BSD or Linux for firewall?

[Kaido]

Never used BSD, but heard it's even better than Linux for doing firewall & security stuff. Comments from users?

 

[TGS]

openbsd for security

 

[Kaido]

Originally posted by: TGS
openbsd for security

What I'd like to do, for fun, is to put a firewall right after the modem in my network, but before the wifi router. The more secure the better! Any special programs to use?

 

[Thyme]

I'm not sure if there are advantages to it or not, but you can use the same computer as a router and a firewall.

 

[JDCentral]

Yeah... use a BSD system.

Speaking from experience, a BSD box is MUCH easier to lock down and configure for router/network administration than anything that Linux can offer.

I'd choose between NetBSD and OpenBSD. The only reason I don't use OpenBSD is because I tried for days and couldn't get OpenBSD to install on my router machine (Older PIII/celeron).

In regards to Thyme's response, use your wifi router as just a wifi 'switch'... and use the box as a router. This lets all of your clients use the same internet settings. Which helps when they want to switch between wired and wireless connections. Also... it allows for easier administration of your resources (like... if you want to do some bandwidth throttling, and stuff).

 

[Kaido]

Well, I'd like to get a little mini-itx system to play around with. Right now, at home, I'm using a WRT54GS as my wifi router. It's working great and I want to add Sveasoft to it, but I know the firewall capabilities are limited. I think it'd be fun to learn security stuff so that I can use it in business at a later point.

 

[sourceninja]

I use IPCop which is linux based. It works great as router/firewall. Plus you can ssh in if you need to do something more advanced.

 

[Nothinman]

Debian. Security is a process, not a product. ipf in OpenBSD is simpler to understand than netfilter on Linux, but personally I would still use Debian.

 

[n0cmonkey]

Originally posted by: Nothinman
Debian. Security is a process, not a product. ipf in OpenBSD is simpler to understand than netfilter on Linux, but personally I would still use Debian.

OpenBSD doesn't use IPF anymore. They haven't for years.

 

[n0cmonkey]

I run OpenBSD on just about everything I can get a hold of. I can't wait to set it up as a firewall/WAP again.

Linux works fine too, I just prefer OpenBSD and Packet Filter.

 

[Nothinman]

OpenBSD doesn't use IPF anymore. They haven't for years.

Sorry, was typing quickly.

 

[doornail]

Originally posted by: sourceninja
I use IPCop which is linux based. It works great as router/firewall. Plus you can ssh in if you need to do something more advanced.

Another thumbs up for IPCop. Very easy to install and maintain.

A few years ago, I switched from IPCop to Smoothwall, but recently switched back to IPCop. Works great. Smoothwall development appears to have frozen.

 

[n0cmonkey]

What's the difference between IPcop's firewall and Netfilter?

 

[sourceninja]

IPcop has a easy install, and a really nice web interface to setup the firewall/proxy/bandwith shaping/IDS.

It doesn't do anything you cant do yourself, but it makes it a world easier to manage and maintain, plus you still can ssh in if you want to do it by hand.

At least for me its much easier to open a browser to 192.186.1.1:81 and click and type in some boxes to add port fowarding of bit torren with bandwith shapping to keep it from killing my vonage when its in use (IPcop uses wondershaper for this) then it is to do it by hand.

Another really good router/firewall distro is m0n0wall. Its bsd based and really small (like under 50megs). Its designed for embedded hardware, but it can run on a PC. Again, it doesn't do anything you can't do yourself, it just is stripped down and secured with a really nice web based interface.

 

[TGS]

anyone have expericence with smoothwall?

 

[Bulldog13]

Originally posted by: Nothinman

OpenBSD doesn't use IPF anymore. They haven't for years.

Sorry, was typing quickly.

Jesus, thought that was going to turn into an epic flamewar.

nothinman vs n0cmonkey

 

[n0cmonkey]

Originally posted by: Bulldog13

Originally posted by: Nothinman

OpenBSD doesn't use IPF anymore. They haven't for years.

Sorry, was typing quickly.

Jesus, thought that was going to turn into an epic flamewar.

nothinman vs n0cmonkey

No, that's a verifiable fact. I think 3.0 was the last release IPF was in. It was quickly replaced with the world's best firewall, Packet Filter.

 

[carloboy]

netbsd is towards security more than open

 

[n0cmonkey]

Originally posted by: carloboy
netbsd is towards security more than open

Explain.

 

[Red and black]

Any of these systems (Debian, FreeBSD, NetBSD, OpenBSD) would be fine for a firewall. Use what you know, or what you have local tech support (i.e. friends) access for.

I have used NetBSD for this, though IPF is a bit of a pain -- PF (OpenBSD) is supposed to be nicer. Of course, I haven't done anything fancy (verified exec, securelevels, etc.).

I don't know what the current state-of-the-art is for linux kernel packet filters. A couple years ago, a friend set up a packet filter for Red Hat and it was a real pain, much worse than IPF.

 

[thirdlegstump]

I've had killer results with monowall firewall. Boots off CD and saves XML config data to a floppy. No HDD needed!

 

[n0cmonkey]

Originally posted by: deathkoba
I've had killer results with monowall firewall. Boots off CD and saves XML config data to a floppy. No HDD needed!

Install OpenBSD to a CompactFlash device, no moving parts.