|
Size: 20481
Comment:
|
← Revision 80 as of 2020-04-13 09:42:38 ⇥
Size: 13391
Comment: TAG to allow table inclusion in translations + minor fixes
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 1: | Line 1: |
| ## Auto-converted by kwiki2moinmoin v2005-10-07 | #language en ~-[[DebianWiki/EditorGuide#translation|Translation(s)]]: [[de/Firewalls|Deutsch]] - [[it/Firewalls|Italiano]]-~ ---- |
| Line 4: | Line 7: |
| * [Firewalls-dnat-redirect] is one sticky point where hosts are in the same subnet as the dnated service they are trying to use, and need special attention to make connections work. * [Firewalls-local-port-redirection] tells you how to redirect traffic from one port to another within single machine. * I also found this to be invaluble, along the lines of ECN: http://www.tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.cookbook.ultimate-tc.html * Another very good reading on iptables, including both - new or advanced iptables users can be found here: http://iptables-tutorial.frozentux.net/ Provided in part by the http://lists.debian.org/debian-firewall/ list (debian-firewall@lists.debian.org). Hot English Website Navigate: http://www.0008888.com/jixie005/001.htm http://www.0008888.com/jixie005/002.htm http://www.0008888.com/jixie005/003.htm http://www.0008888.com/jixie005/004.htm http://www.0008888.com/jixie005/005.htm http://www.0008888.com/jixie005/006.htm http://www.0008888.com/jixie005/007.htm http://www.0008888.com/jixie005/008.htm http://www.0008888.com/jixie005/009.htm http://www.0008888.com/jixie005/010.htm http://www.0008888.com/jixie005/011.htm http://www.0008888.com/jixie005/012.htm http://www.0008888.com/jixie005/013.htm http://www.0008888.com/jixie005/014.htm http://www.0008888.com/jixie005/015.htm http://www.0008888.com/jixie005/016.htm http://www.0008888.com/jixie005/017.htm http://www.0008888.com/jixie005/018.htm http://www.0008888.com/jixie005/019.htm http://www.0008888.com/jixie005/020.htm http://www.0008888.com/jixie005/021.htm http://www.0008888.com/jixie005/022.htm http://www.0008888.com/jixie005/023.htm http://www.0008888.com/jixie005/024.htm http://www.0008888.com/jixie005/025.htm http://www.0008888.com/jixie005/026.htm http://www.0008888.com/jixie005/027.htm http://www.0008888.com/jixie005/028.htm http://www.0008888.com/jixie005/029.htm http://www.0008888.com/jixie005/030.htm http://www.0008888.com/jixie005/031.htm http://www.0008888.com/jixie005/032.htm http://www.0008888.com/jixie005/033.htm http://www.0008888.com/jixie005/034.htm http://www.0008888.com/jixie005/035.htm http://www.0008888.com/jixie005/036.htm http://www.0008888.com/jixie005/037.htm http://www.0008888.com/jixie005/038.htm http://www.0008888.com/jixie005/039.htm http://www.0008888.com/jixie005/040.htm http://www.0008888.com/jixie005/041.htm http://www.0008888.com/jixie005/042.htm http://www.0008888.com/jixie005/043.htm http://www.0008888.com/jixie005/044.htm http://www.0008888.com/jixie005/045.htm http://www.0008888.com/jixie005/046.htm http://www.0008888.com/jixie005/047.htm http://www.0008888.com/jixie005/048.htm http://www.0008888.com/jixie005/049.htm http://www.0008888.com/jixie005/050.htm http://www.0008888.com/jixie005/051.htm http://www.0008888.com/jixie005/052.htm http://www.0008888.com/jixie005/053.htm http://www.0008888.com/jixie005/054.htm http://www.0008888.com/jixie005/055.htm http://www.0008888.com/jixie005/056.htm http://www.0008888.com/jixie005/057.htm http://www.0008888.com/jixie005/058.htm http://www.0008888.com/jixie005/059.htm http://www.0008888.com/jixie005/060.htm http://www.0008888.com/jixie005/061.htm http://www.0008888.com/jixie005/062.htm http://www.0008888.com/jixie005/063.htm http://www.0008888.com/jixie005/064.htm http://www.0008888.com/jixie005/065.htm http://www.0008888.com/jixie005/066.htm http://www.0008888.com/jixie005/067.htm http://www.0008888.com/jixie005/068.htm http://www.0008888.com/jixie005/069.htm http://www.0008888.com/jixie005/070.htm http://www.0008888.com/jixie005/071.htm http://www.0008888.com/jixie005/072.htm http://www.0008888.com/jixie005/073.htm http://www.0008888.com/jixie005/074.htm http://www.0008888.com/jixie005/075.htm http://www.0008888.com/jixie005/076.htm http://www.0008888.com/jixie005/077.htm http://www.0008888.com/jixie005/078.htm http://www.0008888.com/jixie005/079.htm http://www.0008888.com/jixie005/080.htm http://www.0008888.com/jixie005/081.htm http://www.0008888.com/jixie005/082.htm http://www.0008888.com/jixie005/083.htm http://www.0008888.com/jixie005/084.htm http://www.0008888.com/jixie005/085.htm http://www.0008888.com/jixie005/086.htm http://www.0008888.com/jixie005/087.htm http://www.0008888.com/jixie005/088.htm http://www.0008888.com/jixie005/089.htm http://www.0008888.com/jixie005/090.htm http://www.0008888.com/jixie005/091.htm http://www.0008888.com/jixie005/092.htm http://www.0008888.com/jixie005/093.htm http://www.0008888.com/jixie005/094.htm http://www.0008888.com/jixie005/095.htm http://www.0008888.com/jixie005/096.htm http://www.0008888.com/jixie005/097.htm http://www.0008888.com/jixie005/098.htm http://www.0008888.com/jixie005/099.htm http://www.0008888.com/jixie005/100.htm http://www.0008888.com/jixie005/101.htm http://www.0008888.com/jixie005/102.htm http://www.0008888.com/jixie005/103.htm http://www.0008888.com/jixie005/104.htm http://www.0008888.com/jixie005/105.htm http://www.0008888.com/jixie005/106.htm http://www.0008888.com/jixie005/107.htm http://www.0008888.com/jixie005/108.htm http://www.0008888.com/jixie005/109.htm http://www.0008888.com/jixie005/110.htm http://www.0008888.com/jixie005/111.htm http://www.0008888.com/jixie005/112.htm http://www.0008888.com/jixie005/113.htm http://www.0008888.com/jixie005/114.htm http://www.0008888.com/jixie005/115.htm http://www.0008888.com/jixie005/116.htm http://www.0008888.com/jixie005/117.htm http://www.0008888.com/jixie005/118.htm http://www.0008888.com/jixie005/119.htm http://www.0008888.com/jixie005/120.htm http://www.0008888.com/jixie005/121.htm http://www.0008888.com/jixie005/122.htm http://www.0008888.com/jixie005/123.htm http://www.0008888.com/jixie005/124.htm http://www.0008888.com/jixie005/125.htm http://www.0008888.com/jixie005/126.htm http://www.0008888.com/jixie005/127.htm http://www.0008888.com/jixie005/128.htm http://www.0008888.com/jixie005/129.htm http://www.0008888.com/jixie005/130.htm http://www.0008888.com/jixie005/131.htm http://www.0008888.com/jixie005/132.htm http://www.0008888.com/jixie005/133.htm http://www.0008888.com/jixie005/134.htm http://www.0008888.com/jixie005/135.htm http://www.0008888.com/jixie005/136.htm http://www.0008888.com/jixie005/137.htm http://www.0008888.com/jixie005/138.htm http://www.0008888.com/jixie005/139.htm http://www.0008888.com/jixie005/140.htm http://www.0008888.com/jixie005/141.htm http://www.0008888.com/jixie005/142.htm http://www.0008888.com/jixie005/143.htm http://www.0008888.com/jixie005/144.htm http://www.0008888.com/jixie005/145.htm http://www.0008888.com/jixie005/146.htm http://www.0008888.com/jixie005/147.htm http://www.0008888.com/jixie005/148.htm http://www.0008888.com/jixie005/149.htm http://www.0008888.com/jixie005/150.htm http://www.0008888.com/jixie005/151.htm http://www.0008888.com/jixie005/152.htm http://www.0008888.com/jixie005/153.htm http://www.0008888.com/jixie005/154.htm http://www.0008888.com/jixie005/155.htm http://www.0008888.com/jixie005/156.htm http://www.0008888.com/jixie005/157.htm http://www.0008888.com/jixie005/158.htm http://www.0008888.com/jixie005/159.htm http://www.0008888.com/jixie005/160.htm http://www.0008888.com/jixie005/161.htm http://www.0008888.com/jixie005/162.htm http://www.0008888.com/jixie005/163.htm http://www.0008888.com/jixie005/164.htm http://www.0008888.com/jixie005/165.htm http://www.0008888.com/jixie005/166.htm http://www.0008888.com/jixie005/167.htm http://www.0008888.com/jixie005/168.htm http://www.0008888.com/jixie005/169.htm http://www.0008888.com/jixie005/170.htm http://www.0008888.com/jixie005/171.htm http://www.0008888.com/jixie005/172.htm http://www.0008888.com/jixie005/173.htm http://www.0008888.com/jixie005/174.htm http://www.0008888.com/jixie005/175.htm http://www.0008888.com/jixie005/176.htm http://www.0008888.com/jixie005/177.htm http://www.0008888.com/jixie005/178.htm http://www.0008888.com/jixie005/179.htm http://www.0008888.com/jixie005/180.htm http://www.0008888.com/jixie005/181.htm http://www.0008888.com/jixie005/182.htm http://www.0008888.com/jixie005/183.htm http://www.0008888.com/jixie005/184.htm http://www.0008888.com/jixie005/185.htm http://www.0008888.com/jixie005/186.htm http://www.0008888.com/jixie005/187.htm http://www.0008888.com/jixie005/188.htm http://www.0008888.com/jixie005/189.htm http://www.0008888.com/jixie005/190.htm http://www.0008888.com/jixie005/191.htm http://www.0008888.com/jixie005/192.htm http://www.0008888.com/jixie005/193.htm http://www.0008888.com/jixie005/194.htm http://www.0008888.com/jixie005/195.htm http://www.0008888.com/jixie005/196.htm http://www.0008888.com/jixie005/197.htm http://www.0008888.com/jixie005/198.htm http://www.0008888.com/jixie005/199.htm http://www.0008888.com/jixie005/200.htm http://www.0008888.com/jixie005/201.htm http://www.0008888.com/jixie005/202.htm http://www.0008888.com/jixie005/203.htm http://www.0008888.com/jixie005/204.htm http://www.0008888.com/jixie005/205.htm http://www.0008888.com/jixie005/206.htm http://www.0008888.com/jixie005/207.htm http://www.0008888.com/jixie005/208.htm http://www.0008888.com/jixie005/209.htm http://www.0008888.com/jixie005/210.htm http://www.0008888.com/jixie005/211.htm http://www.0008888.com/jixie005/212.htm http://www.0008888.com/jixie005/213.htm http://www.0008888.com/jixie005/214.htm http://www.0008888.com/jixie005/215.htm http://www.0008888.com/jixie005/216.htm http://www.0008888.com/jixie005/217.htm http://www.0008888.com/jixie005/218.htm http://www.0008888.com/jixie005/219.htm http://www.0008888.com/jixie005/220.htm http://www.0008888.com/jixie005/221.htm http://www.0008888.com/jixie005/222.htm http://www.0008888.com/jixie005/223.htm http://www.0008888.com/jixie005/224.htm http://www.0008888.com/jixie005/225.htm http://www.0008888.com/jixie005/226.htm http://www.0008888.com/jixie005/227.htm http://www.0008888.com/jixie005/228.htm http://www.0008888.com/jixie005/229.htm http://www.0008888.com/jixie005/230.htm http://www.0008888.com/jixie005/231.htm http://www.0008888.com/jixie005/232.htm http://www.0008888.com/jixie005/233.htm http://www.0008888.com/jixie005/234.htm http://www.0008888.com/jixie005/235.htm http://www.0008888.com/jixie005/236.htm http://www.0008888.com/jixie005/237.htm http://www.0008888.com/jixie005/238.htm http://www.0008888.com/jixie005/239.htm http://www.0008888.com/jixie005/240.htm http://www.0008888.com/jixie005/241.htm http://www.0008888.com/jixie005/242.htm http://www.0008888.com/jixie005/243.htm http://www.0008888.com/jixie005/244.htm http://www.0008888.com/jixie005/245.htm http://www.0008888.com/jixie005/246.htm http://www.0008888.com/jixie005/247.htm http://www.0008888.com/jixie005/248.htm http://www.0008888.com/jixie005/249.htm http://www.0008888.com/jixie005/250.htm http://www.0008888.com/jixie005/251.htm http://www.0008888.com/jixie005/252.htm http://www.0008888.com/jixie005/253.htm http://www.0008888.com/jixie005/254.htm http://www.0008888.com/jixie005/255.htm http://www.0008888.com/jixie005/256.htm http://www.0008888.com/jixie005/257.htm http://www.0008888.com/jixie005/258.htm http://www.0008888.com/jixie005/259.htm http://www.0008888.com/jixie005/260.htm http://www.0008888.com/jixie005/261.htm http://www.0008888.com/jixie005/262.htm http://www.0008888.com/jixie005/263.htm http://www.0008888.com/jixie005/264.htm http://www.0008888.com/jixie005/265.htm http://www.0008888.com/jixie005/266.htm http://www.0008888.com/jixie005/267.htm http://www.0008888.com/jixie005/268.htm http://www.0008888.com/jixie005/269.htm http://www.0008888.com/jixie005/270.htm http://www.0008888.com/jixie005/271.htm http://www.0008888.com/jixie005/272.htm http://www.0008888.com/jixie005/273.htm http://www.0008888.com/jixie005/274.htm http://www.0008888.com/jixie005/275.htm http://www.0008888.com/jixie005/276.htm http://www.0008888.com/jixie005/277.htm http://www.0008888.com/jixie005/278.htm http://www.0008888.com/jixie005/279.htm http://www.0008888.com/jixie005/280.htm http://www.0008888.com/jixie005/281.htm http://www.0008888.com/jixie005/282.htm http://www.0008888.com/jixie005/283.htm http://www.0008888.com/jixie005/284.htm http://www.0008888.com/jixie005/285.htm http://www.0008888.com/jixie005/286.htm http://www.0008888.com/jixie005/287.htm http://www.0008888.com/jixie005/288.htm http://www.0008888.com/jixie005/289.htm http://www.0008888.com/jixie005/290.htm http://www.0008888.com/jixie005/291.htm http://www.0008888.com/jixie005/292.htm http://www.0008888.com/jixie005/293.htm http://www.0008888.com/jixie005/294.htm http://www.0008888.com/jixie005/295.htm http://www.0008888.com/jixie005/296.htm http://www.0008888.com/jixie005/297.htm http://www.0008888.com/jixie005/298.htm http://www.0008888.com/jixie005/299.htm http://www.0008888.com/jixie005/300.htm http://www.0008888.com/jixie005/301.htm http://www.0008888.com/jixie005/302.htm http://www.0008888.com/jixie005/303.htm http://www.0008888.com/jixie005/304.htm http://www.0008888.com/jixie005/305.htm http://www.0008888.com/jixie005/306.htm http://www.0008888.com/jixie005/307.htm http://www.0008888.com/jixie005/308.htm http://www.0008888.com/jixie005/309.htm http://www.0008888.com/jixie005/310.htm http://www.0008888.com/jixie005/311.htm http://www.0008888.com/jixie005/312.htm http://www.0008888.com/jixie005/313.htm http://www.0008888.com/jixie005/314.htm http://www.0008888.com/jixie005/315.htm http://www.0008888.com/jixie005/316.htm http://www.0008888.com/jixie005/317.htm [http://www.8886663.com/01index.htm Dry Batteries] [http://www.8886663.com/02index.htm Dry Cabinet] [http://www.8886663.com/03index.htm DVD VCD Player] [http://www.8886663.com/04index.htm Dyestuffs] [http://www.8886663.com/05index.htm Earphone & Headphone] [http://www.8886663.com/06index.htm Earthwork Products] [http://www.8886663.com/07index.htm Easles] [http://www.8886663.com/08index.htm Edging] [http://www.8886663.com/09index.htm Edible Fats] [http://www.8886663.com/10index.htm Education Appliances] [http://www.8886663.com/11index.htm Educational Toys] [http://www.8886663.com/12index.htm Egg Products] [http://www.8886663.com/13index.htm EL Products] [http://www.8886663.com/14index.htm Electric Bicycle] [http://www.8886663.com/15index.htm Electric Kettle] [http://www.8886663.com/16index.htm Electric Motorcycles] [http://www.8886663.com/17index.htm Electric Power Tools] [http://www.8886663.com/18index.htm Electric Shavers] [http://www.8886663.com/19index.htm Electrical] [http://www.8886663.com/20index.htm Electrical Contacts] [http://www.8886663.com/21index.htm Electrical Outlets] [http://www.8886663.com/22index.htm Electrical Toys Electricity] [http://www.8886663.com/24index.htm Electronic Instrument Enclosures] [http://www.8886663.com/25index.htm Electronic Books] [http://www.8886663.com/26index.htm Electronic Component] http://www.8886663.com/index.htm http://www.8886663.com/products.htm http://www.8886663.com/tuijian.htm http://www.8886663.com/zhuyao.htm http://www.8886663.com/shiyong.htm http://www.8886663.com/jianjie.htm http://www.8886663.com/rongyu.htm http://www.8886663.com/lianxi.htm [http://www.8885553.com/01index.htm Exhaust System] [http://www.8885553.com/02index.htm Exhibition Equipment] [http://www.8885553.com/03index.htm Explosive] [http://www.8885553.com/04index.htm Fan] [http://www.8885553.com/05index.htm Farm] [http://www.8885553.com/06index.htm Farm Machines] [http://www.8885553.com/07index.htm Fashion] [http://www.8885553.com/08index.htm Fasteners] [http://www.8885553.com/09index.htm Fast-Food] [http://www.8885553.com/10index.htm Faucet] [http://www.8885553.com/11index.htm Fax Machines] [http://www.8885553.com/12index.htm Feather] [http://www.8885553.com/13index.htm Fencing] [http://www.8885553.com/14index.htm Ferroalloy] [http://www.8885553.com/15index.htm Fertilizer] [http://www.8885553.com/16index.htm Fiber Optic Equipment] [http://www.8885553.com/17index.htm Fiberglass] [http://www.8885553.com/18index.htm File Folder] [http://www.8885553.com/19index.htm Film] [http://www.8885553.com/20index.htm Films] [http://www.8885553.com/21index.htm Filters] [http://www.8885553.com/22index.htm Financial Field] [http://www.8885553.com/23index.htm Fine Chemicals] [http://www.8885553.com/24index.htm Fire-fighting] [http://www.8885553.com/25index.htm Fireproof Materials] [http://www.8885553.com/26index.htm Fishery Machinery] http://www.8885553.com/index.htm http://www.8885553.com/products.htm http://www.8885553.com/tuijian.htm http://www.8885553.com/zhuyao.htm http://www.8885553.com/shiyong.htm http://www.8885553.com/jianjie.htm http://www.8885553.com/rongyu.htm http://www.8885553.com/lianxi.htm [http://www.8885558.com/01index.htm Electronic Data Systems] [http://www.8885558.com/02index.htm Electronic Instrument] [http://www.8885558.com/03index.htm Electronic Pets] [http://www.8885558.com/04index.htm Electronic Signs] [http://www.8885558.com/05index.htm Electronics] [http://www.8885558.com/06index.htm Electronics Packaging] [http://www.8885558.com/07index.htm Electronics Stocks] [http://www.8885558.com/08index.htm Elementary Substance] [http://www.8885558.com/09index.htm Elevators] [http://www.8885558.com/10index.htm Embroidery] [http://www.8885558.com/11index.htm Emergency Lights] [http://www.8885558.com/12index.htm Enamel] [http://www.8885558.com/13index.htm Energy] [http://www.8885558.com/14index.htm Energy Saving] [http://www.8885558.com/15index.htm Engine Parts] [http://www.8885558.com/16index.htm Engines] [http://www.8885558.com/17index.htm Envelop] [http://www.8885558.com/18index.htm Envelopes] [http://www.8885558.com/19index.htm Environment] [http://www.8885558.com/20index.htm Enzyme Preparations] [http://www.8885558.com/21index.htm Enzymes] [http://www.8885558.com/22index.htm Equipment] [http://www.8885558.com/23index.htm Eraser] [http://www.8885558.com/24index.htm Ester] [http://www.8885558.com/25index.htm Excess Inventory] [http://www.8885558.com/26index.htm Exchanges] http://www.8885558.com/index.htm http://www.8885558.com/products.htm http://www.8885558.com/tuijian.htm http://www.8885558.com/zhuyao.htm http://www.8885558.com/shiyong.htm http://www.8885558.com/jianjie.htm http://www.8885558.com/rongyu.htm http://www.8885558.com/lianxi.htm [http://www.8883339.com/01index.htm Fishing] [http://www.8883339.com/02index.htm Fitness] [http://www.8883339.com/03index.htm Fittings] [http://www.8883339.com/04index.htm Flashlights] [http://www.8883339.com/05index.htm Flavor Enhancers] [http://www.8883339.com/06index.htm Flavors] [http://www.8883339.com/07index.htm Flavour and Fragrance] [http://www.8883339.com/08index.htm Flexible Tube] [http://www.8883339.com/09index.htm Flooring & Tiles] [http://www.8883339.com/10index.htm Flour] [http://www.8883339.com/11index.htm Flower Pots] [http://www.8883339.com/12index.htm Flowers] [http://www.8883339.com/13index.htm Fluorescent] [http://www.8883339.com/14index.htm Fodder Feed Additives] [http://www.8883339.com/15index.htm Foils] [http://www.8883339.com/16index.htm Folk Crafts] [http://www.8883339.com/17index.htm Food] [http://www.8883339.com/18index.htm Food Additives] [http://www.8883339.com/19index.htm Food Ingredients] [http://www.8883339.com/20index.htm Food Packaging] [http://www.8883339.com/21index.htm Food Processing Machinery] [http://www.8883339.com/22index.htm Food Processor] [http://www.8883339.com/23index.htm Food Service Supplies] [http://www.8883339.com/24index.htm Food Stocks] [http://www.8883339.com/25index.htm Food Trays] [http://www.8883339.com/26index.htm Football] http://www.8883339.com/index.htm http://www.8883339.com/products.htm http://www.8883339.com/tuijian.htm http://www.8883339.com/zhuyao.htm http://www.8883339.com/shiyong.htm http://www.8883339.com/jianjie.htm http://www.8883339.com/rongyu.htm http://www.8883339.com/lianxi.htm |
'''Note that some of the information in this page can be out of date.''' == More information == * [[Firewalls-dnat-redirect]] is one sticky point where hosts are in the same subnet as the DNATed service they are trying to use, and need special attention to make connections work. * [[Firewalls-local-port-redirection]] tells you how to redirect traffic from one port to another within single machine. * I also found this to be invaluable, along the lines of ECN: http://www.tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.cookbook.ultimate-tc.html * Another very good reading on iptables, including both - new or advanced iptables users can be found here: http://www.frozentux.net/documents/iptables-tutorial/ * On this wiki there's the [[iptables]] page. * DebianPkg:iptables-persistent == Choosing an IPtables frontend == === Introduction === There are ''lots'' of iptables frontends. So you have lots of choice. This section is devoted to help you making a choice among this truckload of options by comparing the tools. NB: you should install just ''one'' of these packages. Installing more than one will ''not'' make your system more secure; it will likely make your system unmanageable. BTW: There's also a [[http://online.securityfocus.com/infocus/1410|securityfocus article]] (from April 2001) comparing some of these tools. Some of these are described in the [[http://www.debian.org/doc/manuals/securing-debian-howto/ch-sec-services.en.html#s-firewall-pack|Securing Debian Manual]]. ==== Overview ==== Here's an overview of the different tools (selection inspired upon what's available in Debian unstable as of 2014-07): || Package and Upstream URL || Interface || Programming Language || Size of Source (as of 2005-10) || Releases (as of 2014-07) || ##TAG:FIREWALLS_LIST_START || [[http://rocky.eld.leidenuniv.nl/|arno-iptables-firewall]] || edit (debconf) || sh || 60K || < 2003-08 - 2014-04 || || [[http://ferm.foo-projects.org/|ferm]] ([[ferm|wiki page]]) || edit || perl || 80K || 2000-12 - 2013-07 || || [[http://www.fiaif.net/|fiaif]] || edit || bash || 320K || < 2003-01 - 2013-01 || || [[http://spacepants.org/src/filtergen/|filtergen]] || edit || C || 150K || < 2002-10 - 2005-05 || || [[http://firehol.sourceforge.net/|firehol]] || edit || bash || 210K || < 2003-05 - 2014-02 || || [[http://www.fs-security.com/|firestarter]] || gui (gnome) || C || 1170K || < 2003-01 - 2005-01 || || [[http://www.fwbuilder.org/|fwbuilder]] || gui (kde) || C++ || 1190K || < 2003-12 - 2013-04 || || [[http://www.simonzone.com/software/guidedog/|guidedog]] || gui (kde) || C++ || 590K || 2001-11 - 2008-08 || || [[http://www.linuxkungfu.org/|ipkungfu]] || edit || sh || 40K || 2002-09 - 2007-01 || || [[http://www.stearns.org/mason/|mason]] || shell (autolearning) || bash || 500K || < 1999-03 - 2002-05 || || [[https://launchpad.net/netscript-2.4|netscript-2.4]] || edit, iptables || sh || 70K || < 2000-11 - 2004-10 || || [[http://www.shorewall.net/|shorewall]] || edit, webmin || sh || 130K || < 2001-12 - 2014-07 || || [[https://github.com/cajus/uif|uif]] || edit (debconf) || perl || 34K || 2002-02 - 2014-07 || || [[http://mdcc.cx/uruk|uruk]] || edit || sh || 80K || 2003-03 - 2014-06 || || [[http://www.vuurmuur.org/|Vuurmuur]] || curses || C || 1877K || 2004-07 - 2009-04 || || [[http://launchpad.net/ufw|ufw]] || edit || python || 247K || 2009-05 - 2012-08 || ##TAG:FIREWALLS_LIST_END '''ferm''' uses a text-based configuration with keywords closely resembling iptables rules. Variables and combined rules simplify rule definitions and enhance readability. The '''fiaif''' configuration file is very similar to raw iptables rules. '''Filtergen''' has support for non-iptables packet filters too. The configuration file is application-specific. '''firestarter''' is an application oriented towards end-users that includes a wizard useful to quickly setup firewall rules. The application includes a GUI to be able to monitor when a firewall rule blocks traffic. '''fwbuilder''' is an object oriented GUI which includes policy compilers for various firewall platforms including Linux' netfilter, BSD's pf (used in OpenBSD, NetBSD, FreeBSD and MacOS X) as well as router's access-lists. It is similar to enterprise firewall management software. Complete fwbuilder's functionality is also available from the command line. '''mason''' is an application which can propose firewall rules based on the network traffic your system sees. The '''netscript-2.4''' Debian package description says: "DON'T use this on a server - it is designed for dedicated routers and firewalls with hardly any configured services." '''shorewall''' is a firewall configuration tool which provides support for IPsec as well as limited support for traffic shaping as well as the definition of the firewall rules. Configuration is done through a simple set of files that are used to generate the iptables rules. '''ufw''': Canonical's ufw is from Ubuntu. (New for squeeze) '''vuurmuur''': Victor Julien's [[http://www.vuurmuur.org/|vuurmuur]] is not (yet?) included in Debian, but Debian packages are available in an [[http://www.vuurmuur.org/trac/wiki/InstallationDebian|apt-able archive]]. ==== Debian specific information ==== Some Debian-specific data about these packages: || Package and Debian package URL || Debian package description || [[http://popcon.debian.org/source/by_inst.gz|Popularity (2017-01-09)]] || ##TAG:FIREWALLS_PACKAGES_START || DebianPkg:arno-iptables-firewall || Single- and multi-homed firewall script with DSL/ADSL support || 491 || || DebianPkg:ferm || maintain and setup complicated firewall rules || 1661 || || DebianPkg:fiaif || An easy to use, yet complex firewall || X || || DebianPkg:filtergen || packet filter generator for various firewall systems || 11 || || DebianPkg:firehol || An easy to use but powerful iptables stateful firewall || 537 || || DebianPkg:firestarter || gtk program for managing and observing your firewall || X || || DebianPkg:firewalld || dynamically managed firewall with support for network zones || 565 || || DebianPkg:fwbuilder || Firewall administration tool GUI || 2323 || || DebianPkg:guidedog|| NAT/masquerading/port-forwarding configuration tool in Qt5 || 14 || || DebianPkg:ipkungfu || iptables-based Linux firewall || 15 || || DebianPkg:mason || Interactively creates a Linux packet filtering firewall || 19 || || [[DebianPkg:netscript-2.4]] || Linux 2.4.x (and 2.6.x) router/firewall network configuration system || 63 || || DebianPkg:shorewall || Shoreline Firewall (Shorewall) || 3232 || || DebianPkg:uif || Advanced iptables-firewall script || 29 || || DebianPkg:uruk || Wrapper for Linux iptables, for filtering rules management || 71 || || DebianPkg:ufw || program for managing a Netfilter firewall || 5377 || || DebianPkg:vuurmuur || curses-based firewall || - || ##TAG:FIREWALLS_PACKAGES_END The number in the popularity is the number of installations. The higher the number the more installations it has. "-" and "X" denote packages not in Debian; "X" marks former packages that have been removed as of stretch. As of 2005-11-02, for all packages (ferm, fiaif, filtergen, firehol, firestarter, fwbuilder, guidedog, hlfl, ipkungfu, ipmenu, mason, netscript-2.4, shorewall, uif) the [[http://bugs.debian.org/|BTS]] looks quite OK: no serious bugs, the packages look well-maintained. Notes on size of package: if there are lots of sources, the package might be too bloated for your taste. However, if the size of the sources is small, there are likely less nice features. OTOH, small packages are more easy to check for errors, and might offer a nice "mean 'n' lean" feeling. ==== Yet other ones ==== There's also [[http://www.webmin.com/|webmin-firewall]]. webmin-firewall is a webmin plugin, shipped in [[http://www.webmin.com/standard.html|firewall.wbm.gz]]: "Configure a Linux firewall using iptables". [[http://users.pandora.be/stes/ipmenu.html|ipmenu]], a small perl script with curses interface, wasn't shipped with the Debian etch release. ==== Conclusion ==== Now for the conclusion: we'll give a possible way to decide, using the data gathered above. If you want a gui tool choosing firestarter or fwbuilder is probably wise: these are all popular tools. fwbuilder (for KDE) is by far the most popular. However, it is said it's definately ''not'' a tool for newbies. Guarddog (KDE) and firestarter (GNOME) are both equally popular. The codesize for all three is about the same. Now suppose you don't want a gui tool, for instance since you're working on servers and don't have X libraries installed. You also might like a plain-text editable configuration file, since you manage your configuration files with a version control system. You also want a tool which is actively maintained: since 2004-09 there should have been at least one release. Let's take a closer look at 6 of the qualifying non-gui tools: || Package and Online Documentation || Configuration file format || Size of main script || || [[http://rocky.eld.leidenuniv.nl/page/iptables/help.htm|arno-iptables-firewall]] || shell || 135K || || [[http://ferm.foo-projects.org/|ferm]] || app specific || 62K || || [[http://firehol.sourceforge.net/overview.html|firehol]] || shell || 24K + 131K = 155K || || [[http://shorewall.sourceforge.net/standalone.htm|shorewall]] || app specific || 203K || || [[http://mdcc.cx/pub/uruk/uruk-latest/man/uruk.html#getting%20started|uruk]] || shell || 9K || || [[http://launchpad.net/ufw|ufw]] || python || 848 k || The '''arno-iptables-firewall''' Debian package comes with a debconf frontend: it is possible to configure this tool interactively. To use '''ferm''', one has to write a configuration file using keywords that are used by iptables. Ferm basically adds nesting syntax and variables to iptables rules. It seems it has the best support for IPv6 among these packages. This tool offers a quick and maintainable approach to writing firewall rules if you are used to iptables commands. "'''FireHOL''' is a language to express firewalling rules, not just a script that produces some kind of a firewall." FireHOL configuration files are shell scripts (but actually don't really look like that; it seems they're about as simple as one can get). FireHOL comes with firehol-wizard(8), which creates a configuration file you'll ''have'' to edit manually afterwards. Support for IPv6 was added recently (it was previously available in FireHOL fork called Sanewall). This is a pretty popular tool. "'''Shorewall''' is not the easiest to use of the available iptables configuration tools but I believe that it is the most flexible and powerful." It "can handle complex and fast changing network environments." It needs multiple configuration files, even for simple setups. Seems only suitable for powerusers. (Likely there are a lot of these among Debian users: shorewall is very popular!) For '''uruk''', there is an [[http://mdcc.cx/pub/uruk/uruk-latest/doc/rc|example uruk configuration file]]. Uruk is extremely small: this is nice if you want to adapt the tool to your own needs, or want to be very sure it does what you want: it doesn't take long to check all the code manually. Of course, the small size comes with less functionality. However, if you have very specific needs, you can easily hook your own crafted iptables rules in the uruk framework. This is documented in the uruk manpages. However, beware: the major part of this section of this wiki-page was written by the uruk-author. If you feel this page could be more objective, please edit it! Making the final decision between the 5 short-list ones is left as an exercise to the reader: it depends on your specific situation and needs. You could install them one after the other, and try them for yourself. ==== Thanks ==== Thanks to [[http://apsy.gse.uni-magdeburg.de/main/index.php?page=hanke|Michael Hanke]] for making the first start of the IPtables frontends comparison. Thanks to Victor Julien for contributing some notes on the Vuurmuur package. Provided in part by the [[http://lists.debian.org/debian-firewall/|debian-firewall list]]. ---- CategorySystemAdministration | CategorySystemSecurity | CategoryRedundant: merge with DebianFirewall |
Translation(s): Deutsch - Italiano
A system designed to prevent unauthorized access to or from a private network. Firewalls can be implemented in both hardware and software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.
Note that some of the information in this page can be out of date.
More information
Firewalls-dnat-redirect is one sticky point where hosts are in the same subnet as the DNATed service they are trying to use, and need special attention to make connections work.
Firewalls-local-port-redirection tells you how to redirect traffic from one port to another within single machine.
I also found this to be invaluable, along the lines of ECN: http://www.tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.cookbook.ultimate-tc.html
Another very good reading on iptables, including both - new or advanced iptables users can be found here: http://www.frozentux.net/documents/iptables-tutorial/
On this wiki there's the iptables page.
Choosing an IPtables frontend
Introduction
There are lots of iptables frontends. So you have lots of choice. This section is devoted to help you making a choice among this truckload of options by comparing the tools. NB: you should install just one of these packages. Installing more than one will not make your system more secure; it will likely make your system unmanageable.
BTW: There's also a securityfocus article (from April 2001) comparing some of these tools. Some of these are described in the Securing Debian Manual.
Overview
Here's an overview of the different tools (selection inspired upon what's available in Debian unstable as of 2014-07):
Package and Upstream URL |
Interface |
Programming Language |
Size of Source (as of 2005-10) |
Releases (as of 2014-07) |
edit (debconf) |
sh |
60K |
< 2003-08 - 2014-04 |
|
edit |
perl |
80K |
2000-12 - 2013-07 |
|
edit |
bash |
320K |
< 2003-01 - 2013-01 |
|
edit |
C |
150K |
< 2002-10 - 2005-05 |
|
edit |
bash |
210K |
< 2003-05 - 2014-02 |
|
gui (gnome) |
C |
1170K |
< 2003-01 - 2005-01 |
|
gui (kde) |
C++ |
1190K |
< 2003-12 - 2013-04 |
|
gui (kde) |
C++ |
590K |
2001-11 - 2008-08 |
|
edit |
sh |
40K |
2002-09 - 2007-01 |
|
shell (autolearning) |
bash |
500K |
< 1999-03 - 2002-05 |
|
edit, iptables |
sh |
70K |
< 2000-11 - 2004-10 |
|
edit, webmin |
sh |
130K |
< 2001-12 - 2014-07 |
|
edit (debconf) |
perl |
34K |
2002-02 - 2014-07 |
|
edit |
sh |
80K |
2003-03 - 2014-06 |
|
curses |
C |
1877K |
2004-07 - 2009-04 |
|
edit |
python |
247K |
2009-05 - 2012-08 |
ferm uses a text-based configuration with keywords closely resembling iptables rules. Variables and combined rules simplify rule definitions and enhance readability.
The fiaif configuration file is very similar to raw iptables rules.
Filtergen has support for non-iptables packet filters too. The configuration file is application-specific.
firestarter is an application oriented towards end-users that includes a wizard useful to quickly setup firewall rules. The application includes a GUI to be able to monitor when a firewall rule blocks traffic.
fwbuilder is an object oriented GUI which includes policy compilers for various firewall platforms including Linux' netfilter, BSD's pf (used in OpenBSD, NetBSD, FreeBSD and MacOS X) as well as router's access-lists. It is similar to enterprise firewall management software. Complete fwbuilder's functionality is also available from the command line.
mason is an application which can propose firewall rules based on the network traffic your system sees.
The netscript-2.4 Debian package description says: "DON'T use this on a server - it is designed for dedicated routers and firewalls with hardly any configured services."
shorewall is a firewall configuration tool which provides support for IPsec as well as limited support for traffic shaping as well as the definition of the firewall rules. Configuration is done through a simple set of files that are used to generate the iptables rules.
ufw: Canonical's ufw is from Ubuntu. (New for squeeze)
vuurmuur: Victor Julien's vuurmuur is not (yet?) included in Debian, but Debian packages are available in an apt-able archive.
Debian specific information
Some Debian-specific data about these packages:
Package and Debian package URL |
Debian package description |
|
Single- and multi-homed firewall script with DSL/ADSL support |
491 |
|
maintain and setup complicated firewall rules |
1661 |
|
An easy to use, yet complex firewall |
X |
|
packet filter generator for various firewall systems |
11 |
|
An easy to use but powerful iptables stateful firewall |
537 |
|
gtk program for managing and observing your firewall |
X |
|
dynamically managed firewall with support for network zones |
565 |
|
Firewall administration tool GUI |
2323 |
|
NAT/masquerading/port-forwarding configuration tool in Qt5 |
14 |
|
iptables-based Linux firewall |
15 |
|
Interactively creates a Linux packet filtering firewall |
19 |
|
Linux 2.4.x (and 2.6.x) router/firewall network configuration system |
63 |
|
Shoreline Firewall (Shorewall) |
3232 |
|
Advanced iptables-firewall script |
29 |
|
Wrapper for Linux iptables, for filtering rules management |
71 |
|
program for managing a Netfilter firewall |
5377 |
|
curses-based firewall |
- |
The number in the popularity is the number of installations. The higher the number the more installations it has. "-" and "X" denote packages not in Debian; "X" marks former packages that have been removed as of stretch.
As of 2005-11-02, for all packages (ferm, fiaif, filtergen, firehol, firestarter, fwbuilder, guidedog, hlfl, ipkungfu, ipmenu, mason, netscript-2.4, shorewall, uif) the BTS looks quite OK: no serious bugs, the packages look well-maintained.
Notes on size of package: if there are lots of sources, the package might be too bloated for your taste. However, if the size of the sources is small, there are likely less nice features. OTOH, small packages are more easy to check for errors, and might offer a nice "mean 'n' lean" feeling.
Yet other ones
There's also webmin-firewall. webmin-firewall is a webmin plugin, shipped in firewall.wbm.gz: "Configure a Linux firewall using iptables".
ipmenu, a small perl script with curses interface, wasn't shipped with the Debian etch release.
Conclusion
Now for the conclusion: we'll give a possible way to decide, using the data gathered above.
If you want a gui tool choosing firestarter or fwbuilder is probably wise: these are all popular tools. fwbuilder (for KDE) is by far the most popular. However, it is said it's definately not a tool for newbies. Guarddog (KDE) and firestarter (GNOME) are both equally popular. The codesize for all three is about the same.
Now suppose you don't want a gui tool, for instance since you're working on servers and don't have X libraries installed. You also might like a plain-text editable configuration file, since you manage your configuration files with a version control system. You also want a tool which is actively maintained: since 2004-09 there should have been at least one release.
Let's take a closer look at 6 of the qualifying non-gui tools:
Package and Online Documentation |
Configuration file format |
Size of main script |
shell |
135K |
|
app specific |
62K |
|
shell |
24K + 131K = 155K |
|
app specific |
203K |
|
shell |
9K |
|
python |
848 k |
The arno-iptables-firewall Debian package comes with a debconf frontend: it is possible to configure this tool interactively.
To use ferm, one has to write a configuration file using keywords that are used by iptables. Ferm basically adds nesting syntax and variables to iptables rules. It seems it has the best support for IPv6 among these packages. This tool offers a quick and maintainable approach to writing firewall rules if you are used to iptables commands.
"FireHOL is a language to express firewalling rules, not just a script that produces some kind of a firewall." FireHOL configuration files are shell scripts (but actually don't really look like that; it seems they're about as simple as one can get). FireHOL comes with firehol-wizard(8), which creates a configuration file you'll have to edit manually afterwards. Support for IPv6 was added recently (it was previously available in FireHOL fork called Sanewall). This is a pretty popular tool.
"Shorewall is not the easiest to use of the available iptables configuration tools but I believe that it is the most flexible and powerful." It "can handle complex and fast changing network environments." It needs multiple configuration files, even for simple setups. Seems only suitable for powerusers. (Likely there are a lot of these among Debian users: shorewall is very popular!)
For uruk, there is an example uruk configuration file. Uruk is extremely small: this is nice if you want to adapt the tool to your own needs, or want to be very sure it does what you want: it doesn't take long to check all the code manually. Of course, the small size comes with less functionality. However, if you have very specific needs, you can easily hook your own crafted iptables rules in the uruk framework. This is documented in the uruk manpages. However, beware: the major part of this section of this wiki-page was written by the uruk-author. If you feel this page could be more objective, please edit it!
Making the final decision between the 5 short-list ones is left as an exercise to the reader: it depends on your specific situation and needs. You could install them one after the other, and try them for yourself.
Thanks
Thanks to Michael Hanke for making the first start of the IPtables frontends comparison. Thanks to Victor Julien for contributing some notes on the Vuurmuur package. Provided in part by the debian-firewall list.
CategorySystemAdministration | CategorySystemSecurity | CategoryRedundant: merge with DebianFirewall