RE: best firewall option for FreeBSD

From: Lee Brotherston (lee.brotherston@uk.easynet.net)
Date: 02/27/02 

From: Lee Brotherston <lee.brotherston@uk.easynet.net>
To: 'Geert Houben' <sec@hict.nl>, freebsd-security@freebsd.org
Date: Wed, 27 Feb 2002 10:28:09 -0000

| What firewall software (Opensource) would you advice? Or do I have to
| choose another OS?

Personally I would favour using either ipf (ipfilters) or ipfw. Both are
compiled into the kernel or can be loaded as modules. ipfw is probably
easier to use for a newcomer, as the rule ordering is easier to understand,
however ipf has some really good features, especially if you are using nat
(it can do nat in the kernel using ipnat afaik).

The homepage for ipf is http://coombs.anu.edu.au/~avalon/ip-filter.html and
there is a really good tutorial at
http://www.obfuscation.org/ipf/ipf-howto.txt

ipfw doesn't require quite as much explanation, there is a page on
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls.html
which covers it. Although 'man ipfw' will probably provide most of what you
want.

Hope it helps

  Lee 

-- 
Lee Brotherston  -  IP Security Manager, Easynet Ltd
http://www.easynet.net/         Phone: +44 20 7900 4444
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • RE: internet gateway
    ... Your using the ppp nat function which is ok, ... complied the ipfw divert option into your kernel. ... My gateway machine has two network cards, ...
    (freebsd-questions)
  • Re: dummynet module?
    ... > and also that I can run IPFW wide open as IPF is the firewall. ... be compiled into the kernel for reasons of presidence. ... is lower presidence, I believe.) ...
    (comp.unix.bsd.freebsd.misc)
  • RE: ipf not working correctly???
    ... Your first problem is you have ipfw and ipf both turned on in kernel ... You can only have one firewall on at a time. ...
    (freebsd-questions)
  • RE: FreeBSD - Secure by DEFAULT ?? [hosts.allow]
    ... But why IPFW? ... IPF is *BSD native wall. ... > hosts.allow file on a FreeBSD Production Server? ... but with no Firewall yet. ...
    (FreeBSD-Security)
  • Re: dummynet module?
    ... because ipfw sorts by the explicit rule numbers you supplied, ... function to IPF if you're still concerned about your ipfw rules ... login over the net, or that the system hangs and you can't login from ... check the logs from the console to see what's denying the packets. ...
    (comp.unix.bsd.freebsd.misc)