Printable View
I'm curious as to the advantages of any, of choosing one over the other. I'm gettin my friend's old 486(in exchange for a case of beer), so I had planned on installing OpenBSD, and using that as a firewall.
This is mainly geered as a learning experience, however I'm curious as to the effectiveness between a Software Firewall(preferably free or low cost, e.g. Zone Alarm, Tiny, etc.) to a Hardware Firewall(OpenBSD).
Comments?
I don't know much about hardware firewalls, but so far software firewalls have worked well for me.
Well if it's a hardware firewall it will use software to run it, where software only needs but your PC to run. Software wise lots to choose from, Zone Alarm, Black Ice, ah all I can recall at the moment. Depending on the connect like ADSL, CABLE, can have like a linksys, or D-link switch with NAT that can also be used to block stuff, dial up go with a software firewall, Zone Alarm is free do a google search www.google.com. Me I like hardware/software
Since software is easier to update/patch up I would say going with software is to your advantage.
This is again, not a question about software/hardware firewalls, this is more a question of the differences between Application Layer firewalls and Packet (or Network) Layer firewalls.
OpenBSD, while its filter (PF or IPF?) will give you the functionality of a hardware-style firewall, is still entirely software based. The differentiation one could make would be in what hardware the software that powers the firewall sits on. Instead of ROM and EEPROM, the software is stored on a standard PC hard drive.
Some more information can also be found in the below threads.
Tutorials Forum - Index. Maintained by Negative.
Firewall basics - Short but valuable information.
Basic Firewall tutorial - Lot's of links to more information and firewall vendors.
Network Basics 1: the OSI-model - Good knowledge about Network's are good when dealing with firewalls.
And several other threads in the tutorials forum.
i personally like both, i have a p100 as my hardware (+ a cable modem + router ) all as my hardware firewalls, and norton + zonealarm as mu software firewalls, tbh i like hardware as it takes less resources thatn software......
Besides hardware (appliances) and software (on top on an existing O.S.), there is another kind of firewall: the one that boots from a CD. Nothing to install for get corrupted on the hard disk. You can find several ones: www.sentryfirewall.com, www.gibraltar.at, www.netboz.net. The last is the one I recommend.
aluco > The link to "sentryfirewall" and "gibraltar" does not work.. Please remove the comma in the adress :).
If you are interested in installing a firewall, before you go through all the trouble of setting up some kind of a PC platform running some kind of a firewall, I would recommend you look into firewall/router/switch/dhcp server combos. You can get them cheap ($50 bucks), they are overall going to be faster (specifically designed for that kind of application), and they are fairly easy to configure.
As far as whether or not you want to use an application layer firewall or a stateful packet inspection firewall, the choice depends on what you are trying to accomplish. A stateful packet inspection firewall will inherently be faster than an application layer firewall (it keeps it down at layer 3 versus layer 7 of an application firewall). Even though many stateful packet inspection firewalls have built in psuedo-proxy like functionality for well known protocols (ftp, telnet, http, etc), they are still basically unable to properly understand the application running on top of the communication stream (by definition). On the downside, most of these applications cost major bucks ($100K +). You got the freebies like iptables and (I think) netranger, and then the commerical firewalls like checkpoint, raptor, sidewinder.
If you insist on using that PC, I would say something like iptables, but would still recommend you get a firewall appliance...
Neb
Techincally, there is no such thing as a hardware firewall. All that means is that you have a box that is a dedicated firewall. It can be running OpenBSD with a firewall installed. It can be running linux with Checkpoint or iptables/ipchains installed. It can be running solaris with CP installed. It can be running NT with a firewall installed. etc etc. It just means that the ONLY use for that box is to be a firewall.
So is your question wether or not to set up a dedicated firewall, or just run a program on the machine you are using for other stuff also?
Yeah, souleman has it right. I realised after a convo with him that my wording sucked. No need to re-explain it though, ppl have already given me neggies for bad wording... :)