Linux Firewalling...opinions desired....

[n0cmonkey]

I actually had to do some emergency work on a Linux firewall recently. I was using IPChains, and it wasn't too bad.

 

[drag]

Check out Unixcircle They have some good step by step howto's for OpenBSD/OpenBSD + PF/NetBSD/FreeBSD/Linux firewalls plus provide links to more research material and a online port scanner to test your firewall for you.

 

[drag]

Originally posted by: n0cmonkey

Originally posted by: skyking
There is no analog to it in IPFW, that is why I asked. I am going to try a multi-nic box, with 3 inside interfaces. Have you ever done one of those? I have a tulip 4 port nic i was going to try, and use it to subnet off wireless with only internet access, and one for the normal lan, and a server nic for http kinds of things.

I currently have a 3 nic firewall machine at home. I have the outside nic, the "dmz" nic, and a wireless nic. It works just fine.

I think that linux can handle something like up to 8 nic cards, but don't hold me to that.

 

[n0cmonkey]

Originally posted by: drag

Originally posted by: n0cmonkey

Originally posted by: skyking
There is no analog to it in IPFW, that is why I asked. I am going to try a multi-nic box, with 3 inside interfaces. Have you ever done one of those? I have a tulip 4 port nic i was going to try, and use it to subnet off wireless with only internet access, and one for the normal lan, and a server nic for http kinds of things.

I currently have a 3 nic firewall machine at home. I have the outside nic, the "dmz" nic, and a wireless nic. It works just fine.

I think that linux can handle something like up to 8 nic cards, but don't hold me to that.

I can't give numbers, but OpenBSD can handle multiple nics (more than 3) easily. I am sure they are supported in Linux too, but some of the 4 port NICs are supported under multiple archs in OpenBSD.

 

[Nothinman]

I think that linux can handle something like up to 8 nic cards, but don't hold me to that.

A quick look at the net device registration code and it looks like the device index is a signed integer, which would hold a lot more than 8 =)

 

[chsh1ca]

It can use theoretically way more than 8 NICs. Practically, you are probably limited to what will fit into a machine anyway. I have a slackware based central firewall solution here that has 7 NICs (6 PCI, 1 onboard) and it works without flaw.

Unless you get multiport NICs, you aren't likely to run into more than 6 in any machine anyway.

 

[n0cmonkey]

Originally posted by: chsh1ca
It can use theoretically way more than 8 NICs. Practically, you are probably limited to what will fit into a machine anyway. I have a slackware based central firewall solution here that has 7 NICs (6 PCI, 1 onboard) and it works without flaw.

Unless you get multiport NICs, you aren't likely to run into more than 6 in any machine anyway.

You could have 2 onboard, 6 in PCI slots, 4+ USB, and a couple of firewire connections

Not sure why you would want to though.

 

[chsh1ca]

The same reason people climb mount everest. To say that they did it, and few others have.

 

[Barnaby W. Füi]

Originally posted by: n0cmonkey

Originally posted by: BingBongWongFooey

Originally posted by: cleverhandle
Hehe, I see the PF followers jumped right in.

Actually we both use ipf thank you very much

There is a port of PF for NetBSD.

Yeah, I am actually eager to see it replace IPF in the main tree. Until then, though, I doubt I'll have much reason to mess with hacking it in.

 

[Barnaby W. Füi]

Originally posted by: n0cmonkey

Originally posted by: chsh1ca
It can use theoretically way more than 8 NICs. Practically, you are probably limited to what will fit into a machine anyway. I have a slackware based central firewall solution here that has 7 NICs (6 PCI, 1 onboard) and it works without flaw.

Unless you get multiport NICs, you aren't likely to run into more than 6 in any machine anyway.

You could have 2 onboard, 6 in PCI slots, 4+ USB, and a couple of firewire connections

Not sure why you would want to though.

You could have some 4 port nics in the pci slots too, but I'm sure you would run out of irqs or whatever else before you actually got 24 working pci nics.

And really you could have tons of USB adapters, hundreds even.

 

[n0cmonkey]

Originally posted by: BingBongWongFooey

Originally posted by: n0cmonkey

Originally posted by: chsh1ca
It can use theoretically way more than 8 NICs. Practically, you are probably limited to what will fit into a machine anyway. I have a slackware based central firewall solution here that has 7 NICs (6 PCI, 1 onboard) and it works without flaw.

Unless you get multiport NICs, you aren't likely to run into more than 6 in any machine anyway.

You could have 2 onboard, 6 in PCI slots, 4+ USB, and a couple of firewire connections

Not sure why you would want to though.

You could have some 4 port nics in the pci slots too, but I'm sure you would run out of irqs or whatever else before you actually got 24 working pci nics.

I went for no multiport NICs.

And really you could have tons of USB adapters, hundreds even.

Good point. I hate USB to the point I forgot that you can do that.

 

[Nothinman]

You could have some 4 port nics in the pci slots too, but I'm sure you would run out of irqs or whatever else before you actually got 24 working pci nics.

IRQs are virtual, the numbers don't really mean anything any more, you would run out of PCI slots before IRQs.