Hi All,

I want configure open source firewall on my office for websites blocking and bandwidth monitoring.

Can any please tell me which is the beast free open source firewall........

Regards
Thirupathi

Thirupathi

Most Distros have their own FW's available and active on them. For instance, Fedora uses the SELinux FW, Suse uses the AppArmour FW. Check with your distros package management site.
You just need to learn how to use them.

If you are thinking of using something like Smoothewall, read the HOW-TOs on the Smoothewall home page.Also go read the several sites on the Internet on IPtables and how they work.

Alternatively, what I do is this; I have my PC's attached to a routered network and use the default firewalls inherent to the OS. The Router acts like a hardware Firewall, and then all SElinux needs to do is monitor LAN cross traffic.
This method is the simplest.

If you are still Gung-Ho at using a 3rd party FW for your LAN ... then Smooth Wall goes on a PC separate from the one you logged onto this Forum with.

graphically its like this::

internet --> modem --> Gateway [Firewall} PC --> LAN Switch or Hub [ switch is better]--> LAN PC's

or Using a router , like this ::

Internet--> modem --> Router --> LAN PC's


So a router is much simpler
And routers are not that expensive
But if you are persistent on learning IPchains method , read the HowTo's on the net ... and read the Smoothewall site info and go from there .


ok?


L-R

0 members found this post helpful.

The default "firewall" built into Linux is called Iptables. It is a front end for netfilter which is built into the Linux kernel itself. Iptables is a program that can be a little difficult to setup, as the syntax is a little bit strange until you get used to it, but not so much that you should shy away from it. Once you do get used to it, writing scripts for iptables becomes somewhat of an art. There are also GUI applications to assist with the setup, like UFCW and Firestarter, though this will depend on your distribution.

As far as for blocking websites, I assume you mean that you want to prevent others from being able to access certain sites. In this case, you would want to use a proxy, such as Squid. Squid may also provide bandwidth monitoring.

One application that I like to use to monitor network activity is Iftop. On the surface, it looks like a simple program, much like Top, but has a lot of capability.

I don't really consider AppArmor and SELinux to be "firewalls". In my opinion, those are more of a system hardening application where it enforces access rights as an extension to the standard Linux permissions system.

2 members found this post helpful.

Yes as said above. IPTables is your standard linux network firewall these days. Your distro probably comes with a graphical utility to make firewall rules.

So to block access to a certain website a rule such as:
could be used. Though this may block access to any other website on that are on the IP. To get around that you could block the DNS resolution in /etc/hosts on your DNS server, or just every PC. By putting a line in like:
127.0.0.1 www.evilsite.youwantotblock.com

this is easily bypassed with a proxy though.

As for bandwidth monitoring I've never had to do that personally, but there looks to be a good tutorial for a simple (text based) solution it here: http://www.linux.com/learn/tutorials...-with-iptables

Though consider quid and iftop as mentioned above.

The best free, open-source and human-readable firewall is probably OpenBSD's PF http://www.openbsd.org/faq/pf/

You might consider using a proxy, as suggested, but use a white list instead of a black list. Allow traffic only to locations that employees need to use for their job.

Hi All,

Thanks for suggestions finally i have configured the SQUID with SARG and it is working fine.

Thanks for all help.


Regards
Thirupathi

Sweet!

Can you mark the post as SOLVED? Thanks!

1 members found this post helpful.

I would like to say a few words about 2 other tools:
- netwatch
- iptraf
I use both and I like them. Hope my modest advice could be helpful to somebody. :-)

Attached Thumbnails

 

3 members found this post helpful.