<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
Does anybody have any information on how to use these firewalls. I
tried setting one up, and ended up shutting my pc off to everything,
and had to get somebody to help open it up again. I gave up with the
virus checker, as it thought a lot of things that were important to the
pc were viruses, and as I dont know enough, had to leave that go.<br>
<br>
John<br>
<br>
On 21/04/10 11:51, Paul Morgan-Roach wrote:
<blockquote
cite="mid:s2u7c1de4ef1004210351oc8db433au439f4fca6c04cc90@mail.gmail.com"
type="cite"><br>
<div class="gmail_quote">On Wed, Apr 21, 2010 at 12:29 AM, John
Stevenson <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:john@jr0cket.com">john@jr0cket.com</a>></span> wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="gmail_quote">
<div><br>
Am I wrong in thinking this post is really a warning about not setting
you router up securely? <br>
<br>
If you are unable to control the router or the IP address your Ubuntu
box is assigned, then you can always run a firewall and/or AppAmor on
you Ubuntu box.<br>
</div>
</div>
</blockquote>
<div><br>
For those wanting a graphical interface for IPTables, you can use
Firestarter (available in the repos). It's a nice interface that
covers most functions. From the command line Ubuntu has ufw - the
uncomplicated firewall, which is effectively an easy method to
configure basic firewalling (eg. ufw allow ssh)<br>
<br>
I can't emphasise enough how important it is to secure the perimeter
device effectively though. If outbound filtering is enabled and
services are only enabled on requirement, we'd see a drop in viruses,
worms, spam and other nasties. Think back to the "Slammer worm" (<a
moz-do-not-send="true" href="http://en.wikipedia.org/wiki/SQL_Slammer">http://en.wikipedia.org/wiki/SQL_Slammer</a>)
which compromised windows boxes at a rapid rate, but could not have
propagated anywhere near as fast if outbound firewalling was enabled.<br>
<br>
The same goes for IRC controlled botnets - if you restrict outbound IRC
traffic from only the machines that you use IRC on, then the infected
machines cannot be controlled.<br>
<br>
The majority of spam comes from hijacked PC's - if your perimeter
device only allows the mail server on your network outbound access on
port 25, then spam cannot be sent from a compromised desktop.
Furthermore, logging on the perimeter device can also be used to
identify threats from within the network (if you see a blocked IRC or
SMTP traffic it gives cause for investigation).<br>
<br>
I hope this gives a little food for though....<br>
<br>
Paul<br>
</div>
</div>
<br>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Ubuntu User #30817</pre>
</body>
</html>