firewall

What is firewall?

Firewall is a set of scripts (firewall, fwup and fwdown) that implement an ipchains firewall and various forms of network address and port translation. All you have to do is read the policy file and edit it to reflect your topology and filtering policy.

The policy file is composed of sections in which you need to specify: this host's trusted and untrusted network interfaces; this host's role and function within the network topology; the incoming and outgoing services to allow and the internal and external hosts that may take part in them. It has been designed to make this as painless and flexible as possible.

Each section contains detailed explanations and advice on things such as when to start the firewall and the security implications of various well known internet services and advice on how to allow them safely. It is intended to introduce administrators to some subtleties of packet filtering quickly so that they can make better informed security decisions and achieve and maintain effective network security (at least the packet filtering part) in a very short time. Of course, it will not prevent you from achieving bad network security, but you will have been warned.

Firewall is freely available under the GNU General Public License, Version 2 or later.

Features

• The administrator only needs to read and edit the (heavily documented) firewall.policy file. There is no need to see any actual ipchains, ipmasqadm or ip commands.

• Supports various network topologies:

  • Single Host (no forwarding, no address/port translation)
  • Forwarding (no address/port translation)
  • Masquerading (outgoing M:1 NAPT)
  • Port Forwarding (Masquerading + incoming 1:M NAPT)
  • Alias Port Forwarding (Masquerading + incoming N:M NAPT)
  • Static NAT (incoming and outgoing 1:1 NAT)

• Supports up to 10 untrusted network interfaces, each with a distinct policy. There can be as much or as little policy sharing between untrusted interfaces as you like.

• Supports centralised administration of multiple remote firewalls.

• Installation makes sure that the firewall starts at boot time before the network is brought up and automatically reloads whenever the host receives a dynamic address from PPP or DHCP.

• Supports control of many services (incoming and outgoing):

  • DNS Client
  • DNS Server
  • SMTP
  • POP
  • IMAP
  • LDAP
  • SSL-POP
  • SSL-IMAP
  • SSL-LDAP
  • SSH1
  • SSH2/LSH
  • FTP (active)
  • FTP (passive)
  • TELNET
  • HTTP
  • HTTPS
  • HTTP PROXY
  • SQUID
  • NNTP
  • RSYNC
  • CVS
  • GNATS
  • MYSQL
  • SMB
  • IRC
  • ICQ
  • RealAudio/QuickTime
  • VNC
  • REACHOUT
  • PC Anywhere
  • Windows Terminal Server
  • NTP
  • DAYTIME
  • TIME
  • GOPHER
  • WAIS
  • ARCHIE
  • FINGER
  • WHOIS
  • AUTH
  • NOTES
  • DIALPAD
  • WEBPHONE
  • NET2PHONE
  • HOTTELEPHONE/WEB2CALL
  • NETMEETING
  • SYSLOG
  • DHCP Client/Server
  • TACACS+
  • SNMP
  • SNMP TRAP
  • BGP
  • OSPF
  • RIP
  • KERBEROS
  • PPTP
  • IPSEC
  • PING
  • TRACEROUTE
  • X11

• Comes with example policy files for each supported network topology.

• Comes with several utilities for developing, testing and maintaining firewall rules and policy files:

  • dns2ip - a filter that translates domain names into IP addresses
  • fwhelper - helps the testing and development of an ipchains firewall
  • portscan - performs a thorough port scan
  • tcpdump-histogram - prints a histogram of connection tuples in tcpdump output

• Comes with two useful patches:

  • ipchains-Q - Makes starting the packet filter much faster
  • masq-demasq - Makes internally initiated port forwarding work

For more information see the Documentation section.

Supported Platforms

Currently, firewall is only for 2.2 linux kernels or 2.4 kernels that use the ipchains backwards compatibility module. Firewall should work on any Linux distribution including LRP (supports building an LRP package containing the firewall scripts and your policy file).

Documentation

There is a README file and firewall.policy:

Download