Printable View
Is Fedora and Snort still my best option for a Hard Ware firewall to protect my network?
I have a pentium 333mh 384mb ram 8gb hdd and Athlon 2400+ 512mb ram and 80gb hdd
Does speed and ram make a significant effect to firewall/ network speed?
Is there any special way to install OS? Always been told less is more?
What about physical position of Firewall, what is best?
Any advice really appreciated.
Thanks
First things first. Fedore is an OS and snort is an NIDS. Neither of them are considered a "hardware firewall". People tend to call Cisco PIX, Nokia-Checkpoint FW-1, Sonicwalls etc hardware firewalls. Dedicated boxes with everything buildin out-of-the-box.
On the other hand, you can turn this into a great firewall with intrusion detection.
Speed and RAM does have an effect on the performance.
How much bandwidth are you planning on firewalling?
As for installation of the OS, only install the bare minimum you need.
And the physical position? How about at the edge of your network?
Or did you mean in a closed (server) room?
As a side note, I have an old P90, 24MB ram, 512MB HDD that's protecting my 4Mbit adsl connection. Works like a charm :)
Your hardware is probably overkill unless you have a massive amount of custom rules
and are prioritizing voice data over all other data types...My guess is you won't be.
Fedora+Snort does not a firewall make...!!
Any Linux using netfilter and snort among other configurations can be.
Why not use something like smoothwall (http://www.smoothwall.org) and get your
feet wet with it.
Physical location will depend on what your choices are...Details Details Details
I don't know about the others, but I flunked ESP in College..:)
Thanks for coming to the plate.
T1 inbound cisco router straight through, eth0 and eth1 circuits to internet related MS servers.
All software individual firewalls to date, just wanted to provide security umbrella and start to investigate potential security holes with some self generated attacks.
I am off to investigate your suggested url
If you need more info, just let me know what is is.
Thank you.
Smoothwall was not responding, I kept trying and finally it came up.
It the delay is anything to go by it doesn't look a viable proposition.
Will keep open mind and review further.
Well unless you change your router config, you will need a firewall interface for each
router interface leading into your trusted network.
Placing enough NICS in your box will do the trick. More than one trusted interface will
just add a few more rules but not much complexity.
Can I suggest where to place this (whatever you decide to put on) machine?
Oh, and my firewall is running on FreeBSD-4-stable with IPFilter.Code:T1>---[cisco router]--[DYI Firewall/IDS]-----[Internal LAN]
\
----DMZ----[MS webservers]
Their IP pings at TTL=246
But the website navigation is like waiting for paint to dry
is this perhaps the Firewall in action?
Are you experiencing the same delays?
Thank you SirDice
There is only a couple of us on the trusted network.
There are MS servers on both eth circuits does that mean two
firewalls?
Network mainly consists of individual single workgroups, dns, email server, webservers, sql, couple of workstations.
ss2chef
Router is managed by provider of T1, it is open.
I thought I could put a FW box upstream of router between it and t1
input.
Have a delay here tooQuote:
Originally posted here by customwebman
Their IP pings at TTL=246
But the website navigation is like waiting for paint to dry
is this perhaps the Firewall in action?
Are you experiencing the same delays?
Smoothwall is a fine firewall for getting feet wet
Your supposition is just silly. Smoothwall is in wide use and is known to work quite well.
Could be many reasons for slowness but hey...There is always google which will net a ton
of hits on "linux firewall"
Well you would have to get a card to add to your box to terminate your T1Quote:
Originally posted here by customwebman
ss2chef
Router is managed by provider of T1, it is open.
I thought I could put a FW box upstream of router between it and t1
input.
It's not simply Ethernet
Then your firewall is really a router now which will provide an interesting session or two
of rules configuration. All very messy when you can just let your routers route and
then pass to your firewall.
In front of your router is the wrong place IMO.
Linux firewall on Google I have tried, that is why I am asking my peers for advice.
I'l keep my humor to myself in future.
ss2chef
I take your point, so I should place the hardware between the router and the switch.
Excuse my ignorance but I have two feeds from router going to different switches.
Does it follow that I should place another box between second outlet from router
to second switch? Or is there an easier or better way?
Thank you
Always difficult. Please keep in mind that some (if not most) of us don't speak english as a native language. What might be funny in one language maybe offensive in an other.Quote:
I'l keep my humor to myself in future.
Also note that written (text) humor is quite different from spoken humor. It's all to do with the way you say it. Correct punctuation and/or smileys can help ;)
It doesn't work so it must be crap. This can be funny when pronounced with some cynicism but that's hard to put on paper :)
Should this be my plan?
Install Smoothwall to PC with two nics and place between router and switch.
Is there anything else I should consider at this stage?
SirDice makes a good point about the DMZ.
Is it possible to put the servers open to the UNTRUSTED public on a seperate segment?
I'm cool with humor..really
Most Linux will provide an IPTABLES offering to you but I like the canned stuff for newer users
as the rulesets can be a pain with multiple interfaces for users new to netfilter.
Is an off the shelf product an option?
3 NICS might be better.Quote:
Originally posted here by customwebman
Should this be my plan?
Install Smoothwall to PC with two nics and place between router and switch.
Is there anything else I should consider at this stage?
NIC1 = public untrusted interface
NIC2 = DMZ with both servers behind it
NIC3 = LAN Workstations and whatnot
How you configure can depend on what IP structure you have.
Do you only have a single public IP to work with or do you have a block to use?
Smoothwall is one of many canned options.
I like it cause it has other features like snort, proxy, and basic bandwith monitoring for
each interface. It's also managed via a web page interface which is nice if you are new to
commandline on Linux.
Cisco router feeds to eth0 with about a dozen ip's in one block and
about 120 ip's in another
Second or eth1 feeds about 20 ips
It would be a lot of work to move servers to one block because
we added as we needed. But it might be possible to isolate most
on eth0.
Still need to get physical layout clear in my mind.
Servers all within 50 feet.
Revised plan
T1 -- router -- smoothwall -- (eth0) webserver, dns, Internet based servers.
| |
(eth1) (local net)
non critical
How does this fit in with your suggestions?
Am I mistaken? It looks like in your diagram that localnet is outside any firewall.
Maybe you need:
router -- (eth0)smoothwall1(eth1)webserver, dns, Internet based servers.
|
|
(eth0)Smoothwall2(eth1) Localnet
Okay now I see your edit..
Seems we are on the same page now.
So do I need third nic?
Any last considerations before I build this?
Put smoothwall on Pentium 333 = no adverse affect?
Anything I should know about smoothwall before installing?
Thanks again for pointing me in right direction.
There are so many pitfalls in this profession, I have been in plenty.
Really do appreciate your help.
Thank you
Either a 3rd nic or a second firewall.
No reason to put any thing up unprotected when a new nic is like $15 US.
Before you put it into production make sure its tested.
Don't consider this an endall solution. Some tweaking will probably be required.
Be sure to patch smoothwall asap and before you put it in production.
I never asked but do you have any access lists on the router?
Not a bad idea to use them as well.
Ingress filtering entries on the outside interface for example.
OK three nics,
Internet from Eth0
To Switch for mission critical
To second Switch for local
Think I will use faster newer server for smoothwall.
A little concerned about post install stuff you mention.
Can you be more specific please.
Well as with all operating systems, patches are created to address software bugs.
Smoothwall will alert you that updates are available. I think there are 4 now.
You will download them and appy them via the Smoothwall web management interface.
I also suggest you set your firewall to log to a seperate syslog server if you can.
I managed to download smoothwall and burn it to CDR but it won't boot.
Syslog server? no linux experience yet. Trying hard to learn.
No idea what you mean or how to do it.
If this was windows/asp/perl/almost any but linux I probably would be finished by now.
I am stuck at getting the software and loading onto a box.
Clue me to a process because download burn and boot didn't work.
I have Nero but it didn't like to make the iso a boot disk!
Should call me Pitfaller (humor warning) I fell in again.
Smoothwall file is an ISO image.
You need to burn the image to the disk not just write the file to cd if that is what you did.
Why not just get an off the shelf router.
Will cost a little but not as much as the potential cost of a disaster.
Can get one with a WANPort(eth0), Eth1, and DMZPort for pretty cheap these days.
Spend a little and buy some time to play with the Linux for a while.
I have a new cdr with the iso on it. I thought I burned it on.
You lost me at burn to disk not write file to CDR
I thought that was the same thing.
I must learn - might as well be now.
Thank you I will investigate what you said and make a proper cdr
that will load smoothwall.
Not giving up.
Thanks
Just wanted to thank you for getting me pointed in the right direction.
I can now readily access a support forum for Smoothwall. Also
since reading about the plight of my fellow newbies with Linux
and the Smoothwall installation, I don't feel so hopeless.
There is nothing smooth about the installation and setup process
unless you know exactly what you are doing.
Thanks
Take care :-)
Well good luck to you.
Try to remember that ease of use is NO indication of quality.
More often than not, making things easier to use/learn has a direct impact on how much
time and effort people take to understand complicated problems.
The easier something is, the less time people take to know what the !@#$ they
are dealing with.
It's frustrating beyond all measure...
Cheers!!