I am looking for a good firewall for debian 5 which is a web server. Are there any good options apart from iptables? Thanks
1
-
3What do you perceive as a reason not to use iptables?– John GardeniersAug 3, 2009 at 0:24
Add a comment
|
7 Answers
I would take shorewall, a scripting engine atop of iptables. To build a sensible firewall on linux, you have to use iptables (It is the kernel network filtering mechanism). What you do not have to do, is to write iptables scripts by hand. Thats way too complex and nearly unmaintainable.
aptitude shorewall should also work.
all the config resides in /etc/shorewall and is done in straight text files. Shorewall itself is just a bash script, executed once. It does not provide a deamon!
-
3+1 for Shorewall. It adds a nice zone based configuration setup to Netfilter. Aug 2, 2009 at 18:22
-
1Another +1 for shorewall. It should be noted that there is only one firewall in Linux, iptables. What your looking for is an interface to it.– DavidAug 2, 2009 at 21:51
-
2
-
-
1@David: ipchains is actually 2.2; iptables was introduced in 2.4 and carried through in 2.6.– womble ♦Aug 6, 2009 at 23:35
Everything runs on iptables. You can download all kinds of software, scripts, GUI apps that can help you configure iptables without knowing all the detailed chains.
Do a apt-cache search iptables and it will list all sorts of software.
-
4iptables is not the firewall system,
iptablesis the set of user space utilities to managenetfilter, the firewall system in the Linux kernel. Aug 2, 2009 at 19:21 -
If you pefer working from the command line (i.e., in a non-graphical environment), i would recommend ferm. You can find a good introduction on times.debian.net.
Also, at the official Debian wiki you can find a very comprehensive list of IPtables frontends from which to choose.
Please note that, as other colleagues have pointed out, these tools are just frontends for managing the firewall rules more easily (the actual packet filtering is always done with iptables, through the netfilter framework).
Best regards, Marcus
There's nothing wrong with iptables. I don't think there is an alternative. What bothers you? Is it too complicated or do you need a feature iptables is not providing?
-
1
aptitude search arno
Should give you the package name for arno iptables firewall. It is a pretty nice package with support for custom rules and plugins. To reconfigure the non-custom rules it ties into dpkg nicely.
dpkg-reconfigure arno-iptables-firewall
answered Aug 2, 2009 at 17:18
You could use NuFW : http://www.nufw.org/-English-.html It's a FW based on Netfilter, with user authentification.
You can find an « introduction » here : nufw.org/Introduction,1.html
For the moment, i just use NuFW for fun/learn, but i wish to switch from script-iptables to NuFW later.
Why do you want to run the firewall on the server itself. Have you considered putting a firewall (such as IPCop, pfSense, Smoothwall, etc) BETWEEN your servers and the internet?
In addition to iptables on the server itself (always a great idea) I'd consider taking it one step farther and having a physical appliance/firewall sitting in front of your server(s).
-
1And what if the attack comes from a compromised machine, or malicious user, within the local network? Aug 3, 2009 at 0:23
-
What if the attack comes from a rogue employee? ;-) My post did say "In addition to iptables on the server...". I was simply recommending an an external firewall in addition to a hardened web server.– KPWINCAug 3, 2009 at 1:19