What is the best iptables frontend? [closed]

Question

I'm looking for a simple solution that works via HTTP or SSH.

I need to perform the following basic tasks:

1. NAT/router
2. Reject all the incoming connections except predefined TCP and UDP ports and port ranges
3. ESTABLISHED/RELATED should work by default
4. Outgoing connections allowed by default
5. Delegate some ports to particular hosts inside the network (Virtual server) Example: 80 - HTTP Server, 51413 - torrents

Answer 1

if your using webmin already or cpanel then I would argue that CSF&LFD is one of the best, it also has the bonus feature of doing brute force protection and other smart blocking and alerting. http://configservers.org/cp/csf.html

Answer 2

You can try Shorewall. It's a frontend for iptables, and it's very powerfull.

It fits with your requirements.

Answer 3

The short answer is the one already bundled in your distro - that way you don't need to worry about different tools trying to set up the firewall in different ways. The answer you don't want to hear is the iptables command is the best frontend - because it always shows you exactly how the firewall is configured - not some abstract representation which is then mapped to a set of iptables rules.

I have used firestarter before (but only after removing any bundled scripts / tools for manipulating the firewall) and liked its simplicity - but its an X Window tool.

These days if you're running a ssh server, then fail2ban is essential - so you need to study how any tool you do use behaves with fail2ban.

Answer 4

Update:

After doing some more looking around, the choice I would make is clear: fwbuilder, also known as Firewall Builder. I've heard of it before, but looking at the website I always thought it was a commercial product. It turns out, though, that it is free and open source for the linux program, and only the MS Windows and Mac programs are closed source and paid for.

It works like Firestarter in that you run it on your workstation, and then it transfers the configuration to the target firewall using ssh and scp. I like this because it means you don't have to install anything extra and there no extra running daemons on your firewall.

Old:

Firestarter. I have not used it (yet), but it looks the most interesting, and the one I would try out first.

From the introduction page:

Firestarter can be installed onto individual servers and managed graphically over SSH or using the shell.

That or ufw, possibly with Gufw, which is the standard on Ubuntu.

Update: it looks like there is Turtle Firewall, which is the standalone version of the iptables frontend included in Webmin. And is still maintained, unlike Firestarter.