Difference between revisions of "PeerGuardian Linux"

From ArchWiki
Jump to: navigation, search
m (add ja link)
 
(21 intermediate revisions by 6 users not shown)
Line 1: Line 1:
[[Category:Networking]]
+
[[Category:Firewalls]]
[[Category:Security]]
+
[[ja:PeerGuardian Linux]]
''PeerGuardian Linux'' (pgl) is a privacy oriented firewall application. It blocks connections to and from hosts specified in huge block lists (thousands or millions of IP ranges). ''pgl'' is based on the Linux kernel netfilter framework and [[iptables]].
+
[http://sourceforge.net/projects/peerguardian/ PeerGuardian Linux] (''pgl'') is a privacy oriented firewall application. It blocks connections to and from hosts specified in huge block lists (thousands or millions of IP ranges). ''pgl'' is based on the Linux kernel [[Wikipedia:Netfilter|netfilter]] framework and [[iptables]].  
  
{{Warning|''pgl'' may block your complete network/internet access! Using too many
+
A more native, efficient solution to achieve the same end is to use the [[ipset]] kernel module in conjunction with the pg2ipset tool and the ipset-update script.
and/or inappropriate lists may seriously degrade your internet service.}}
+
  
 
== Installation ==
 
== Installation ==
There are two [[AUR]] packages to choose from: [https://aur.archlinux.org/packages.php?ID=51838 pgl-cli] includes only the daemon and CLI tools, while [https://aur.archlinux.org/packages.php?ID=51839 pgl] comes complete with a GUI (written using Qt).
+
 
 +
There are two [[AUR]] packages to choose from: {{AUR|pgl-cli}} includes only the daemon and CLI tools, while {{AUR|pgl}} comes complete with a GUI (written using Qt).
  
 
== Configuration ==
 
== Configuration ==
All the configuration files are located in {{ic|/etc/pgl/}}:
 
* {{ic|blocklists.list}} contains a list of URL for retrieving the various block lists,
 
* {{ic|pglcmd.conf}}, empty by default, overrides the default settings present in {{ic|/usr/lib/pgl/pglcmd.defaults}},
 
* {{ic|allow.p2p}} lists custom IP ranges that will not be filtered.
 
  
The most important aspect that you will want to change as soon as possible are the preconfigured block lists. The default lists in {{ic|/etc/pgl/blocklists.list}} block many potentially legitimate IP address, so use your best judgment and the information available at [http://www.iblocklist.com/ I-Blocklist] to make your choice.
+
* {{ic|/etc/pgl/blocklists.list}} contains a list of URL for retrieving the various block lists.
 +
* {{ic|/etc/pgl/pglcmd.conf}}, empty by default, overrides the default settings present in {{ic|/usr/lib/pgl/pglcmd.defaults}}.
 +
* {{ic|/etc/pgl/allow.p2p}} lists custom IP ranges that will not be filtered.
  
If you install ''pgl'' on a workstation, it is recommended to disable the filtering of HTTP connections. Simply add the following to {{ic|/etc/pgl/pglcmd.conf}}:
+
The default lists in {{ic|/etc/pgl/blocklists.list}} block many potentially legitimate IP address.  Users are encouraged to exercise best judgment and the information available at [http://www.iblocklist.com/ I-Blocklist].
  
{{hc|/etc/pgl/pglcmd.conf|2=<nowiki>WHITE_TCP_OUT="http https"</nowiki>}}
+
It is recommended to disable the filtering of HTTP connections by adding the following to {{ic|/etc/pgl/pglcmd.conf}}:
  
Also, depending on the lists you use, some program might not be able to reach the outside world. For instance, if you use MSN for instant messaging, you will need to add port 1863 to the white list:
+
{{hc|/etc/pgl/pglcmd.conf|2=WHITE_TCP_OUT="http https"}}
  
{{hc|/etc/pgl/pglcmd.conf|2=<nowiki>WHITE_TCP_OUT="http https msnp"</nowiki>}}
+
Some program might not be able to reach the outside world. For instance, users of MSN for instant messaging, will need to add port 1863 to the white list:
  
Conversely, you could white list all the ports except the ones used by the program you are trying to restrain. The following example only use the block lists to stop incoming traffic on ports 53 (DNS) and 80 (HTTP):
+
{{hc|/etc/pgl/pglcmd.conf|2=WHITE_TCP_OUT="http https msnp"}}
  
{{hc|/etc/pgl/pglcmd.conf|2=<nowiki>WHITE_TCP_IN="0:79 81:65535"
+
Conversely, one could white list all the ports except the ones used by the program to be blocked. The following example only use the block lists to stop incoming traffic on ports 53 (DNS) and 80 (HTTP):
WHITE_UDP_IN="0:52 54:65535"</nowiki>}}
+
  
=== LAN ===
+
{{hc|/etc/pgl/pglcmd.conf|2=WHITE_TCP_IN="0:79 81:65535"
 +
WHITE_UDP_IN="0:52 54:65535"}}
  
By default, ''pgl'' does not block traffic on your local IPv4 addresses. Unfortunately, this behavior relies on a program called [https://www.archlinux.org/packages/core/x86_64/net-tools/ ifconfig] which is deprecated in Arch Linux. While a new method is being worked on you can use the WHITE_IP_* settings to restore this function, although without the automation.
+
=== Server ===
  
Let us say that ''pgl'' is installed on your workstation (192.168.0.5) and you want to reach some services on another computer (192.168.0.1) on your LAN. Simply add the following to {{ic|/etc/pgl/pglcmd.conf}}:
+
[[systemd]] initialization of the system means that it's quite possible for a server to be briefly unprotected, prior to ''pgl'' launch. To ensure adequate protection, create a service file named after the original server (i.e. {{ic|/etc/systemd/system/httpd.service}} and paste the following:
  
{{hc|/etc/pgl/pglcmd.conf|2=<nowiki>WHITE_IP_OUT="192.168.0.0/24"</nowiki>}}
+
{{hc|/etc/systemd/system/httpd.service|2=
 +
.include /usr/lib/systemd/system/httpd.service
  
If your workstation also hosts services that you would make available to your LAN, add:
+
[Unit]
 +
Wants=pgl.service
 +
After=pgl.service
 +
}}
  
{{hc|/etc/pgl/pglcmd.conf|2=<nowiki>WHITE_IP_IN="192.168.0.0/24"</nowiki>}}
+
=== LAN ===
  
For further information, please refer to the # Whitelist IPs # section of {{ic|/usr/lib/pgl/pglcmd.defaults}}.
+
By default, ''pgl'' blocks traffic on the local IPv4 addresses. To disable this behavior, edit {{ic|/etc/pgl/pglcmd.conf}} to add an exception using the ''WHITE_IP_*'' setting:
 +
 
 +
{{hc|/etc/pgl/pglcmd.conf|2=WHITE_IP_OUT="192.168.0.0/24"}}
 +
{{hc|/etc/pgl/pglcmd.conf|2=WHITE_IP_IN="192.168.0.0/24"}}
 +
 
 +
For further information, please refer to the {{ic|# Whitelist IPs #}} section of {{ic|/usr/lib/pgl/pglcmd.defaults}}.
  
 
== Starting up ==
 
== Starting up ==
  
Once you are comfortable with the configuration of both the daemon and lists, type in:
+
Once comfortable with the configuration of both the daemon and lists, start the {{ic|pgl}} [[daemon|service]]. To make sure that ''pgl'' works as intended, issue this command:
 +
 
 +
# pglcmd test
 +
 
 +
To start ''pgl'' automatically at boot, enable the {{ic|pgl}} service.
 +
 
 +
== Running pgl from within a container ==
  
{{bc|# rc.d start pgl}}
+
Users running pgl within a [[Linux Container]] may need to modify the package included {{ic|lxc@.service}} to include the loading of key modules needed by pgl.
  
To make sure that ''pgl'' works as intended, issue this command:
+
{{hc|/etc/systemd/system/lxc@.service|<nowiki>
 +
[Unit]
 +
Description=%i LXC
 +
After=network.target
  
{{bc|# pglcmd test}}
+
[Service]
 +
Type=forking
 +
ExecStartPre=/usr/bin/modprobe -a xt_NFQUEUE xt_mark xt_iprange
 +
ExecStart=/usr/bin/lxc-start -d -n %i
 +
ExecStop=/usr/bin/lxc-stop -n %i
 +
Delegate=true
  
Should you want ''pgl'' to run automatically, just add "pgl" to your {{ic|/etc/rc.conf/}} DAEMONS array.
+
[Install]
 +
WantedBy=multi-user.target
 +
</nowiki>}}

Latest revision as of 04:16, 9 August 2015

PeerGuardian Linux (pgl) is a privacy oriented firewall application. It blocks connections to and from hosts specified in huge block lists (thousands or millions of IP ranges). pgl is based on the Linux kernel netfilter framework and iptables.

A more native, efficient solution to achieve the same end is to use the ipset kernel module in conjunction with the pg2ipset tool and the ipset-update script.

Installation

There are two AUR packages to choose from: pgl-cliAUR includes only the daemon and CLI tools, while pglAUR comes complete with a GUI (written using Qt).

Configuration

  • /etc/pgl/blocklists.list contains a list of URL for retrieving the various block lists.
  • /etc/pgl/pglcmd.conf, empty by default, overrides the default settings present in /usr/lib/pgl/pglcmd.defaults.
  • /etc/pgl/allow.p2p lists custom IP ranges that will not be filtered.

The default lists in /etc/pgl/blocklists.list block many potentially legitimate IP address. Users are encouraged to exercise best judgment and the information available at I-Blocklist.

It is recommended to disable the filtering of HTTP connections by adding the following to /etc/pgl/pglcmd.conf:

/etc/pgl/pglcmd.conf
WHITE_TCP_OUT="http https"

Some program might not be able to reach the outside world. For instance, users of MSN for instant messaging, will need to add port 1863 to the white list:

/etc/pgl/pglcmd.conf
WHITE_TCP_OUT="http https msnp"

Conversely, one could white list all the ports except the ones used by the program to be blocked. The following example only use the block lists to stop incoming traffic on ports 53 (DNS) and 80 (HTTP):

/etc/pgl/pglcmd.conf
WHITE_TCP_IN="0:79 81:65535"
WHITE_UDP_IN="0:52 54:65535"

Server

systemd initialization of the system means that it's quite possible for a server to be briefly unprotected, prior to pgl launch. To ensure adequate protection, create a service file named after the original server (i.e. /etc/systemd/system/httpd.service and paste the following:

/etc/systemd/system/httpd.service
.include /usr/lib/systemd/system/httpd.service

[Unit]
Wants=pgl.service
After=pgl.service

LAN

By default, pgl blocks traffic on the local IPv4 addresses. To disable this behavior, edit /etc/pgl/pglcmd.conf to add an exception using the WHITE_IP_* setting:

/etc/pgl/pglcmd.conf
WHITE_IP_OUT="192.168.0.0/24"
/etc/pgl/pglcmd.conf
WHITE_IP_IN="192.168.0.0/24"

For further information, please refer to the # Whitelist IPs # section of /usr/lib/pgl/pglcmd.defaults.

Starting up

Once comfortable with the configuration of both the daemon and lists, start the pgl service. To make sure that pgl works as intended, issue this command:

# pglcmd test

To start pgl automatically at boot, enable the pgl service.

Running pgl from within a container

Users running pgl within a Linux Container may need to modify the package included lxc@.service to include the loading of key modules needed by pgl.

/etc/systemd/system/lxc@.service
[Unit]
Description=%i LXC
After=network.target

[Service]
Type=forking
ExecStartPre=/usr/bin/modprobe -a xt_NFQUEUE xt_mark xt_iprange
ExecStart=/usr/bin/lxc-start -d -n %i
ExecStop=/usr/bin/lxc-stop -n %i
Delegate=true

[Install]
WantedBy=multi-user.target