Forum OpenACS Q&A: experience with firewall tools...

Posted by David Kuczek on 03/10/02 04:15 PM

I am successfully hosting a cheap server over my home dsl line via
dyndns.org 😊

I am looking for a firewall tool that allows me to easily administer
ports etc. Google gave me http://firestarter.sourceforge.net/

Any experience with firestarter or any other firewall tool???

2: Response to experience with firewall tools... (response to 1)

Posted by Talli Somekh on 03/10/02 07:47 PM

David, there was another thread somewhere around on the bboards that mentioned Smoothwall (http://www.smoothwall.org) and IPcop (http://www.ipcop.org). In researching some of these things, I've learned that the Smoothwall community is dominated by mega-jerks and IPcop is an offshoot of that project.

I've never heard of Firestarter, though.

talli

3: Response to experience with firewall tools... (response to 1)

Posted by Marc Spitzer on 03/10/02 09:08 PM

I like ipfilter, for what it is worth. I do not know if it runs on linux, I use freebsd.

4: Response to experience with firewall tools... (response to 1)

Posted by G. Armour Van Horn on 03/10/02 10:00 PM

I used IPFilter for quite some while and was very confident of its abilities. It could be configured down to the last detail, and for me it was easier to comprehend than IPChains. Much easier. I ran IPFilter exclusively on OpenBSD, which is supposedly the safest Unix version available, and through version 2.9 the IPFilter material came on the install CD (which was only $30). For some obscure licensing reason, the creator of IPFilter no longer allows OpenBSD to bundle IPFilter. IPFilter can be run on other distros, of course.

I never was able to get those firewalls talking to each other, so I tried SmoothWall. I had my first firewall working in 20 minutes, and that included downloading the code, burning a CD, installing a new hard drive, temporarily hooking a CD up, and running the install. It couldn't have been easier. Once I had two of them setup it took me about two hours to figure out how to connect them via IPSec, now that I am not making the same stupid mistakes it adds about five minutes per machine to connect them.

To call the creators of SmoothWall "mega jerks" is, however, awfully mild. Definitely Daniel Bernstein class. Fortunately, I doubt that there is much reason to care. When I was using the OpenBSD/IPFilter system I was running DJBDNS in them, which exposed me to more of Bernstein than the SmoothWall experience exposed me to Richard Morrell.

Another possibility that might make sense would be to use one of the Webmin tools to make IPChains or IPTables understandable. When I was starting this whole mess a year ago I don't think these were available, but there are several listed now on the Webmin site:

http://webmin.thirdpartymodules.com/?page=Networking

But SmoothWall is, by far, the easiest solution I've seen.

Van

5: Response to experience with firewall tools... (response to 1)

Posted by Talli Somekh on 03/10/02 10:14 PM

</a> (tag closing)
<p>
Van's right. If anyone wants to be amazed by a curmudgeony community, check out the Smoothwall FAQ pdf. They spend about 20 pages explaining why you're probably a donkey's butt for asking for a developer's help. It seems that most open source communities that are security focused are led by insane curmudgeons who just haven't found a local militia that's angry enough.
<p>
Anyway, the <a href=http://www.ipcop.org>IPcop (http://www.ipcop.org)</a>community is an offshoot of Smoothwall. These guys were sick and tired of dealing with the angry bastards who ran Smoothwall. Also, I think the Smoothwall guys wanted to start making money off of the code so they were playing games with the code they released under GPL. So, AFAIK, it's a fork of the Smoothwall.
<p>
I imagine Van's review of Smoothwall is reasonably accurate for IPcop, too.
<p>
talli

6: Response to experience with firewall tools... (response to 1)

Posted by Mat Kovach on 03/11/02 02:47 PM

For the most part, using the stock tools with either Linux/*BSD till make you a basic rather secure firewall. I'm suggesting find the ruleset that make the most sense to you and use those.

7: Response to experience with firewall tools... (response to 1)

Posted by Michel Henry de Generet on 03/11/02 03:33 PM

I put a linksys router in front of my private network. Works well but I had to upgrade the firmware (was 1 year old) because upload was not working well. Upgrade and administration are quite easy. Linksys has also model with firewall but I would consider Linux for that specific usage.

8: Response to experience with firewall tools... (response to 1)

Posted by Jade Rubick on 03/11/02 07:10 PM

I've used NARC, which features a fairly easy setup and what seems to me to be a very secure firewall.

9: Response to experience with firewall tools... (response to 1)

Posted by Jamie Ross on 03/12/02 01:14 AM

I am using Smoothwall both at home and work. I know there has been some friction at smoothwall but their support has been great for me and admin is easy. I run two AOLserver sites on different servers over IDSL on one IP .. works great

10: Response to experience with firewall tools... (response to 1)

Posted by Matthew Geddert on 03/12/02 06:40 AM

if you want a "serious" box, i would recommend going with Sonicwall Pro's (200 or 300 model, depending on your needs), they are great, but they cost a fair amount (i.e. $1600+). If you want to run a secure linux server as your firewall with some old pentium 100 with 16mb of ram you have lying around, i recommend reading this tutorial:

http://www.linuxdoc.org/LDP/solrhe/Securing-Optimizing-Linux-RH-Edition-v1.3/index.html

it is great, and to the point. obviously the section on firewalls via ipchains is important, but you must remember that a firewall is only as good as its biggest hole, so the entire system needs to be secure. The guide at this url is a great explaination.