up vote 3 down vote favorite
2
share [g+] share [fb]

I am looking for a good firewall for debian 5 which is a web server. Are there any good options apart from iptables? Thanks

link|improve this question
3  
What do you perceive as a reason not to use iptables? – John Gardeniers Aug 3 '09 at 0:24
feedback

7 Answers

up vote 13 down vote accepted

I would take shorewall, a scripting engine atop of iptables. To build a sensible firewall on linux, you have to use iptables (It is the kernel network filtering mechanism). What you do not have to do, is to write iptables scripts by hand. Thats way too complex and nearly unmaintainable.

aptitude shorewall should also work.

all the config resides in /etc/shorewall and is done in straight text files. Shorewall itself is just a bash script, executed once. It does not provide a deamon!

link|improve this answer
3  
+1 for Shorewall. It adds a nice zone based configuration setup to Netfilter. – David Pashley Aug 2 '09 at 18:22
1  
Another +1 for shorewall. It should be noted that there is only one firewall in Linux, iptables. What your looking for is an interface to it. – David Aug 2 '09 at 21:51
2  
@ 2nd David, ipchains finally depreciate? – Avery Payne Aug 2 '09 at 23:16
guys go and learn iptables ;) – asdmin Aug 3 '09 at 8:40
1  
@David: ipchains is actually 2.2; iptables was introduced in 2.4 and carried through in 2.6. – womble Aug 6 '09 at 23:35
show 1 more comment
feedback
up vote 5 down vote

Everything runs on iptables. You can download all kinds of software, scripts, GUI apps that can help you configure iptables without knowing all the detailed chains.

Do a apt-cache search iptables and it will list all sorts of software.

link|improve this answer
3  
iptables is not the firewall system, iptables is the set of user space utilities to manage netfilter, the firewall system in the Linux kernel. – Manuel Faux Aug 2 '09 at 19:21
stand corrected - edited. – sybreon Aug 3 '09 at 4:03
feedback
up vote 4 down vote

If you pefer working from the command line (i.e., in a non-graphical environment), i would recommend ferm. You can find a good introduction on times.debian.net.

Also, at the official Debian wiki you can find a very comprehensive list of IPtables frontends from which to choose.

Please note that, as other colleagues have pointed out, these tools are just frontends for managing the firewall rules more easily (the actual packet filtering is always done with iptables, through the netfilter framework).

Best regards, Marcus

link|improve this answer
feedback
up vote 1 down vote

There's nothing wrong with iptables. I don't think there is an alternative. What bothers you? Is it too complicated or do you need a feature iptables is not providing?

link|improve this answer
1  
Go with iptables. :-) – Tatas Aug 2 '09 at 15:39
feedback
up vote 1 down vote 
aptitude search arno

Should give you the package name for arno iptables firewall. It is a pretty nice package with support for custom rules and plugins. To reconfigure the non-custom rules it ties into dpkg nicely.

dpkg-reconfigure arno-iptables-firewall
link|improve this answer
feedback
up vote 0 down vote

You could use NuFW : http://www.nufw.org/-English-.html It's a FW based on Netfilter, with user authentification.

You can find an « introduction » here : nufw.org/Introduction,1.html

For the moment, i just use NuFW for fun/learn, but i wish to switch from script-iptables to NuFW later.

link|improve this answer
feedback
up vote -1 down vote

Why do you want to run the firewall on the server itself. Have you considered putting a firewall (such as IPCop, pfSense, Smoothwall, etc) BETWEEN your servers and the internet?

In addition to iptables on the server itself (always a great idea) I'd consider taking it one step farther and having a physical appliance/firewall sitting in front of your server(s).

link|improve this answer
1  
And what if the attack comes from a compromised machine, or malicious user, within the local network? – John Gardeniers Aug 3 '09 at 0:23
What if the attack comes from a rogue employee? ;-) My post did say "In addition to iptables on the server...". I was simply recommending an an external firewall in addition to a hardened web server. – KPWINC Aug 3 '09 at 1:19
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.