Originally Posted by frankbell

Here's an iptables tutorial:

http://www.frozentux.net/documents/iptables-tutorial/

It might be easier to use an rc.firewall script, such as this one:

http://projectfiles.org/firewall/

The script is well-annotated.

And here's The Linux Documentation Project HOWTO:

http://tldp.org/HOWTO/Firewall-HOWTO.html

I usually use either an rc.firewall script or the Firestarter GUI frontend for iptables.

Firestarter is in the Ubuntu repos.

Originally Posted by mansour

... but if I don't know how to recompile the kernel as suggested in that HowTo

Originally Posted by mansour

should I just go with the Firestarter which is a GUI as I understood.
Am I correct to assume that the Firestarter GUI works well on a Ubuntu 10.04 machine, which I am going to use for my Firewall?

Originally Posted by salasi

Most people using a normal kernel from a distribution (as oppose to a custom, minimalist, self-compiled, kernel) will have no reason to recompile the kernel just to use a firewall. Some people who have compiled a very stripped-down kernel might have to do it, but it is hardly the commonest case.

And:



Given that recompiling the kernel would be the least of your problems, if you went down this route, and you are not confident about recompiling the kernel, I'd have to suggest that it is possible (what isn't, if you have the source?) but the degree of difficulty would be well in excess of anything that you are likely to be able to be successful with. Of course, you'd learn a lot, on the way, but, from what evidence there is, I doubt that you would ever succeed.

Of course, it is likely to be possible for an expert with quasi-infinite resources, but why would they do that? What advantage is there that would accrue which would lead them to do this? It would probably be easier to 'fix' iptables to include whatever it is that is the hidden advantage of PF rather than get PF to work with Linux, but that doesn't make it impossible (just unreasonable/insane, but a lot of good can come out of insane projects...)



Roughly, 'firewalls' on the Linux platform fall into two categories

• Bash scripts that create and instantiate a set of firewall rules for iptables
• GUIs that create and instantiate a set of firewall rules for iptables

(so, really, iptables is the firewall, these other things are just easier ways of controlling it...and, another possible wrinkle is that if you are using one of the very compact distros (dsl, etc) that uses an earlier kernel, you might find that you are using a precursor to iptables, but the view from 10,000 ft is the same, anyway)

In general, whatever your distribution, if you can get the 'firewall' (the program to interface to the firewall, not iptables, itself) from your distro's repositories, then that ought to work with your distribution in a relatively painless manner. If not, there is something wrong with how your distro has configured the program and its install routines. (I don't think that firestarter is the default for Ubuntu, but Gufw, or something, is*. However, if you install from the main repos of your distro, whatever you get ought to work, or it is a misconfiguration bug. If, hiowever, you manually compile the code for something from, eg, a widely available .tar.gz that has not been tweaked for you distro it may work or it may not, depending on whether any tweaks are required for your distro. Obviously, you may have more difficulty getting help with a problem like that.)

* ...and, at some points, the default for Kubuntu has not necessarily been the same as Ubuntu (what about xubuntu, lubuntu, etc, etc?), so we do have to be careful about what exactly we are talking about here but I am referring to Ubuntu, and not the other Ubuntus, or Ubuntu server.

Originally Posted by mansour

OK, I downloaded the Firestarter last night from their site. But do I need to connect it to the iptables at all, and how would I do that?

Originally Posted by salasi

Err, did you read what I wrote? Really?

Originally Posted by frankbell

Run Firestarter as root and it will take care of finding iptables.

Originally Posted by frankbell

Run Firestarter as root and it will take care of finding iptables.

Originally Posted by mansour

Now are you saying that I should forget about the Firestarter and instead install the GuFw.
I am not going to do that.

Originally Posted by mansour

I did, but maybe didn't understand it well,
I know what is the real firewall in linux.(is the iptables or ipchain) obviously the Firestarter is only a GUI interface with the iptables, in order to control it. And I have installed it already on my ubuntu desktop machine. But I don't know how to use it now.

Originally Posted by salasi

You made that up; you need to read more carefully.




You will need to know something about its use; in normal circumstances, the answer 'read the man page' would be one of the appropriate ones. In downloading direct from the website of the program, rather than using the easier and safer (and more guaranteed to work) method, you have made it more likely that you have no man page, or no man page that works, and that is entirely your problem.

Note also that creating iptables rulesets is not the only thing that firewall utilities do; there is some level of configuring the kernel that is usually done as well. Ubuntu is somewhat variant in this regard, so unless you have a utility modified for the Ubuntu platform, the kernel config part may not work. If you get something out of the Ubuntu repos, I am 99.9% certain that it will work; for something from a producer's website, it is probably closer to 50%.

Originally Posted by mansour

Well, I actually removed it once, and then re-installed it again form the command line.
#apt-get install firestarter

So I think is from the ubuntu repositories.
I think it is a success initially, I just have to learn to configure the policy page.

I copied its icon on my desktop as well. Everything seems clear. Its active button is seen, a UDP connection from SMB service from my Win XP was blocked on five or six occasions on first time around 7:30 pm when I first statrted it. I just don't know yet how to make any changes to the policy page if I need to. And it has a 30 page manual with it that is hard to understand. So this would be my stand alone firewall, and I will isntall one on each machine I have. That's three linux machine.


mansour

Originally Posted by spankbot

IPCop is a well known Linux distribution that is built from the ground up to be a dedicated firewall. It's easy to setup and powerful.

Building your own firewall from the ground up is not a good idea if you're a beginner (in my opinion).

Firestarter is also a great solution if you simply want to run a software firewall on your desktop machine. Note that your typical WiFi NAT router is a far better solution.