Re: Home Network, step by step?

From: David Adam (zanchey_at_ucc.gu.uwa.edu.au)
Date: 12/15/04

  • Next message: Vulpes Velox: "Re: video capture and editing suggestions please" 
    Date: Wed, 15 Dec 2004 09:11:32 +0800 (WST)
To: "R. Scott Kennan" <rskennan@gmail.com>

    On Tue, 14 Dec 2004, R. Scott Kennan wrote:

    > One other thing I don't understand is why I'm being told to install
    > the firewall in this context; are firewalls more than just an
    > intrusion countermeasure? Do they do any 'lifting' on a network beyond
    > blocking unauthorised transfers?

    They do now.

    Partly in response to cleverer security threats, and partly as a
    convergence between routing and firewalling, most modern firewalls - like
    ipf and pf in FreeBSD - are now not so much firewalls, but packet filters.
    They have the ability to inspect and modify any packets going in any
    direction on various interfaces. This makes them an invaluable tool on
    routers in any environment (except, perhaps, Internet core routers, but
    they're another case entirely).

    By the way, someone up the thread a bit recommended you start running
    IPFW (IPFIREWALL). While I'm not currently in a position to give you
    instructions as detailed as James did, I would recommend you start with
    either ipf or pf. IPFW is much older and is somewhat less well maintained,
    the documentation in particular.

    >From the Handbook's IPFW Chapter...

    http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-ipfw.html

    "The IPFW stateless rule syntax is empowered with technically
    sophisticated selection capabilities which far surpasses the knowledge
    level of the customary firewall installer. IPFW is targeted at the
    professional user or the advanced technical computer hobbyist who have
    advanced packet selection requirements."

    (Proper use of freebsd-newbies@ approaching!)

    I've had superb results with pf (although for full effect, it will require
    a kernel rebuild). The pf documentation at OpenBSD is very well written
    and easy to follow. Setting up NAT can be a somewhat daunting task
    (personally, I do it at home with Windows' ICS, which is an absolute
    no-brainer) - however, once you get it working it is extremely useful.

    Best of luck! (I really should get back to work - if I can get my system
    at home logged on to the 'net I'll try and run you through the basics of
    setting it up if you still need it.)

    Cheers,

    David Adam 

    ---
zanchey@ucc.gu.uwa.edu.au
Medicine: And you thought hacking computers was complex.
_______________________________________________
freebsd-newbies@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-newbies
To unsubscribe, send any mail to "freebsd-newbies-unsubscribe@freebsd.org"
  • Next message: Vulpes Velox: "Re: video capture and editing suggestions please"

    Relevant Pages

    • Couple of network questions (NAT, firewalls)
      ... Let's start with firewalls. ... I've compiled my kernel to support both ipfw and ipf. ... ipfw add 500 divert natd all from 192.168.0.5 to any via re0 pfw add ... So what is that connection between nat and ssh? ...
      (comp.unix.bsd.freebsd.misc)
    • Re: Large number of http connections immediately dropped
      ... We didn't see this problem after recompiling without SMP support and waiting for a day or two, but that immediately brought the load average up to around 50 and made it much slower, so that's clearly not a solution. ... The reason to ask the firewall question (ipfw, pf, etc) is that as the rate of TCP connections goes up, and if there are a small number of addresses involved, the reuse rate for TCP/IP port/address tuples becomes very high, which can cause connections to reuse tuples too quickly. ... Sometimes firewalls are more sensitive to this than the stack -- especially if those firewalls are doing things like randomizing port numbers, TCP sequence numbers, etc, so in the past there have been reports along those lines. ...
      (freebsd-performance)
    • RE: FreeBSD Gateway problems
      ... Which of the firewalls do you want to use and if you want to use both what ... After following some other How-Tos I tried running ipfw, ... No virus found in this incoming message. ... Checked by AVG Anti-Virus. ...
      (freebsd-questions)
    • Re: firewall on FreeBSD
      ... The two firewalls work very differently. ... it implies that somehow ipfw could support ... the quick keyword, and that is nonsensical. ...
      (freebsd-questions)
    • Re: [fw-wiz] Firewall rules order and performance
      ... Some firewalls no longer parse the configuration ... New connections / s is generally limited by ruleset size and complexity. ... As I recall, several years ago Lucent had an Oalgorithm for packet filtering on some of their high end routers that leveraged some tricky algebra, but it was limited to 256 not very complex rules. ... This is why every vendor specifies throughput based on large packets - ask them for 64-byte packet throughput and watch them squirm. ...
      (Firewall-Wizards)