[gentoo-user] Personal firewall for Linux?

[gentoo-user] Personal firewall for Linux?

[Matt Randolph]

I've seen related threads here recently, but I think my question is 
different enough to warrant a new thread.

I'm looking for a personal firewall along the lines of the ZoneAlarm 
product for Windows.  I don't want to take the time to teach myself 
iptables if there is a simple alternative. 

I'm not trying to do anything complicated like protect a LAN or include 
a DMZ or run an ftp server or anything like that.  I'm just looking for 
a quick and easy way to add another layer of protection to my desktop by 
closing all unused ports. 

A GUI is preferred but is not required.

Any suggestions?

(If you dare answer,) what firewall do you use and why did you choose it?
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Personal firewall for Linux?

[Martin S]

[-- Attachment #1: Type: text/plain, Size: 75 bytes --]

KFireWall (I think it's called) if you use KDE.


Regards,

Martin S

[-- Attachment #2: Type: text/html, Size: 85 bytes --]

Re: [gentoo-user] Personal firewall for Linux?

[Holly Bostick]

Matt Randolph schreef:
> I've seen related threads here recently, but I think my question is
> different enough to warrant a new thread.

I think you're not quite right :), but I can see why you'd think this.
> 
> I'm looking for a personal firewall along the lines of the ZoneAlarm
> product for Windows.  I don't want to take the time to teach myself
> iptables if there is a simple alternative.

Sure there is; just use one of the many GUI front ends for iptables that
are "pre-set", as it were, for personal (workstation) settings, rather
than router or server settings.

As far as I can see, iptables *is* the firewall, but that doesn't mean
you have to go all full-bore with it.

> I'm not trying to do anything complicated like protect a LAN or include
> a DMZ or run an ftp server or anything like that.  I'm just looking for
> a quick and easy way to add another layer of protection to my desktop by
> closing all unused ports.
> A GUI is preferred but is not required.
> 
> Any suggestions?
> 
> (If you dare answer,) what firewall do you use and why did you choose it?

I use (the) firestarter (frontend for iptables). It seems quite clever;
I still appear to ShieldsUP! as stealth (including those ports I have
forwarded to be open to specific apps), but those applications/services
which are set to use specific ports via UDP (azureus, for example), are
able to pass through without issue (and in fact without my having to
specifically configure Firestarter to allow them to, although I did,
because of the UDP, I believe).

Firestarter has specific pre-sets to allow various known services
through the firewall, and runs as a daemon, though there's a GUI you can
run in the tray if you often need to check or reconfigure something. I
ran the tray applet the first day; it seemed to work well, so I don't
run it any more unless something changes on my system as a whole (I
started running an ftp server, for example), and I would need to
reconfigure slightly.

Firestarter was recommended to me by the Shorewall page:

> Shorewall is not the easiest to use of the available iptables configuration tools but I believe that it is the most flexible and powerful. So if you are looking for a simple point-and-click set-and-forget Linux firewall solution that requires a minimum of networking knowledge, I would encourage you to check out the following alternatives:
> 
>     *
> 
>       http://www.m0n0.ch/wall/
>     *
> 
>       http://www.fs-security.com/
> 


Firestarter is the second link.

HTH,
Holly
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Personal firewall for Linux?

[Oscar]

I use shorewall on my gateways / firewalls, but it's probably a bit overkill for you.

A really simple setup can be done with firehol(.sf.net), but I don't think running a firewall on a unix desktop is necessary.

Oscar

On Mon, 29 Aug 2005 14:54:46 -0400
Matt Randolph <mattr@erols.com> wrote:

> I've seen related threads here recently, but I think my question is 
> different enough to warrant a new thread.
> 
> I'm looking for a personal firewall along the lines of the ZoneAlarm 
> product for Windows.  I don't want to take the time to teach myself 
> iptables if there is a simple alternative. 
> 
> I'm not trying to do anything complicated like protect a LAN or include 
> a DMZ or run an ftp server or anything like that.  I'm just looking for 
> a quick and easy way to add another layer of protection to my desktop by 
> closing all unused ports. 
> 
> A GUI is preferred but is not required.
> 
> Any suggestions?
> 
> (If you dare answer,) what firewall do you use and why did you choose it?
> -- 
> gentoo-user@gentoo.org mailing list
> 
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Personal firewall for Linux?

[Alvin A ONeal Jr]

[-- Attachment #1: Type: text/plain, Size: 598 bytes --]

iptables really isn't that difficult if you just want to do what the 
average home user wants to do- accept certain services and block 
everything else.

Provided that you have kernel support for iptables you can just 
copy/paste some example code in a text file.

http://gentoo-wiki.com/HOWTO_Iptables_for_newbies#QuickStart


http://gentoo-wiki.com/GWikInstall_Essential_Daemons#Firewall_with_netfilter.2Fiptables


-- 
8^)
Laterz-
~Alvin
http://CoolAJ86.Havenite.net

---
SlickC92: I'd rather die than have people point and laugh at me all of 
the time! CoolAJ86: But don't they do that anyway?

[-- Attachment #2: coolaj86.vcf --]
[-- Type: text/x-vcard, Size: 323 bytes --]

begin:vcard
fn:Alvin A ONeal Jr
n:ONeal;Alvin
adr;dom:;;34 Fletcher Lane;Shelburne;VT;05482
email;internet:coolaj86@havenite.net
tel;work:1.802.877.2938
tel;home:1.802.985.5277
tel;cell:1.802.578.0599
note;quoted-printable:DoB: 19860616=0D=0A=
	
x-mozilla-html:FALSE
url:http://coolaj86.havenite.net
version:2.1
end:vcard

Re: [gentoo-user] Personal firewall for Linux? [OT]

[Alvin A ONeal Jr]

[-- Attachment #1: Type: text/plain, Size: 640 bytes --]

> but I don't think running a firewall on a unix desktop is necessary.

I certainly do. What about ssh multiple-login attacks? I know that pam 
can easily fix this 
(http://gentoo-wiki.com/GWikInstall_Essential_Daemons#Securing_SSH), but 
I know there are other services (portmap) that can be vulnerable if not 
blocked or selectively filtered.

Most geeks know to set a good password, but to generalize "unix desktop" 
- that includes a number of grandmas, believe it or not.


-- 
8^)
Laterz-
~Alvin
http://CoolAJ86.Havenite.net

---
Did I say that? Well, if I did, I've changed my mind - And it just goes 
to show that I still have one!

[-- Attachment #2: coolaj86.vcf --]
[-- Type: text/x-vcard, Size: 323 bytes --]

begin:vcard
fn:Alvin A ONeal Jr
n:ONeal;Alvin
adr;dom:;;34 Fletcher Lane;Shelburne;VT;05482
email;internet:coolaj86@havenite.net
tel;work:1.802.877.2938
tel;home:1.802.985.5277
tel;cell:1.802.578.0599
note;quoted-printable:DoB: 19860616=0D=0A=
	
x-mozilla-html:FALSE
url:http://coolaj86.havenite.net
version:2.1
end:vcard

Re: [gentoo-user] Personal firewall for Linux?

[Sean Higgins]

Matt,

Check out net-firewall/firestarter, http://www.fs-security.com/, it is a gui 
frontend for iptables and has a way to monitor the communication.

                        Sean

On Monday 29 August 2005 02:54 pm, Matt Randolph wrote:
> I've seen related threads here recently, but I think my question is
> different enough to warrant a new thread.
>
> I'm looking for a personal firewall along the lines of the ZoneAlarm
> product for Windows.  I don't want to take the time to teach myself
> iptables if there is a simple alternative.
>
> I'm not trying to do anything complicated like protect a LAN or include
> a DMZ or run an ftp server or anything like that.  I'm just looking for
> a quick and easy way to add another layer of protection to my desktop by
> closing all unused ports.
>
> A GUI is preferred but is not required.
>
> Any suggestions?
>
> (If you dare answer,) what firewall do you use and why did you choose it?

-- 
Sean Higgins, sean@systura.com
http://www.systura.com - "Where information becomes knowledge."
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Personal firewall for Linux?

[Nagatoro]

Matt Randolph wrote:
> I've seen related threads here recently, but I think my question is 
> different enough to warrant a new thread.
> 
> I'm looking for a personal firewall along the lines of the ZoneAlarm 
> product for Windows.  I don't want to take the time to teach myself 

Not an answer but a follow up question: Is there a firewall for Linux 
that can do application level filtering (probably wrong terms but...), 
that is is there a program that can block foo from web access but 
allow it to imap and at the same time allow bar web access? (like most 
Win* firewalls can)
-- 
Naga
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Personal firewall for Linux?

[Holly Bostick]

Nagatoro schreef:
> Matt Randolph wrote:
> 
>> I've seen related threads here recently, but I think my question is
>> different enough to warrant a new thread.
>>
>> I'm looking for a personal firewall along the lines of the ZoneAlarm
>> product for Windows.  I don't want to take the time to teach myself 
> 
> 
> Not an answer but a follow up question: Is there a firewall for Linux
> that can do application level filtering (probably wrong terms but...),

Please anybody, correct me if I'm wrong, but afaik, this assumption that
there are multiple firewall programs in the first place is incorrect.

There is one. IPtables. All right, two, if you count IPchains, which
IPtables replaced.

> that is is there a program that can block foo from web access but allow
> it to imap and at the same time allow bar web access? (like most Win*
> firewalls can)

It's all about the ruleset. In this case, it looks like this option is
involved:

  owner
       This module attempts to match various characteristics of the
packet creator, for locally-generated packets.  It is only valid in the
OUTPUT  chain,
       and even this some packets (such as ICMP ping responses) may have
no owner, and hence never match.

       --uid-owner userid
              Matches if the packet was created by a process with the
given effective user id.

       --gid-owner groupid
              Matches if the packet was created by a process with the
given effective group id.

       --pid-owner processid
              Matches if the packet was created by a process with the
given process id.

       --sid-owner sessionid
              Matches if the packet was created by a process in the
given session group.

       --cmd-owner name
              Matches  if  the packet was created by a process with the
given command name.  (this option is present only if iptables was
compiled under a
              kernel supporting this feature)


Obviously, one would have to read more of man iptables than I did, or
get a GUI front end that handles this more 'intuitively' to actually
write the appropriate rule, but clearly it is possible.

Hope this helps,
Holly

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Personal firewall for Linux?

[Bastian Balthazar Bux]

Nagatoro wrote:
[snip]

> 
> Not an answer but a follow up question: Is there a firewall for Linux
> that can do application level filtering (probably wrong terms but...),
> that is is there a program that can block foo from web access but allow
> it to imap and at the same time allow bar web access? (like most Win*
> firewalls can)

echo "net-firewall/iptables extensions" >> /etc/portage/package.use
emerge -av net-firewall/iptables

visit "http://l7-filter.sf.net" for howto and faqs


-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Personal firewall for Linux?

[Bastian Balthazar Bux]

Holly Bostick wrote:
[snip]
>>Not an answer but a follow up question: Is there a firewall for Linux
>>that can do application level filtering (probably wrong terms but...),
> 
> 
> Please anybody, correct me if I'm wrong, but afaik, this assumption that
> there are multiple firewall programs in the first place is incorrect.
> 
> There is one. IPtables. All right, two, if you count IPchains, which
> IPtables replaced.

Not really, there is the ipt* kernel modules, than there is the program
iptables, then the various programs that use the iptables program.

the iptables program is a frontend, all the other are frontends that use
it, it's a question of how much the piece you're looking at is near to
the nucleus.

> 
> 
>>that is is there a program that can block foo from web access but allow
>>it to imap and at the same time allow bar web access? (like most Win*
>>firewalls can)
> 
> 
> It's all about the ruleset. In this case, it looks like this option is
> involved:
> 
>   owner
>        This module attempts to match various characteristics of the
> packet creator, for locally-generated packets.  It is only valid in the
> OUTPUT  chain,
>        and even this some packets (such as ICMP ping responses) may have
> no owner, and hence never match.
> 
>        --uid-owner userid
>               Matches if the packet was created by a process with the
> given effective user id.
> 
>        --gid-owner groupid
>               Matches if the packet was created by a process with the
> given effective group id.
> 
>        --pid-owner processid
>               Matches if the packet was created by a process with the
> given process id.
> 
>        --sid-owner sessionid
>               Matches if the packet was created by a process in the
> given session group.
> 
>        --cmd-owner name
>               Matches  if  the packet was created by a process with the
> given command name.  (this option is present only if iptables was
> compiled under a
>               kernel supporting this feature)
> 
> 
> Obviously, one would have to read more of man iptables than I did, or
> get a GUI front end that handles this more 'intuitively' to actually
> write the appropriate rule, but clearly it is possible.
> 
> Hope this helps,
> Holly

See what "l7" provide as application level filtering to have some other
ideas.

never worked with advanced options like "--cmd-owner name" , this one
sound promising for a "personal firewall" but sound difficult to maintain.

A question: there are front-ends (graphical or not) that use this kind
of options ? Just because I've found rather ugly maintain directly
iptables rules.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Personal firewall for Linux?

[Uwe Thiem]

On 30 August 2005 15:28, Holly Bostick wrote:
> Nagatoro schreef:
> > Matt Randolph wrote:
> >> I've seen related threads here recently, but I think my question is
> >> different enough to warrant a new thread.
> >>
> >> I'm looking for a personal firewall along the lines of the ZoneAlarm
> >> product for Windows.  I don't want to take the time to teach myself
> >
> > Not an answer but a follow up question: Is there a firewall for Linux
> > that can do application level filtering (probably wrong terms but...),
>
> Please anybody, correct me if I'm wrong, but afaik, this assumption that
> there are multiple firewall programs in the first place is incorrect.

There are two completely different types of firewalls. One is a packet filter 
(iptables with all its frontends like shorewall, firestarter et al), the 
other is an application level firewall which does not work on IP level. While 
I am not aware of any implementation of the latter one for linux, there might 
well be one. ;-)

Uwe

-- 
95% of all programmers rate themselves among the top 5% of all software 
developers. - Linus Torvalds

http://www.uwix.iway.na (last updated: 20.06.2004)
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Personal firewall for Linux?

[Nagatoro]

Holly Bostick wrote:
> It's all about the ruleset. In this case, it looks like this option is
> involved:
[...]

Thanks. This seems like it would do the trick.
-- 
Naga
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Personal firewall for Linux?

[Matthias Bethke]

[-- Attachment #1: Type: text/plain, Size: 1445 bytes --]

Hi Matt,
on Monday, 2005-08-29 at 14:54:46, you wrote:
> I'm not trying to do anything complicated like protect a LAN or include 
> a DMZ or run an ftp server or anything like that.  I'm just looking for 
> a quick and easy way to add another layer of protection to my desktop by 
> closing all unused ports. 

Well, if they are unused, they are closed, no need to worry about them.
The only thing you'd need some packet filter (a firewall is something
different, although the term sounds so good that the marketroids have
established it even for simpler things than iptables) for is if you want
*restrictions* on some ports, like to open your web server to the LAN
but not the internet.
On Windows, the situation is a little different as you don't have a lot
of control about what program opens what ports if you don't know your
system inside-out. And many programs love to connect to their masters
and tell them all kinds of stuff about your system, so you'd usually
want to block these on an application level.
If you just want something that pops up once in a while and gives scary
messages, there's the ususal Perl one-liner :)

perl -e 'use Tk;while(1){sleep(rand(290)+10);new
MainWindow(title,"Boo!")->Button(-text,"HackAttack!!!one!\n\nBlock")->pack;MainLoop}'

cheers!
	Matthias
-- 
I prefer encrypted and signed messages.       KeyID: 90CF8389
Fingerprint: 8E 1F 10 81 A4 66 29 46  B9 8A B9 E2 09 9F 3B 91

[-- Attachment #2: Type: application/pgp-signature, Size: 481 bytes --]

Re: [gentoo-user] Personal firewall for Linux?

[Alvin A ONeal Jr]

[-- Attachment #1: Type: text/plain, Size: 551 bytes --]

>>I'm not trying to do anything complicated like protect a LAN or include 
>>a DMZ or run an ftp server or anything like that.  I'm just looking for 
>>a quick and easy way to add another layer of protection to my desktop by 
>>closing all unused ports. 

Go to gentoo-wiki.com and search for "newbie iptables" there's a 
"quickstart" guide that should tell you in 3 minutes or less the things 
that you need to know.

-- 
8^)
Laterz-
~Alvin
http://CoolAJ86.Havenite.net

---
Dad: There's good-looking, there's excellent looking, and then there's me.

[-- Attachment #2: coolaj86.vcf --]
[-- Type: text/x-vcard, Size: 323 bytes --]

begin:vcard
fn:Alvin A ONeal Jr
n:ONeal;Alvin
adr;dom:;;34 Fletcher Lane;Shelburne;VT;05482
email;internet:coolaj86@havenite.net
tel;work:1.802.877.2938
tel;home:1.802.985.5277
tel;cell:1.802.578.0599
note;quoted-printable:DoB: 19860616=0D=0A=
	
x-mozilla-html:FALSE
url:http://coolaj86.havenite.net
version:2.1
end:vcard