If this is an obvious topic and that's why I can't find good sources, my apologies.

Does anyone know how a firewall device performs compared to a linux system running iptables and doing bridging? (This is for webhosting type networks with a T1 - not too big, but not a business office ISDN line either).

I have experience with a GNAT box which is an okay firewall/NAT/Router appliance, but it's webinterface is lacking, and it'd be nice to have a box that I could ssh into, do advanced logging, sniffing or even mail scanning stuff. Now that I've used the Sentry Firewall distro to make a transparent bridge/firewall system, it seems like that's the way to go.

I assume that since just about every web page I find discussing this avenue are marred with the "For the small business" or "Office" that there's some real performance issue that puts it out of the question.

Note: I've read through (somewhat) Linux advanced routing and traffic control pages so that I know it's possible. I just haven't seen the cut and dry page that says that people "Should" build their own firewalls for medium internet businesses if their able, and here's a list of hardware that works well.

Can anyone help in this discussion, or point me to the definitive forum/website for people who'd rather use linux and spend time on the learning curve then big bucks on a proprietary interface that naturally has shortcomings?

Hmmm, you've kind of answered you question yourself..

The reason a custom solution is better is exactly as you have mentioned, lack of facilities...
You get the chance to add/remove whatever you like...

The downside of a custom solution, is it doing enough?
I would expect a company like Cisco to know what they are doing, which is why I install antivirus software and personal firewalls on workstations.
If I don't, I get to clear up the mess later...
So, Cisco & many others do know what they are doing, but do you know if it good enough??? Hmmm???

Without auditing their systems (do you know what to look for even?), it's a guess they are doing what you want...
So I like custom solutions, once I am sure I know what I am doing..
Until then, I recommend learning quickly, and the fastest tool is information, IDS logs, packet sniffers/loggers, firewall logs, proxy logs etc, & a good source of documentation.

I suggest you have a good look at the snort project, snort-inline and even hogwash to get an idea of how attacks are crafted and how to structure (many levels) protection.

As far as the speed is concerned, snort on a T1 wouldn't be a challenge.
It is quite processor heavy, which is why HogWash and others were developed.. but it handles much faster LANs than a T1 can feed data.

I personally favour the "inline" filters, (even if it's just for logging). They can be built as ethernet bridges so physical installation is a breeze..

Thanks for your reply...

It was a poorly formed question. I know how to monitor networks and stuff, but I have never really worried about performance because I was always in control of the environment. Now that I have to install solutions for customers, I was looking for the soothing HOWTO out there that fit my exact situation.

I guess that people who know enough to put a linux router in don't need to ask the question "Does it perform well" because they do the benchmarking.

For anyone else who has this question, I came across this site:
Linux Advanced Routing & Traffic Control

where they discuss (as you might expect) advanced stuff. And while there are some optimization threads in their mailing list, it's only for some heavy hitting stuff (gigabit networking and getting good throughput with thousands and thousands of iptables rules) - so I'm more then all set when talking about maintain some 500-600 lan/wan computers on a firewalled network and a dmz serving to the internet.

Also as a reference for anyone who thinks like I do (good luck) and doesn't find stuff quickly, it took me a long time to find out how to drop in a transparent firewall because I was looking for the wrong search terms.

Search on Transparent Bridge and Firewalling. In linux there's a cool brctl command that allows you to create a virtual network device while leaving two or more adapters in promiscous mode.

www.sentryfirewall.com is a good tool to solidify some network concepts that remain abstract until you actually put a box in and mess with your lan.

What I like about that kind of setup is the ability to bridge & intercept ethernet frames as well as link them to an IP layer and filter with iptables at the same time...

I'm just sorting out proxying as a pass thru at the moment...

It Rocks...!!

I don't think performance is a worry at all. Firewalls are typically limited by their bus speed and the speed of the NICs. Many enterprise firewall appliances are built on reletively low-end Celeron CPUs with not a lot of RAM (in the 128MB neigborhood).

The reason Linux firewalls are pegged as "Small Office/Home Office" is because of two things a) low cost b) low quality. Before everyone gets up in arms about point b, think about it. If it was so easy to just through a packet filter on a box and call it good, why didn't Sun do this a long time ago (actually, I hear they may have, but the fact that I've never seen it in a single data center is telling), why isn't Microsoft's ISA server better regarded? In fact, there are a few Linux-based commercial firewalls available, but none of them are rated very highly.

The fact is that years of research and developement go into firewalls and years of experience give a definite advantage. For you or I to come along and just write a firewall from scratch, there are bound to be errors and also many things that work, but could be done a lot better. That's what you buy when you get a commercial firewall, not just the features, but the history that company has put into the product and all the bugs and vulnerabilities they have already found and corrected. Also, the well respected hardware firewalls like PIX and Netscreen have the additional advantage of no moving parts (other than their fans), whereas you would have to put a lot of work into a PC-based firewall to remove harddrive, the reliance on a PSU fan, etc...