Firewalls

[yesthattom]

I’ve said it before and I’ll say it a again... if you come to me asking how to build a firewall out of a linux box and two NICs, I’m going to tell you that it costs $70. Take that $70 and go to CompUSA and buy a darn “home router” and don’t bother me. It will be done in less than an hour, it will be more reliable, it won’t have a noisy fan, and it will use less power. The reduction in power will pay for itself in a year. For $40 more it will do WiFi without having to figure out the bizarre and badly engineered WiFi stuff that comes with most *nixes. If you want reliability, buy the Linksys model with built-in WiFi, 802.11g, WPA, and the built-in 4-port hub.

Now if you come to me saying, “Tom, I’m trying to learn about networking and security and I thought that building a firewall from scratch with a linux box and two NICs” then I’ll gladly offer advice (mostly by pointing you to FAQs and such).

However, most of the time I’ll help you pick the right Linksys. At least it uses embedded Linux and is hackable.

That is all.

Comments

[okelle.livejournal.com]

Rock on with your bad and fed-up expert self.

Word.

Oh, and happy thanksgiving!

Why indeed

[mrfantasy.livejournal.com]

My in laws got a free combo ADSL modem/firewall/wireless gateway/4 port 10-100 switch with their DSL service. It sits silently atop their PC. I'm going to make them run a Linux box under the desk? Hah.

I've got that Motorola router that I bought at the last $GROUPNAME meeting which I'll put OpenWRT on when I have a chance. Fun.

[sweh.livejournal.com]

Yup; the linksys wrt54g is a great router for the price (you can get them for under $60 these days).

I used to have a Linux machine as my firewall because I wanted my WLAN and LAN to be seperated, but in the end simple convenience meant there was almost do distinction between them, so I replaced with the the Linksys (and gained the 4 port built-in 100Tx switch - Note a switch and not a hub).

[origamislayer.livejournal.com]

I started with a linux firewall because I had the parts lying around, I also used it as a fileserver, and it was the only way I could share my DSL at the time (stupid USB Stingray modem). Now I just use Smoothwall on the same box aqnd I have a dedicated fileserver. If I lose another hard drive in the firewall (I'm on my third) I'll retire it for a hardware solution.

And I thought I heard that the new Linksys routers weren't using Linux anymore?

http://blogs.zdnet.com/open-source/?p=491

[rainbear.livejournal.com]

Yes! Though a slightly different issue, I admit it was a fun exercise at Lumeta to build that firewall with you. :)

Usually what gets me squick'd more is hearing about people going "I have (DSL|Cablemodem) and I want to be able to use it with another PC in the house." "Well don't you have a (DSL|Cablemodem) Router?" "A what?" "Is your PC plugged directly into that (DSL|Cablemodem)?" "Yeah, why wouldn't it be? Oh, would you happen to know why my machine runs so slow all the time?" (inner_voice:SCREAM)

And then you get the people who don't understand why anyone would try to break into *their* computer, cuz who are they to get hacked, anyway. "But, you see, it doesn't matter that it's your computer. It's just that it's a computer on the (DSL|Cable) network." "But what do they think they'll get from my computer? It's not like I have anything major here." "It doesn't matter. They're just looking for any computer they can hack into. By being unprotected on that network, you're a ripe apple for picking." "But they don't know who I am, why would they want to get into my PC?" (inner_voice:ARRGH)

Though, usually, I'm able to explain to a good 80% of people I've talked to about it, why they should have one.

[sfo2lhr.livejournal.com]

Couldn't agree more. I point people at the Linksys (which, BTW, is only $60-70 total for 802.11g, routing, NAT, and a 4-port switch) (http://froogle.google.com/froogle_cluster?q=linksys+802.11g&pid=1886608331007688658&oid=18358534262681327892&btnG=Search+Froogle&lmode=&addr=&scoring=p&hl=en) as well. The basic level firewall is, at this point, a mass-market, fungible, consumer appliance.

There are some people who want to run services in a DMZ, but they're by far the minority.

[lovingboth]

Thank you for this.

I didn't go for Linksys, but... it works and it is indeed much easier than trying to do it via sharing one PC's connection.