Difference between revisions of "Firewalls"

From ArchWiki
Jump to: navigation, search
m (Link update.)
(redirect to Category:Firewalls)
(62 intermediate revisions by 28 users not shown)
Line 1: Line 1:
#REDIRECT [[:Category:Firewalls]]
A firewall is a system designed to prevent unauthorized access to or from a private network (which could be just one machine).  Firewalls can be implemented in only hardware or software, or a combination of both.  Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets.  All messages entering or leaving the intranet pass through the firewall, which examines each message and allows, proxys, or denies the traffic based on specified security criteria.
There is a nice list of firewalls [http://wiki.debian.org/Firewalls here].
There are many posts on the forums about different firewall apps and scripts so here they all are condensed into one page - please add your comments about each firewall, especially ease of use and a security check at [https://www.grc.com/x/ne.dll?bh0bkyd2 Shields Up].
{{Note|Checks at Shields Up are only a valid measure of your router should you have one in the LAN.  To accurately evaluate a software firewall, one needs to directly connect the box to the cable modem.}}
The Linux kernel itself has very powerful firewall called iptables. Other firewalls are usually just front-ends.
See the [[iptables|iptables article]] for more information.
'''More info:'''
*[[Simple stateful firewall]]
*man iptables http://unixhelp.ed.ac.uk/CGI/man-cgi?iptables+8
==iptables front-ends==
===Arno's Firewall===
[http://rocky.eld.leidenuniv.nl/ Arno's IPTABLES Firewall Script] is a secure firewall for both single and multi-homed machines.
The script:
*EASY to configure and highly customizable
*daemon script included
*a filter script that makes your firewall log more readable
*port forwarding
*ADSL ethernet modems with both static and dynamically assigned IPs
*MAC address filtering
*stealth port scan detection
*DMZ and DMZ-2-LAN forwarding
*protection against SYN/ICMP flooding
*extensive user definable logging with rate limiting to prevent log flooding
*all IP protocols and VPNs such as IPsec
*plugin support to add extra features.
[http://ferm.foo-projects.org/ ferm] (which stands for "For Easy Rule Making") is a tool to maintain complex firewalls, without having the trouble to rewrite the complex rules over and over again. ferm allows the entire firewall rule set to be stored in a separate file, and to be loaded with one command. The firewall configuration resembles structured programming-like language, which can contain levels and lists.
[http://firehol.sourceforge.net/ FireHOL] is a language to express firewalling rules, not just a script that produces some kind of a firewall. It makes building even sophisticated firewalls easy - the way you want it. The result is actually iptables rules.
{{Pkg|firehol}} is available in the [[Official Repositories|official repositories]].
[http://projects.leisink.net/firetable Firetable] is an iptables-based firewall with "human readable" syntax.
{{AUR|firetable}} is available in the [[Arch User Repository|AUR]].
[http://www.shorewall.net/ The Shoreline Firewall], more commonly known as "Shorewall", is high-level tool for configuring Netfilter. You describe your firewall/gateway requirements using entries in a set of configuration files. Shorewall reads those configuration files and with the help of the iptables utility, Shorewall configures Netfilter to match your requirements. Shorewall can be used on a dedicated firewall system, a multi-function gateway/router/server or on a standalone GNU/Linux system. Shorewall does not use Netfilter's ipchains compatibility mode and can thus take advantage of Netfilter's connection state tracking capabilities.
{{Pkg|shorewall}} is available in the [[Official Repositories|official repositories]].
ufw (uncomplicated firewall) is a simple front-end for iptables and is available in the [[Official Repositories|official repositories]].
See [[Uncomplicated Firewall]] for more information.
[http://www.vuurmuur.org/ Vuurmuur] Vuurmuur is a powerful firewall manager built on top of iptables. It has a simple and easy to learn configuration that allows both simple and complex configurations. The configuration can be fully configured through an {{Pkg|ncurses}} GUI, which allows secure remote administration through SSH or on the console. Vuurmuur supports traffic shaping, has powerful monitoring features, which allow the administrator to look at the logs, connections and bandwidth usage in realtime.
{{AUR|Vuurmuur}} is available in the [[Arch User Repository|AUR]].
==iptables GUIs==
[http://www.fs-security.com/ Firestarter] is a good GUI for iptables writen on GTK2, it has the ability to use both white and black lists for regulating traffic, it is very simple and easy to use, with good documentation available on their website.
{{AUR|Firestarter}} has [[GNOME]] dependencies and is available in the [[Arch User Repository|AUR]].
[http://www.simonzone.com/software/guarddog/ Guarddog] is a really easy to use GUI for configuring iptables. After setting up a basic desktop configuration it passes all Shields Up tests perfectly.
{{AUR|Guarddog}} requires {{Pkg|kdelibs3}} and is available in the [[AUR]] repository.
To have the firewall settings applied at boot-up you must run {{ic|/etc/rc.firewall}} from inside {{ic|/etc/rc.local}} or something similar.
===Uncomplicated Firewall (ufw) Frontends===
[[Uncomplicated_Firewall#Gufw|Gufw]], a GTK-based front-end to {{Pkg|ufw}} which happens to be a CLI front-end to iptables (gufw->ufw->iptables), is super easy and super simple to use.
{{Note|Gufw is perhaps the simplest replacement for tcp_wrappers, which was [https://www.archlinux.org/news/dropping-tcp_wrappers-support/ discontinued recently]}}
[[Uncomplicated_Firewall#kcm-ufw|kcm-ufw]] is a KDE alternative to Gufw.
See [[Uncomplicated_Firewall#GUI_frontends|Uncomplicated Firewall]] for more info.
[http://kmyfirewall.sourceforge.net/ KMyFirewall] is KDE3 GUI for iptables.
Firewall editing capabilities are simple enough to use to be suitable for beginners, but also allow for sophisticated tweaking of the firewall settings.
{{AUR|KMyFirewall}} requires {{Pkg|kdelibs3}} and is available in the [[Arch User Repository|AUR]].
==Firewall Builder==
[http://www.fwbuilder.org/ Firewall Builder] is "a GUI firewall configuration and management tool that supports iptables (netfilter), ipfilter, pf, ipfw, Cisco PIX (FWSM, ASA) and Cisco routers extended access lists. [...] The program runs on Linux, FreeBSD, OpenBSD, Windows and Mac OS X and can manage both local and remote firewalls." Source: http://www.fwbuilder.org/
{{Pkg|fwbuilder}} is available in the [[Official Repositories|official repositories]].

Latest revision as of 15:08, 7 November 2017

Redirect to: