<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Blindraven wrote:
<blockquote
cite="mid:1b588d0c0903020057v7454a280n656108720fd7c633@mail.gmail.com"
type="cite">
<meta http-equiv="Context-Type"
content="text/html; charset=ISO-8859-1">
# cross post /u-au/slug<br>
<br>
I am looking to set up a hardware firewall using an old computer and a
Linux distribution and am curious about a few things.<br>
...<br>
I am assuming with 2 NICs in the old computer, you dump it between the
switch and the router and connect both the switch and modem/router to
it.<br>
So it would look something like<br>
...<br>
Based on my set-up, which of the following would you recommend and why?<br>
...<br>
I understand policies could be configured for all of them to allow SSH
etc, but I'd like something that does not require me to mess with
modules extenively as I am not <b>tha</b>t technically savvy.<br>
>From what I've read pfSense seems to be the go, but I wouldn't know why
exactly.</blockquote>
My first and only firewall is Shorewall (<a class="moz-txt-link-freetext" href="http://shorewall.net/">http://shorewall.net/</a>). It
enables you to set up configurations with simple text configuration
files (or a Webmin module if you use Webmin - i do). Shorewall has a
sample configuration which is designed for your situation - the
two-interface firewall.<br>
<br>
Why i use and recommend Shorewall:<br>
<ul>
<li>you can think about firewalls at a policy level rather than
packet level<br>
</li>
<li>adding new rules and hosts is very simple</li>
<li>the documentation is first class - better than many commercial
firewalls, i've been told<br>
</li>
<li>excellent preprocessor that catches a lot of your errors</li>
<li>you can install it on any version Linux - i suggest Ubuntu server
or Debian<br>
</li>
<li>highly flexible - anything iptables can do, Shorewall can do,
usually much more easily<br>
</li>
<li>grows with you - has advanced features like IPv6, multiple ISP
load balancing, etc.</li>
<li>I use it on my personal laptop, and on multi-interface clusters
supporting hundreds of client PCs. Also runs on WRT54G routers (i
haven't tried this).<br>
</li>
<li>user support forums full of people with good Linux/networking
skills<br>
</li>
</ul>
Paul<br>
<br>
</body>
</html>