Recently Ive been experimenting and getting to know a bit more of my linux security, so far as firewall stuff I had Firestarter running from the getgo in my FC3. I stumbled upon this Guarddog thingie and decided to see what it was. If I understand correctly my Linux comes with its own firewall thingie (something called iptables and other stuff) and all that Guarddog does is configure it nicely by editing something called rc.firewall.
Now does this means thats all it takes to keep my box secure? A simple tweaking of this rc.firewall file?
So what exactly does Firestarter? It loads its own rules or what? Ive noticed how it not only detects portcalls but it helps me identify'em.
Also, now that Ive tweaked rc.firewall using Guarddog, do I need to keep running Firestarter or could I live without it for now on?

Thanx for any replies and comments.

The actual firewall is part of the Linux kernel (it's called iptables). You can see the current rules for it by typing /sbin/iptables -L. Firewall tools feed a ruleset to iptables. If you use more than one on the same system then things may get a bit confusing, that's all.

The rc.firewall file is probably specific to Guarddog.

Firestarter is also a firewall just like Guarddog.


No they are both firewalls and you should only have one firewall running on your system at a time.

>> Now does this means thats all it takes to keep my box secure? <<

In addition to utilising a firewall, you should also keep your system updated with the latest security patches etc - the typical option is to use YUM on FC3 to keep your system updated - you should also deploy strong passwords, disable any un-necessary services, use an ordinary limited-user account etc....

So, if I understand correctly now that I have rc.firewall properly configured by Guarddog I can ditch Firestarter, right? This might be a dangerous question but, is there any way I can check if my box is really secure? I heard of some security websites where they could check your ports and see if your box is secure, what sites are these? can they really be trusted? should I visit'em and see whats what with my firewall?

Thanx to those who have replied and to those who will reply.

You can go to some online scanner, there are many to choose from, e.g. www.grc.com www.dslreports.com/scan/ just to name two. You could also get nmap from www.insecure.org and that way you can check your box yourself.

And yes you should only be running one firewall, so you should turn off either Guarddog or Firestarter, your choice.