I am looking for a good firewall for debian 5 which is a web server. Are there any good options apart from iptables? Thanks
closed as off-topic by Chris S May 1 '14 at 19:43
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Chris S
I would take shorewall, a scripting engine atop of iptables. To build a sensible firewall on linux, you have to use iptables (It is the kernel network filtering mechanism). What you do not have to do, is to write iptables scripts by hand. Thats way too complex and nearly unmaintainable.
aptitude shorewall should also work.
all the config resides in /etc/shorewall and is done in straight text files. Shorewall itself is just a bash script, executed once. It does not provide a deamon!
Everything runs on iptables. You can download all kinds of software, scripts, GUI apps that can help you configure iptables without knowing all the detailed chains.
apt-cache search iptables and it will list all sorts of software.
Also, at the official Debian wiki you can find a very comprehensive list of IPtables frontends from which to choose.
Please note that, as other colleagues have pointed out, these tools are just frontends for managing the firewall rules more easily (the actual packet filtering is always done with iptables, through the netfilter framework).
Best regards, Marcus
There's nothing wrong with iptables. I don't think there is an alternative. What bothers you? Is it too complicated or do you need a feature iptables is not providing?
aptitude search arno
Should give you the package name for arno iptables firewall. It is a pretty nice package with support for custom rules and plugins. To reconfigure the non-custom rules it ties into dpkg nicely.
You could use NuFW : http://www.nufw.org/-English-.html It's a FW based on Netfilter, with user authentification.
You can find an « introduction » here : nufw.org/Introduction,1.html
For the moment, i just use NuFW for fun/learn, but i wish to switch from script-iptables to NuFW later.
Why do you want to run the firewall on the server itself. Have you considered putting a firewall (such as IPCop, pfSense, Smoothwall, etc) BETWEEN your servers and the internet?
In addition to iptables on the server itself (always a great idea) I'd consider taking it one step farther and having a physical appliance/firewall sitting in front of your server(s).