up vote 4 down vote favorite
share [g+] share [fb]

I have a virtual server running Debian. It's host OS is using Linux Vserver and due to its lack of support for network namespaces, using iptables to secure the box is not an option. I did many searches looking for alternatives but so far I'm only finding different front ends to manage iptables itself.

Is there anything else out there? I was hoping to tie it in into my OSSEC active response scripts to enable real time blocking when malicious activity is detected.

link|improve this question
feedback

4 Answers

up vote 6 down vote

As far as I know, iptables is the linux firewall. Never in all my years working with linux have I ever heard nor seen of any alternatives.

Do you have the option of just running the firewall layer on the host OS?

link|improve this answer
1  
iptables is not a firewall. It's a user-space tool to manipulate the firewall, netfilter. – petrus May 18 '11 at 22:16
1  
@petrus - True, but probably not worth the pedantry. – ErikA May 18 '11 at 22:18
@petrus - also, feel free to edit my answer (or any others) to correct/clarify. – ErikA May 18 '11 at 22:18
And thank god for it -- beat the heck out of ipchains. – nedm May 18 '11 at 22:29
No unfortunately I do not have access to the host OS, and since this is on a shared server I doubt they would be willing to yield to my needs. – BajaBob May 18 '11 at 23:47
feedback
up vote 1 down vote

There's always Debian GNU/kFreeBSD which ports the FreeBSD kernel the Debian/GNU userland. This would allow you to use pf as your firewall. Unfortunately, as of current (Debian 6/Squeeze) GNU/kFreeBSD is considered a "techninical preview", which means not ready for production.

link|improve this answer
feedback
up vote 0 down vote

The Linux kernel has only one built-in firewall, iptables.

There are side projects like dummynet, a Linux port of the BSD firewall, but these are for testing purposes and not to be used in production.

Dummynet: http://info.iet.unipi.it/~luigi/dummynet/

link|improve this answer
dummynet is not firewall, it is a simple traffic shaper. – AlexD May 19 '11 at 17:28
feedback
up vote 0 down vote

ip filter claims to support Linux. (I have only used it on Solaris.) http://coombs.anu.edu.au/~avalon/

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.