A Good Firewall to use

Firestarter.

http://firestarter.sourceforge.net

Can also be gotten from www.gnome.org

For most Linux distros - GUI interface. Easy to configure and use. I have had a lot of luck with it.

Thought others may find it useful as well.

.: Aftiel

Thanks, been looking for some other alternatives!

`pw

Isn't this just a GUI to make it easier to configure the various build-in Linux firewalls?
Looks nice though.

For *nix I would reccommend getting to grips with iptables.

try this by er0k:

http://www.antionline.com/showthread...light=iptables

Or install webmin:

http://www.webmin.com/download.html

That gives you an easy way to configure.

Steve

Essentially what it does is replaces IPTABLES. It will still utilize the built in firewall scheme, although it "replaces" the process on the machine.

Not physically, but in terms of running processes. With Firestarter running, IPTABLES is shown as not running.

So yes, part of it provides a GUI for the OS Firewall, but it extends that ability just a bit.

For me it is certainly convenient, and has been VERY stable, easy to install and use.

It has all the expected capabilities as well - i.e. logging, etc.

It also loads as a process on boot - so it hooks into the OS a bit farther than just a Glade interface.

.: Aftiel

Whoohoo for IPtables. Yes, all this program does it fix up your iprules nicely and easily so, you don't have to muck around with them, there is another good firewall here (http://firewall-jay.sourceforge.net) it's consol based, but it is very nice, and easy to use.

MB

I agree with learning ipchains/iptables. That is how I originally learned.

Once I had an understanding and could set things up manually, I found Firestarter to be a nice fast way to make changes on the fly.

I will never argue the point that the base mechanics of things should be studied/learned first. Good points.

.: Aftiel

I have heard good things about firestarter, and I have played around with webmin a little and thought it was very good as well.
I just wanted to throw another config app for iptables, though, and it's the one I use. No gui, but really simple, solid, and all that other good stuff.
Shorewall

Well, as good as ipchains / iptables have become they still don't address 1 problem. A firewall *should* be a seperate entity dividing two segments. In the context of a network the firewall should seperate the public/private segments of the network. Many software firewalls don't address this issue. If the attackers are at the door, in many cases its already to late. Case in point would be.

If you had a SW firewall running on the host machine, an attacker could use several automated attack tools to cause the FWs stateful inspection routeens to consume massive ammounts of system resources just to identify and prevent the attacks, resulting is a crude DoS situation.

HW firewalls are the best way to go as a first layer of defence if you can spend the extra money. Then IDS and host-based FW's next. And don't forget USER EDUCATION!!!! The weakest link always breaks first. :)

BTW I have a couple HW firewalls for sale that are no longer in use. PM if you're interested. 1 linksys, 1 sonicwall

Sybase Works Very well for me... and I would NOT Recommend Mcafee Anything..

Cheers

Sorry My Bad, I ment sygate.. Too Much Code work..

Cheers

Phantom: Both are windows firewalls. We're talking linux firewalls here ;-)

A relatively inexpensive firewall arch. that I like is the 'screened subnet'. Essentially you are doing stateful
packet-filtering on the exterior router, have a DMZ made up of bastion hosts configured in an ultra-paranoid
manner, and an interior stateful packet-filtering screening router to your intranet. It is also handy to place a
NIDS host between your ISP and the exterior router, this can be tricky to get right (so it is effectively transparent)
but worth the effort once in place.

Code:

---

          { VOID }
                |
                |
          [ NIDS ]
                |
                |
      [ Ext. Router ]
                |
                |
        <  SW0  >____________[  Host0 ]________[ Host1 ]_________[ Host2]  (DMZnet)
                | 
                | 
      [ Int. Router ]
                |
                |_____________(Internal Network)

---

I like to make the hosts on the DMZ triple homed, each interface on it's own network with one net for external
traffic, another for Host-to-Host communication and backups, and the third for Admin.

It is also not a bad idea to proxy all your client traffic on the internal network, this allows for having one very
heavily secured host doing all the communication on behalf of your clients, and can reduce a lot of the risk.

-- spurious