power, potential confusions for newcomers
• rigidity, intelligibility, and impossibility for experienced users to do elegant things

Note: this page is generated by a template. Be aware of this before submitting patches containing formatting information against this page.