Firewall/IDS Monowall and Snort?

Okay, here is the deal... I'm wanting to setup a firewall at home and incorporate an IDS such as snort. I'm considering using m0n0wall but it looks like I would have to install my IDS on a seperate machine as oposed to say IPcop which would allow me to install snort. Is this because IPcop is linux based and m0n0wall is BSD? I would prefer to have one system doing both jobs, that I can log into remotely. I have never configured IPtables or IFwhatchamacallit on BSD, nor have I run monowall or IPcop before. I am also running a wireless router. So what would be the ideal setup?

A) [DSLMODEM] ---> [m0n0wall] ---> [IDS] ---> [Wireless Router]


B) [DSLMODEM] ---> [IPcop w/snort] ---> [Wireless Router]

or

C) [DSLMODEM] ---> [m0n0wall] ---> [Wireless Router] ---> [IDSbox w/Airsnort]

or am I way off here?

OK... here is an easy way to do the job....
use www.ipcop.org as the IDS Box
and I do it this way for extra
protection and and best security....


DSL Modem -->Wireless Router -->IP Cop Box
Install Open VPN on the box and Bingo you have security
for your wireless
and add this one line into the OpenVPN Client

redirect-gateway

Bingo... no matter what happens on the wireless side
you are secured...

http://www.ipcop.org
http://www.zerina.de/
http://firewalladdons.sourceforge.net/


PS: You can use the 3 NIC instead of the 2 NIC and
use a WAP instead of Wireless router.

Thanks for the idea! What I'm a little confused about is how the box can act as a firewall from inside the network. If the box is attatched to the wireless router I can see how it will act as an IDS but how is it going to filter traffic? Wont the traffic just go from Computer -> Router -> DSLmodem without touching traffic that isnt destined for the firewall box? Or do I setup the router to forward the traffic through the firewall?

or

DSL Modem > IPCop or Smoothwall > Wireless Router > PC

I would guess it depends on which side of the router you want your Firewall and IDS, probably pros and cons to both. Regardless, they are only some of the layers of a multi-layered program.

cheers

Quote:

---

A) [DSLMODEM] ---> [m0n0wall] ---> [IDS] ---> [Wireless Router]


B) [DSLMODEM] ---> [IPcop w/snort] ---> [Wireless Router]

or

C) [DSLMODEM] ---> [m0n0wall] ---> [Wireless Router] ---> [IDSbox w/Airsnort]

or am I way off here?

---

I would recommend using a different type of network 'architecture.'

Quote:

---

Originally posted here by Computernerd22
I would recommend using a different type of network 'architecture.'

---

Such as...?

Quote:

---

Okay, here is the deal... I'm wanting to setup a firewall at home

and incorporate an IDS such as snort. I'm considering using m0n0wall but it

looks like I would have to install my IDS on a seperate machine as oposed

to say IPcop which would allow me to install snort. Is this because IPcop

is linux based and m0n0wall is BSD? I would prefer to have one system doing

both jobs, that I can log into remotely. I have never configured IPtables

or IFwhatchamacallit on BSD, nor have I run monowall or IPcop before. I am

also running a wireless router. So what would be the ideal setup?

---

[DSL MODEM] --> [WIRELESS ROUTER] ---> [firewall]--->[IDS] --> [PC1]--->

[PC2]--->


DSL modem to wireless router. Firewall is 'configured' properly, IDS is

setup to monitor incomming/outgoing packets (SCTP, TCP, UDP, ICMP,

ARP,OSPF, GRE, NetBIOS,IPX VINES, ETC...)

point is, if configured correctly, theres nothing passing through the

application thats going to be 'undetected'. (unless you do some type of DoS

attack on the IDS its self and make it completely unstable).Even then, most

IDS systems have a down system(sensor/trigger) to alarm the adminstrators.

Quote:

---

Originally posted here by Computernerd22
[DSL MODEM] --> [WIRELESS ROUTER] ---> [firewall]--->[IDS] --> [PC1]--->

[PC2]--->

---

I realize it would be ideal to have the IDS on a seperate system but I am trying to be space effecient and dont want to use more computers then I have to. Is the advantage of having a seperate box for the IDS great enough to justify bringing another computer home from work?

Also, I am a bit confused by your architecture. If my firewall is inside the wireless network how does it filter traffic? Wont the traffic of the computers never touch firewall unless I am, forwarding the traffic through it? It looks like you have to traffic going from the wireless router to the firewall and IDS and then directly to the PC's. Wouldnt that require me to have a NIC for each PC inside my IDS?

Any help would be MUCH apreciated... I'm really looking forward to setting this up!

Liquid,

In the examples you are seeing where the firewall is falling after the wireless is because of some of the security minded. Wireless is an easy target. So what you are seeing is if your wireless gets hacked[Ex1], someone would have complete access to your internal network and never worry about your firewall. But on the same point if you are using wireless[Ex2], the only protection you have is your router. Its kind of a catch 22 situation. You could set it up so that if you are using wireless you have to authenticate to get connected to your network. i cant think of the name of the apps off hand that allow you to do that. Or you could setup 2 firewalls. Or trust that the method you use to lockdown your wireless will be secure enough to not worry about it being within your network.

[Ex1]

[DSL MODEM] --> [firewall]---> [WIRELESS ROUTER]--->[IDS] -->[Intranet]
| -[HACKED WIRELESS]
---> [IDS (sees traffic)]-->[Intranet (already in network though)]

[Xx2]

[DSL MODEM] --> [WIRELESS ROUTER] ---> [firewall]--->[IDS] -->[Intranet]
|
--Any traffic through here skips firewall and passes through DSL Modem (but if hacked there is no access to network)

I understand that having a wireless router is leaving an opening in my network but that can't really be avoided due to the inherent insecurity of the medium. I was assuming that if somebody connected to my network they would most likely be trying to use my internet as well, hence the firewall/ids in between the router and the modem. However I do see your point in that this does not prevent them from safely targeting local machines and using a different nic/seperate internet connection. So how about this:

[DSL] --> [IPcop/Snort] --> [Wireless Router] --> [PC1]/[PC2]/[PC3]/[IDS]

In this scenario I am filtering traffic at the source as well as actively scanning for intrusions, then once inside the wireless network I have my workstations and a seperate IDS box for scanning inside the local wireless network. Am I missing anything?

Also, somebody mentioned using a VPN? I've never set one up but I may as well give it a try.

Thanks for being patient. :p