Member Avatar for Crash&Burn

Hi everyone,


My nic is Crash and I was just wondering about firewall and who is using what type. I have used many in the past and now have switched to Smoothwall 2.0 Express as a simple to setup firewall on an older pc. It is a Linux based firewall with a web based control panel and it is one of many now available. Are many others in this forum using one like it or do you prefer software based ones?? If so why??? Is one really better than the other?? I don't know informal poll who is using what??? Have you heard of IPcop, Devil Linux, Astaro, Leaf variations and so on there are so many now I can't keep up. I am sort of new to this forum and don't really know anyone yet. So this is a beginers question.

TIA

Ciao

Crash :cheesy:

  • 9 Contributors
  • 11 Replies
  • 371 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by <<seS>>Saint

Dani AI

Generated

This thread shows the typical tradeoffs: cheap NAT/SPI routers for convenience, dedicated Linux/BSD appliances for control, and host-based firewalls for per-machine protection. As notes, appliance projects (Smoothwall, IPcop, Devil Linux, etc.) make a dedicated box easy to run on older hardware; and point out how small consumer routers give whole‑home protection with almost no administration; and illustrate why admins prefer iptables/Shorewall or ipf when fine control, logging and VPNs are required; and , and show why host firewalls still matter on Windows and mobile laptops.

Choose by role and risk: use a simple hardware router (with UPnP disabled and admin access locked down) for plug‑and‑play protection of multiple hosts. Add host-based firewalls on laptops and Windows desktops to protect endpoints when off‑network. Use a dedicated firewall appliance (Linux/BSD) when traffic inspection, VPN termination, custom NAT/port rules, bandwidth shaping or detailed logging is needed. Prefer a layered approach: edge firewall + endpoint controls.

Practical starter (Linux) — replace interface names and ranges to match the environment:

# assume eth0 = WAN, eth1 = LAN (192.168.1.0/24)
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth1 -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Practical checklist and cautions: change vendor defaults and admin passwords, disable remote management, keep router/OS patches current, enable logging and rotate logs, back up configs, and avoid exposing unnecessary ports. NAT filters help, but do not replace patching or endpoint anti‑malware. Combining an edge firewall (hardware or appliance) with host firewalls gives the best balance of ease and security — the positions argued across this thread converge on that layered approach.

Recommended Answers

All 11 Replies

Member Avatar for moderate_rock48

I used Mcafee firewall when I was using windows ME. Once I upraded to XP I installed SP2 and now im just using that firewall that came with SP2. Im using Mcafee Anti-virus, people say Norton is the best, but I just dont like it, Mcafee is more user friendly in my opinion. heh, and to think back in the day I didnt even know what a firewall was :o

Member Avatar for nanosani

I've used many firewalls ... but windows xp sp2 firewall is good. Zone Alarm is also good but it disturbs me with its silly blocks of apps.

Member Avatar for kc0arf

Hello,

I am a network administrator by profession, and believe in solid network protection.

For dialup internet connections of temporary length, I encourage a firewall. For high-speed long term connections (cable/dsl) I demand firewall protection, or I walk away from the situation and let them suffer.

Firewall implementation can vary by design; some people prefer to firewall the main router, and let the other machines go naked; others firewall each machine on their own. I implement combination sets, so that I am protected outside of my own network when my laptop travels to other environments.

On the linux servers, I operate IPTABLES. I am considering converting to ShoreWall (I think that is what it is called) when I upgrade from RedHat 9 to Fedora sometime in the future. ShoreWall has a webmin module that should allow for easier configuration, although once I figured out IPTABLES, it is not too hard to modify for different needs.

On Windoze, I have used ZoneAlarm without trouble. For Windoze servers, I have set them up behind hardware and linux-based software firewalls.

And on my beloved Macintosh, I run the internal firewall. The Mac doesn't have any server services running on it, so the internal firewall works just fine for me.

Of course, larger companies with performance considerations will likely pop for a hardware firewall that should be faster than the software ones.

Christian

commented: webmin is cool :) +2
Member Avatar for Chainsaw

Since I have DSL, I use a hardware firewall/router to protect all the machines at home. They're dirt cheap these days.

Member Avatar for Catweazle

Anyone who uses ADSL should, in my opinion, use an all-in-one modem/forewall/router. As Chainsaw mentions, they are very inexpensive, and even if you only have a single PC at home, the small extra expense is offset by the increased protection you get. If you have more than one PC, all the management of your network is done by the router for you and there's no need for 'Internet connection sharing' hassles.

It's not a matter of 'why' use one, it's a situation of 'why the hell not?'

Member Avatar for alc6379

I have cable, and I've got a custom firewall setup.

I'm running NetBSD 1.6.2 on a Sun SparcStation 5, NAT being provided by ipnat, and firewalling performed by ipf. I've got rules set up such that certain applications I need are facing the world through port forwarding, but those same ports are accessible only from locations that I know I'd need access to those remote services on. It's worked out great for me, with months of uptime, because that's all it does!

Member Avatar for <<seS>>Saint

I too have DSL and use a modem/router. I used to use sygate personnel firewall but I feel having a hardware firewall is more effective then software.

And no offence to anyone but I think SP2 is crap. I had to do a complete re-install to get it off my computer to go back to SP1

Member Avatar for Catweazle

No offence to you either, Saint, but the more sensible approach is to perform a full reinstall to put Service Pack 2 ON the PC. :)

It's like an OS upgrade, because it impacts on just about every function of Windows. If system corruption already exists, it'll be magnified afterwards. That's the case with an upgrade install, and it's the case with this Service Pack.

Member Avatar for jwenting

See you soon in the virus and trojan forums when you come crying about having been compromised by something that SP2 fixes, looser (or luzer as you'll probably understand better).

Member Avatar for Catweazle

That comment is uncalled for, and it surprises me to see it uttered. Are you having a bad day, jwenting?


I'll see YOU in the Viruses and Nasties section, because that's where I'm moving this discussion :)

Member Avatar for <<seS>>Saint

Well m8 I have been running SP1 for quite some time, and so have many others that I know. I've NEVER encountered any virus or spyware that could have been prevented by installing SP2. True there are enhanced security features but it too has drawbacks. Let’s remember most viruses and spyware are designed to attack the Windows OS so no matter how many security patches they come out with someone will always beat it, AND THAT IS NOT TO SAY THAT THEY AREN'T GOOD TO DOWNLOAD. I've just had problems with SP2.

Oh and jwenting I really enjoy being part of this forum please don't ruin it for me. ;)

As stated before, this is not a stab at anyone who uses SP2 I just said I didn't like it or "it's crap".

Saint

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.