firestarter — autoswitch between wired and wireless networks 

Ok, so we roam about a lot these days, switching between different networks and different network infrastructures all the time. If you are like me and you use Linux with the Firestarter firewall, you probably wish there was a way to get Firestarter to seamlessly reconfigure between wired networks (say on eth0 interface) and wireless networks (say on wlan0 interface). If that is the case, then do read on, as this post presents a simple approach to achieve just that.

Firestarter is a Linux firewall that includes a nifty front-end graphical user interface (GUI) for back-end configuration of iptables and for event notification. Thus, whatever distro you use, whether it be Ubuntu, Redhat, SuSe or other, Firestarter is your friend if you like the ease of configuration and information display via a GUI. While I am a fan of the Firestarter firewall, there are many features that could be added to further extend its functionality. Unfortunately, the Firestarter project has not been under active development for some years now. Worry not, however, the power and beauty of Linux comes from the fact that it is engineered to be extended.

Lets take a look at a screenshot of the Firestarter GUI (shown below):

Firestarter firewall GUI (screenshot)

To manually reconfigure the "Internet connected network device" (i.e., your external interface) between wired and wireless devices, one can simply click on "Edit > Preferences > Network Settings" and select one of the devices from the "Detected device(s)" list, as shown below:

Firestarter firewall external interface selection dialog (screenshot)

Simple, huh? :) Well if you have to do it very frequently, it will drive you mad. So how does one automate this task? Well, a good place to start is to determine exactly where the external interface setting resides within Firestarter's configuration file. From your favourite shell run the following command:

sudo head /etc/firestarter/configuration

and here is the resulting output:

#-----------( Firestarter Configuration File )-----------#

# --(External Interface)--
# Name of external network interface
# Network interface is a PPP link

# –(Internal Interface–)
# Name of internal network interface

Yours may vary a little, but the important line is the one with the interface highlighted in blue. Note that in this example I am configured on the first wireless device (wlan0), but you may be on a different interface. Anyhow, lets say that in this example I now move to a new location, where instead of using wireless I plugin an ethernet cable to use wired infrastructure through interface device eth0. To reconfigure Firestarter one would first backup the original config file as follows:

sudo cp /etc/firestarter/configuration /etc/firestarter/configuration.backup

and then change wlan0 interface to eth0 interface using sed for example:

sudo sed -i 's:^IF="wlan0":IF="eth0":' /etc/firestarter/configuration

followed by Firestarter restart:

sudo /etc/init.d/firestarter restart

and if all went well, the Firestarter firewall should have successfully restarted, with output similar to the following:

 * Stopping the Firestarter firewall...                              [ OK ]
 * Starting the Firestarter firewall...                              [ OK ]

Note that prior to restarting of the firewall we could have also checked that the sed command worked correctly, using:

sudo grep '^IF=' /etc/firestarter/configuration

with the expected output being:


Ok, so now we can change the interface from shell, but this still is a manual change. Next let us make this change automatic. We could achieve this by periodically checking which interface is configured with an IP address (for example as suggested by Joel Bastos), and possibly using a CRON job. However, there is an easier and better way, as mentioned by Ryan Thompson. Essentially, whenever a new network connection is established (or one gets terminated), scripts placed in a predefined directories will be invoked for specific events (this is a common approach on Linux platforms). For our purposes, we are interested in updating the Firestarter config file each time a new network connection is being established (or just prior to), as long as this happens before the Firestarter firewall is restarted. To do this, let us start by taking a look in the following directory:

sudo ls -lah /etc/network/if-up.d

On my system, the above command produces the following output:

drwxr-xr-x 2 root root 4.0K 2011-02-26 03:32 .
drwxr-xr-x 6 root root 4.0K 2011-02-19 05:29 ..
-rwxr-xr-x 1 root root  256 2011-02-26 03:32 50firestarter
-rwxr-xr-x 1 root root  892 2010-09-13 10:57 avahi-autoipd
-rwxr-xr-x 1 root root  431 2010-09-13 10:57 avahi-daemon
-rwxr-xr-x 1 root root  319 2010-04-23 16:03 mythtv-backend.if-up.d
-rwxr-xr-x 1 root root 1.2K 2010-02-02 18:19 ntpdate
-rwxr-xr-x 1 root root  173 2010-07-12 09:35 openvpn
-rwxr-xr-x 1 root root  225 2010-07-22 07:52 upstart

We are looking for Firestarter's script, highlighted above in red. Notice that it has some numbers prepended. These are used to control the order in which the scripts in the above directory are executed. Lets have a look what's in the highlighted file as follows:

sudo cat /etc/network/if-up.d/50firestarter

which gives:

invoke-rc.d firestarter restart

which essentially restarts Firestarter whenever a new network connection is established… Are you thinking what I am thinking? Lets have a look at what I came up with:

sudo cat /etc/network/if-up.d/50firestarter

which gives:

set -e
if [ "$IFACE" = "eth0" ]; then
    sed -i 's:^IF=".*":IF="eth0":' /etc/firestarter/configuration
if [ "$IFACE" = "wlan0" ]; then
    sed -i 's:^IF=".*":IF="wlan0":' /etc/firestarter/configuration
invoke-rc.d firestarter restart

We could tidy it up a bit further like so:

set -e
if [ "$IFACE" = "eth0" -o "$IFACE" = "wlan0" ]; then
    sed -i 's:^IF=".*":IF="'$IFACE'":' /etc/firestarter/configuration
invoke-rc.d firestarter restart

In the above, prior to Firestarter restart we are checking whether the network interface defined in shell variable $IFACE is one of two predefined interfaces we are interested in and, if so, we update the Firestarter config accordingly and then restart the firewall. Note that prior to changing the above file, you may want to back it up, but obviously do so into a different directory.

That is it from me. Feel free to customise this to suit your needs, test it, try it, enjoy it :)


Did you find the above information useful and interesting? If so, please support this site by using the blog directory links at the bottom of this page. Thanks for your support!

If you have any Linux related problems or questions then please feel free to post them on our Linux Forums:

VPS Hosting Referral Code DZZCC3

Add me to Technorati Favorites Vote for me on Blog Catalog

6 Responses to “firestarter — autoswitch between wired and wireless networks”

  1. cement_head Says:

    I just use UFW and GUFW nowadays and it works much better than firestarter.

    - CH

  2. Connor Says:

    Great! Thank you very much! I was looking for a solution to this problem as I frequently switched from WiFi to Ethernet and always forgot to update the firewall, and actually couldn't believe I had to each time.

    This solution works great.

    Had a look at GUFW but it looks very basic.

  3. John Says:

    It's a little strange. Sometimes it works most of the time it does not. Starting the gui does not indicate problems. However on boot I get an error 2 message. Firewall does not start.
    No idea what to do about it so I simply start a script to change things after the boot sequence. This solved the problem.

    cool article, it helped in the end.


  4. xivi Says:

    Thank you !! You are great !!!

  5. jo Says:

    iptables may be hard to learn but worth it.

  6. Solomon Says:

    Your post shows the contents of 50firestarter as:

    invoke-rc.d firestarter restart

    but mine, after a fresh installation, contains:

    #! /bin/sh

    # quit if this is runlevel 0 or 6 (shutdown)
    RL=`${RUNLEVEL} | sed 's/.*\ //'`
    if [ "x${RL}" = "x0" ] || [ "x${RL}" = "x6" ]; then
    exit 0

    # quit if we're called for the loopback
    if [ "x$IFACE" = "xlo" ]; then
    exit 0

    # quit if the configuration does not exist
    if [ ! -r /etc/firestarter/configuration ]; then
    exit 0

    # Retrieve the configured interface value (IF and INIF)
    . /etc/firestarter/configuration

    # Check if we have the values we need to proceed
    if [ -z "$IF" ] || [ -z "$INIF" ] ; then
    exit 0

    # Are we being called for the same interfaces we are configured with?
    if [ "$IFACE" != "$IF" ] ; then
    exit 0

    # If all the other checks succeed, then restart the firewall
    invoke-rc.d firestarter restart

    Am I supposed to replace all of that default configuration with yours?

Leave a Reply