Printable View
I'm semi-familiar with ipchains/tables, but I'm afraid that just isn't going to cut it any longer. Could you guys give me a run down of different nixbased software firewalls, as well as pros and cons of each based upon your own experience? Some links to tutorial research would be great too. Thanks guys!
I can't give experience for this one but it is awesome from what I hear. I've read both trusted and untrusted sources saying that it's great:
Sunscreen. This is from Sun and is for UNIX and in particular Solaris:
Sun Screen is something I'd like to have one day. The configuration looks a lot like a web based Router configuration.
NetWall is another you migth want to look at. It's expensive but that's really the only downside.
Netfilter might be something you look into as well. But then again that is just IPTables in one way anyway, so you may not.
If all else fails, there are a few I've found just by searching for them, but mostly they are IPTables front ends.
http://www.linux-firewall-tools.com/linux/
ipcop is an excellent firewall "suite". I say suite because it includes everything you need. squid, vpn, packet queueing, firewall obviously... and then some. ipcop.org
Shorewall..haven't used it.
astaro security linux is a "commercial" tool but it's free for home use. I'd check them out..it's strikingly similar to ipcop...hmmm opensource is great isn't it?
openbsd 'pf'..I have loads of hours spent with this, and I enjoy it. It does what I need it to do, and has a few nice additions..works on Freebsd and netbsd iirc.
iptables/netfilter...well you already know those. I'd use fwbuilder to build a basic ruleset.
I still question the entire "hardware" vs. "software" firewalls..because what is a *nix box dedicated to firewalling? any hardware firewall still runs an os at the core, no matter how embedded or stripped...so meh.
ttfn..work is calling
There was some thread around here about not really being anything that should be considered a hardware firewall... it's nothing more than a dedicated system for firewalling. I love seeing that "Alpha Shield" gimmick in London Drugs... "100% unhackable security" pfft! :P
I personally use a dedicated Linux box running a huge iptables script, it has worked very adequately for what we need. My buddy recently used Sunscreen for a university departments firewall and he got hooked on it. I am always looking for the "next thing" for our firewall solution so perhaps IPcop might be beneficial, or I coulf always dust off my Solaris discs again.....
i will assume that this is for personal use, right? don't deploy this stuff into a production environment unless you are very familiar with it or have someone who is always available who is familiar with it.Quote:
Originally posted here by poohsuntzu
I'm semi-familiar with ipchains/tables, but I'm afraid that just isn't going to cut it any longer. Could you guys give me a run down of different nixbased software firewalls, as well as pros and cons of each based upon your own experience? Some links to tutorial research would be great too. Thanks guys!
we use FreeBSD solution.
pro's - it's very stable and reliable and configurable
cons - tricky and time consuming to setup.
regards
SL
Is there a reason why you don't feel Netfilter can do the job?
Well it can, completely. Was just trying to open up to other solutions and learn them than just iptables :) Chances are.. I'll stick to iptables though.
While I like Netfilter for home or small workgroups, I am starting to require all firewalls at the edge of my networks to have awareness of both Anti-Virus and Windows patch levels before grantingQuote:
permission to VPN clients.
I have not seen Netfilter or NF based products on the radar with this capability.
Added firewall bonuses are the ability to easily terminate connections other than Ethernet.
NF based products fall short here.
Also, while the NF modules and add-ons along with additional software are starting to become
better at layer 3 and application awareness, I feel the start to finish configuration is still a bit
long.
GORE: I too wish to play with Sunscreen. It looks too cool.
The NOKIA products I run with Checkpoint are BSD(ish) but heavily modified.
*NIX + Checkpoint is still not a bad way to go tho its feeling old school with all of the turnkey stuff coming out.
I used to refuse to install any hard-drive based firewall seeing it as a likely point of failure but
HDD technology has sure come a long way. Keep em cool and dust free and they will SPIN for a long time these days.
Never hurts to broaden your horizons. I only asked because of your wording. :)Quote:
Originally posted here by poohsuntzu
Well it can, completely. Was just trying to open up to other solutions and learn them than just iptables :) Chances are.. I'll stick to iptables though.
Not being up on VPNs, wouldn't this be a function of your VPN server, not of the firewall?Quote:
Originally posted here by ss2chef
While I like Netfilter for home or small workgroups, I am starting to require all firewalls at the edge of my networks to have awareness of both Anti-Virus and Windows patch levels before granting
permission to VPN clients.
Compared to what?Quote:
Also, while the NF modules and add-ons along with additional software are starting to become
better at layer 3 and application awareness, I feel the start to finish configuration is still a bit
long.
I think almost all *nix firewalls are capable of being run off read-only media like CD.Quote:
I used to refuse to install any hard-drive based firewall seeing it as a likely point of failure but HDD technology has sure come a long way. Keep em cool and dust free and they will SPIN for a long time these days.
Ummm, no not necessarily. Many firewall products terminate VPN conntections andQuote:
Originally posted here by chsh
Not being up on VPNs, wouldn't this be a function of your VPN server, not of the firewall?
either use their own authentication database or pass that chore on to another authentication
service like RADIUS.
Well checkout something small like the Nokia IP330 running Checkpoint NGQuote:
Compared to what?
Out of the box, it crushes any netfilter based product I can think of. Sure you can
probably glue a box together and gain some of the features. If you use a commercial product, you usually have a hard time compiling in new features if the vendor even allows it. If you roll your own, lots of things are possible if you have the time. I just don't have that kind of time.
Really. Cool which ones? I would love to check em out..Quote:
I think almost all *nix firewalls are capable of being run off read-only media like CD. [/B]
The only downside is that you'd have to use a dedicated machine for it and keep the ruleset on a virtual filesystem [most likely in RAM]. If you get a power outtage... you'd kinda have to reconfigure the whole 'shizzle' again :( [except if you have an UPS around]Quote:
Originally posted here by chsh
I think almost all *nix firewalls are capable of being run off read-only media like CD.
But you could do it on an USB memory stick :) Unfortunately I don't know of any BIOS that supports booting from an USB device [I'd love to embed Linux on my USB stick :D]
.... I have a ZIP drive that allows booting. And what about ZIPSlack? I haven't looked into it because I have no use for it.
Virtually every bios since around 2001 has had the ability to boot from a usb device. If yours doesn't..it's time to flash it.Quote:
But you could do it on an USB memory stick :) Unfortunately I don't know of any BIOS that supports booting from an USB device [I'd love to embed Linux on my USB stick :D]
CHSH: a lot of places build things in to one device..such as ipcop and astaro. They both have a ton of features..vpn/content filter/spam filter/AV/firewall etc..
ss2chef: like chsh..virtually any *nix can do it..but it's not neccesarily the best idea.
I'm aware it's available and infact I boot knoppix-std from usb drive often.Quote:
Originally posted here by hogfly
ss2chef: like chsh..virtually any *nix can do it..but it's not neccesarily the best idea.
I was more interested in actual firewall product at market which supports this. Do any exist?
Most Linux/NF based stuff I have seen are stripped down to fit the small footprint.
Usually the 1st things that get ditched are all but the most common drivers and configs.
I have done RAM drive firewalls before.
Hope I am not mis-understood. I like netfilter. But for my clients Enterprise dollar, I prefer to choose
tinker free (my perspective) solutions.