Which is more secure:

A nat router or a linux distro on an old pc with a firewall?

Currently I am using a Linksys router but I was wondering if turning
and old P133 into a firewall/router would be more secure.

Or are they about the same depending on configuration?

I'd say for the average user a store bought router is perfectly fine and more secure for 1 simple reason. The average user will not and/or does not take the time really learn to use tools like iptables. As a result of that they are more prone to unknownly opening/leaving holes in the firewall. That said, for those that desire to learn to use, or are well versed in it already, iptables and the other software involved, custom building your own router gives you alot more control and the ability to do things the average store bought router can not do. You can also stay on top of any security related updates, whereas you generally need wait on the router manufactor to provide you with new firmware when using a store bought router.

So it really just depends. If you want to setup a router without that much trouble and forget it, I'd go with the store bought variety. But if you wish to dig deeper and tweak your firewall to your liking, then build your own.

If you perform a minimal install on the PC and don't install any daemons or added software, then you will be running more or less the same thing, as the majority of linksys routers actually run linux (see the "open source info" of their website). While the linksys router is likely more optimized for firewalling/nat'ing and a little more "plug-and-play", it's also less flexible and configurable than a PC-based firewall, so you are kind of limited in a number of areas like logging capabilites, interface, adding on other security apps like snort, etc.

Thanks for the replies,

it sounds like linksys routers aren't such a bad thing then

i am beginning to think i am not knowledgable enough to setup
a firewall/router on an old pc and be sure it's secure

so i think i'll stick with the linksys for now...

thanks again

If you have time and some old equipment, building your own can be
fun and a learning experience.
Some time ago I bought a p166 machine with a nic in it for $20US.
I put another old nic in it, removed the cdrom and harddrive, and boot
"FloppyFW" from a write protected floppy.
It took me a couple of days to get it configured to my liking but so far
so good!

http://www.zelow.no/floppyfw/index.html

I recently made a router/firewall for my server to replace a Linksys router, and I feel more secure using my linux router instead of some Linksys router.

My routers specs-
IBM PC 300 PL
Processor: P2 350 Mhz
Memory: 64MB RAM with 512 MB swap
Hdd: 4 GB
CDROM drive?: Yes

It took me a while to get port forwarding to work, but in the end, it felt good because I just feel more secure behind it (and my internet tends to run faster at times ). The router runs Slackware 10, and is part of my openmosix cluster. I installed everything that I would need to run in a shell mode, since I had the hdd space availiable.

So, if you got some old stuff lying around, learn iptables, and make a router just for the fun of it, even though mine was made for a full-time.

-Jim

I use ipcop on an ol cyrex ...works beautifully and has lots of addons.
Also updates when needed security patches are out....and has a backup to disk/hard drive function.

My opinion is it all depends on how hard you'd be going to code your firewall in the linux distro and what your requirements are.
As I always say, the more the configuration is user-friendly, the more the primitives are complicated and consequentially they contain errors; also, the more the primitives are complicated, the more you have to reach a compromise.
Linksys are good products after all and quite speedy, but you can't expect all the configurability you can get from a linux router.
The best solution to this question would be Cisco Systems routers which are greatly configurable and damn fast, but, man, I'd feel sad for your wallet!

I can't help but comment on this -- the fact that you're able to log into your firewall (I assume from the network) and that it has the stuff to support a user environment on it means that you should feel less secure behind it than you did behind your linksys, not more.

I run my own Linux firewall because it affords you near universal customization abilities you just don't get with a firewall appliance. For instance, I wrote a Perl script which parses my Exim and Apache logs and grabs the IP address of zombie boxes and spam relay attempts and blacklists them on the fly. Since implementing this my logs have way less nuisance entries, since a lot of these attempts are repeats.

A firewall that runs a webserver is neither.

I can assure you I have both.

I suppose there are arguments for and against this sort of thing, but I can state that in my situation running two separate boxes would be silly. Besides, I am more than confidant in the security of my network. I closely monitor security lists and I am quick with the patches when necessary. I've been running my firewall/busybox for two and a half years now without incident, so I see no need to spread the work over two boxes and make my job that much harder.