Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am looking for a good firewall for debian 5 which is a web server. Are there any good options apart from iptables? Thanks

share|improve this question

closed as off-topic by Chris S May 1 at 19:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Chris S
If this question can be reworded to fit the rules in the help center, please edit the question.

3  
What do you perceive as a reason not to use iptables? –  John Gardeniers Aug 3 '09 at 0:24

7 Answers 7

up vote 12 down vote accepted

I would take shorewall, a scripting engine atop of iptables. To build a sensible firewall on linux, you have to use iptables (It is the kernel network filtering mechanism). What you do not have to do, is to write iptables scripts by hand. Thats way too complex and nearly unmaintainable.

aptitude shorewall should also work.

all the config resides in /etc/shorewall and is done in straight text files. Shorewall itself is just a bash script, executed once. It does not provide a deamon!

share|improve this answer
3  
+1 for Shorewall. It adds a nice zone based configuration setup to Netfilter. –  David Pashley Aug 2 '09 at 18:22
1  
Another +1 for shorewall. It should be noted that there is only one firewall in Linux, iptables. What your looking for is an interface to it. –  David Aug 2 '09 at 21:51
2  
@ 2nd David, ipchains finally depreciate? –  Avery Payne Aug 2 '09 at 23:16
    
guys go and learn iptables ;) –  asdmin Aug 3 '09 at 8:40
1  
@David: ipchains is actually 2.2; iptables was introduced in 2.4 and carried through in 2.6. –  womble Aug 6 '09 at 23:35

Everything runs on iptables. You can download all kinds of software, scripts, GUI apps that can help you configure iptables without knowing all the detailed chains.

Do a apt-cache search iptables and it will list all sorts of software.

share|improve this answer
3  
iptables is not the firewall system, iptables is the set of user space utilities to manage netfilter, the firewall system in the Linux kernel. –  Manuel Faux Aug 2 '09 at 19:21
    
stand corrected - edited. –  sybreon Aug 3 '09 at 4:03

If you pefer working from the command line (i.e., in a non-graphical environment), i would recommend ferm. You can find a good introduction on times.debian.net.

Also, at the official Debian wiki you can find a very comprehensive list of IPtables frontends from which to choose.

Please note that, as other colleagues have pointed out, these tools are just frontends for managing the firewall rules more easily (the actual packet filtering is always done with iptables, through the netfilter framework).

Best regards, Marcus

share|improve this answer

There's nothing wrong with iptables. I don't think there is an alternative. What bothers you? Is it too complicated or do you need a feature iptables is not providing?

share|improve this answer
1  
Go with iptables. :-) –  Tatas Aug 2 '09 at 15:39
aptitude search arno

Should give you the package name for arno iptables firewall. It is a pretty nice package with support for custom rules and plugins. To reconfigure the non-custom rules it ties into dpkg nicely.

dpkg-reconfigure arno-iptables-firewall
share|improve this answer

You could use NuFW : http://www.nufw.org/-English-.html It's a FW based on Netfilter, with user authentification.

You can find an « introduction » here : nufw.org/Introduction,1.html

For the moment, i just use NuFW for fun/learn, but i wish to switch from script-iptables to NuFW later.

share|improve this answer

Why do you want to run the firewall on the server itself. Have you considered putting a firewall (such as IPCop, pfSense, Smoothwall, etc) BETWEEN your servers and the internet?

In addition to iptables on the server itself (always a great idea) I'd consider taking it one step farther and having a physical appliance/firewall sitting in front of your server(s).

share|improve this answer
1  
And what if the attack comes from a compromised machine, or malicious user, within the local network? –  John Gardeniers Aug 3 '09 at 0:23
    
What if the attack comes from a rogue employee? ;-) My post did say "In addition to iptables on the server...". I was simply recommending an an external firewall in addition to a hardened web server. –  KPWINC Aug 3 '09 at 1:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.