Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a simple solution that works via HTTP or SSH.

I need to perform the following basic tasks:

  1. NAT/router
  2. Reject all the incoming connections except predefined TCP and UDP ports and port ranges
  3. ESTABLISHED/RELATED should work by default
  4. Outgoing connections allowed by default
  5. Delegate some ports to particular hosts inside the network (Virtual server) Example: 80 - HTTP Server, 51413 - torrents

locked by HopelessN00b Jan 24 '15 at 21:05

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as not constructive by John Gardeniers, Iain, Bart De Vos, Holocryptic, sysadmin1138 May 29 '11 at 19:51

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

It would help if you were to mention which tasks specifically you were interested in. – Ignacio Vazquez-Abrams May 29 '11 at 6:03

if your using webmin already or cpanel then I would argue that CSF&LFD is one of the best, it also has the bonus feature of doing brute force protection and other smart blocking and alerting.

I used webmin in the past just for the iptables frontend. But it's a bit overkill to use it for just that one thing. I personally would love to find something I can run on my laptop to update the config on routers/server. I think Firestarter would be a good choice, but I haven't taken the time to try it. – James May 29 '11 at 8:15

You can try Shorewall. It's a frontend for iptables, and it's very powerfull.

It fits with your requirements.


The short answer is the one already bundled in your distro - that way you don't need to worry about different tools trying to set up the firewall in different ways. The answer you don't want to hear is the iptables command is the best frontend - because it always shows you exactly how the firewall is configured - not some abstract representation which is then mapped to a set of iptables rules.

I have used firestarter before (but only after removing any bundled scripts / tools for manipulating the firewall) and liked its simplicity - but its an X Window tool.

These days if you're running a ssh server, then fail2ban is essential - so you need to study how any tool you do use behaves with fail2ban.



After doing some more looking around, the choice I would make is clear: fwbuilder, also known as Firewall Builder. I've heard of it before, but looking at the website I always thought it was a commercial product. It turns out, though, that it is free and open source for the linux program, and only the MS Windows and Mac programs are closed source and paid for.

It works like Firestarter in that you run it on your workstation, and then it transfers the configuration to the target firewall using ssh and scp. I like this because it means you don't have to install anything extra and there no extra running daemons on your firewall.


Firestarter. I have not used it (yet), but it looks the most interesting, and the one I would try out first.

From the introduction page:

Firestarter can be installed onto individual servers and managed graphically over SSH or using the shell.

That or ufw, possibly with Gufw, which is the standard on Ubuntu.

Update: it looks like there is Turtle Firewall, which is the standalone version of the iptables frontend included in Webmin. And is still maintained, unlike Firestarter.


Not the answer you're looking for? Browse other questions tagged or ask your own question.