Slashdot Mirror
Captain Crunch's New Boxes, Part II
micsaund writes: "It looks like the infamous Captain Crunch has been toiling away for 3 years on a firewall now known as the Crunchbox. It runs OpenBSD and is administered via a web-based interface. Steve Wozniak is quoted as saying it's 'next to un-crackable.' Check it out at ShopIP. The Register also has an article on it. As an aside, since the Linux Router Project (LRP) appears to have been sold-out and GnatBox is a tad expensive, is anyone aware of some kind of 'packaged' firewall with a slick interface available for free?" We mentioned Draper's venture into firewalls last year, but there's been some progress since then.
Check Out www.bbiagent.com cool, free, easy to use...
L053R
Installs in a snap, free download, stupendous interface, good support. I've used it for months now without a hickup. Just my $0.02
:-)
Smoothwall
Cheers
Have a Happy.
The mailing list is active, there are any number of distributions though few on the latest kernels, all appears kosher if not frantically active.
Was there any reason for this possibly very damaging statement?
I don't read ACs: If a post isn't worth so much as a nom de plume to its author then I wont bother either.
That's what I use on my little NAT/Gateway thing at home. Works like a champ. Web-based config + many other add-ons for this floppy distro. More put together than LRP IMHO. Check it out at: freeSCO.org. The dicumentation is pretty good, although it may not be as secure as other distros.
MMORPG fan-boy? Prove your worth
Single Network Firewall... runs off of a 2.2 kernel, easy to set up, and runs off a "slick web based interface". You can download the ISOs for free off their website.
Some linkage:
Looks like it's /.'d already, so use the power of the google.
Note sure if this qualifies, but it is a neat little floppy disk distribution that does nat. Check it out at http://www.coyotelinux.com/.
"I have a porkchop, you have a porkchop. I have a veal, you have a veal".
I use clark connect for my firewall. Its linux based wit a web admin, it displays usage reports, bandwidth graphs. Does nslookups and whois on people who try to hack you. Even displays "12.12.12.12 tried to use Code Red 2.0"
Also includes CUPS for printing.Samba for file sharing. OpenSSH and the web based admin uses ModSSL so its all encrypted.
Its frickin awesome! Is built from Redhat 7.2 and accepts all Redhat 7.2 RPMS.
Smoothwall has been doing the job for me for ages... Only a 20 meg download for the ISO and you install the system off that... It's pretty cool!
works great, easy to set up, floppy only, works on >= 486 machines. I've never seen it go below 98% idle on a 100MHz P5 with 5 hard-working machines filling a 768Kbps DSL line. You can pay $50 and get a DMZ added on to the free version, same price for a VPN license.
Download it from here. This is a BSD based firewall, but no shell, nothing for a cracker to get onto it. Uses SSL web access (new in later versions) or a Winblows client for configuration.
Oh and one point that is heavily stressed in their marketing material - it's ICSA certified.
There is a small version for ~$750 street price that gives 25-user version with DMZ, no moving parts, runs off 12VDC.
Got Wisdom?
This firewall is free for non-commercial use and has a web interface to boot. I've used this for sometime now. It supports VPN, incoming/outgoing email virus scan, IP accounting and routing. It will even update itself on the fly if you want. Here is the link: Astaro Security Linux
P.S. - I don not work for these guys, I am just impressed by what they offer.
Give IPCop a go. Very similar to Smoothwall without the "attitude" that some people suffer from.
Please check out ClarkConnect... it's a great little firewall based on RedHat 7.2. It gets regular updates, and has an active user community.
check out astaro firewall at www.astaro.com.
it is a linux based firewall solution with vpn & virus scanning support. it's the most comprehensive firewall package that i have seen (and that is freely downloadable).
astaro includes implementations of other security related products (swan, etc) all in one package. definately worth a try.
The crunchbox could ship with the public key of the Crunchbox team, and then the iShop people could digitally sign updates.
If you wanted to fake an update, you'd need iShop/Crunchbox's secret key to sign your little bundle of destruction.
I have no idea if this is how they take care of it, but it seems like a good idea to me.
OK... apparently, I am a moron... well, maybe not a moron, but LAZY. I got off my arse and did some poking around. Look what I found.
I found a few application level proxies -
OpenGateKeeper H.323 Proxy
ftp.proxy - This looks very well done.
smtp.proxy - done by the same guy as tcpproxy below.
For the generic tcp proxy -
nportredird - This looks very promising.
aproxy - looks a little too simple, but it's perl! (English can be found via babelfish.)
tcpproxy - This one seems the most complete and designed for a firewalling environment.
I found a whole slew of different app "level" proxies (Quake, POP3, etc.), but most seemed a bit basic. Some of the POP3 ones were cool (proxy auth support).
I was not able to find a good udp proxy - with multi-source/multi-destination (proxy with an ACL). I've a small local port udp redirector (I have no idea where I got it) that I use on my home network, but it's not something I could use at work. So... there ya go.
3cx.org - A truly bad website.
Firewalls using iptables with 2.4.x kernel:
Firewalls using ipchains with 2.2.x kernel:
Firewalls using ipfwadm with 2.0.x kernel:
My question is, isn't it best to use an iptables-based firewall on a 2.4.x kernel instead of an ipchains- or ipfwadm-based firewall on a 2.2.x or 2.0.x kernel? I definetely want the connection tracking capabilities in the 2.4.x kernel, especially for screwy things like FTP, IRC, etc. (Yes, I know there is an IRC connection tracking patch out now for 2.4 kernels...) Is a kernel that doesn't support connection tracking for firewalls a reasonable option these days?
The emBSD Firewall seems to be right on track, and you can download it right now. I've not tried it, but it runs off a 32MB Compact Flash.
What were the skies like when you were young?
dp
I like Coyote Linux. I used it for some time. It has one of the easiest installers. It even installs from windows. But if you run it through GRC's Shields Up at: http://grc.com/default.htm you will see closed ports on the default firewall ruleset.
Might I suggest FrazierWall Linux. It is a fork of Coyote and LRP, but with better default firewall rules, and a built in web server for local firewall status information. And it will even e-mail the firewall logs to you.
http://www.frazierwall.com/
Plus it passes both the Shields Up and Sygate Scans : http://scan.sygatetech.com/
with stealth mode almost everywhere.
I did have some problems with in initial install. I looked in the config files from Coyote to get things straight with FrazierWall. Other than that, FrazierWall is a well done firewall.
I just read the IRC log and I must say that his first answers were short but not rude at all (later after you have used up all of his patience he indeed gets slight rude...). But IMHO you were quite annoying since you just ignored his answers or haven't understood them.
....
... whatever, you know what I mean.
I think the whole problem is that you want something like a small, secure operating system based on linux that has dhcpd and a webserver and IRC and
But Smoothwall is no such thing (you can abuse it as such of course, but don't expect support for that) - it's "a firewall". In short: A firewall is something that is inbetween you and the internet. This can be a software package (i.e. an add-on to the OS) that installs on your workstation or a device that sits on your uplink. And to be precise Smoothwall is the software/OS of such a device.
You really shouldn't run any additional software on the machine that runs Smoothwall, you should run them on machines that are either placed before the firewall or after it, so including GCC in smoothwall doesn't make any sense at all unless you change the purpose of the software from "a firewall" to
Your failure was that you haven't understand the goals of Smoothwall and dustmite's failure was that he hasn't noticed that. When you said that you want to replace Suse and RedHat and only have "one machine to work with" and want to install/run this and that he simply should have said "Sorry, Smoothwall is obviously not the right solution for your problem. Use something else, we can't help you".
Oh, BTW: Do you really except help from someone after you have criticized him for his attitude? This is not a clever tactic.
yes, thank you for stating what i was going to say.
i'm glad your response was modded up. I am quite satisfied with the level of activity on LEAF. We are going to move to a recent version of Oxygen in the near future. And the reason for doing that is to be able to run Seawall as a firewall on our
'embedded' boxes.
There is a real nice, stripped clean and naturally free linux distro for firewalls/routers called bifrost. The latest few versions use 2.4-kernels, but they keep a nice annotated back-log of their old distros since 1997. The distro has a fairly clever system for dealing with mobile users (called nomad). It lacks a "click-and-go" wui by design, due to the risk of unneccesary security breaches - in my translation from the swedish pages - Correct filterrules are preferentially constructed "offline", and transfered by scp. For those who want clickability and colors, we recommend Xemacs for suitable coziness. Imho, thats the way to go (although I zealously use emacs instead).
The guys who maintain bifrost/nomad spend a lot of time on fairly advanced network performance testing with different hardware/driver combinations, so you maight want to consider their hardware recommendations as well. For the machines they put together for the Swedish university network, they go with flash-drives for safe (and fast) storage.
If you are curios about the name of the distro, the following helps:
The name Bifrost comes from the nordic mythology, where Bifrost is the bridge between Midgård (The Earth) and Asgård (the home of gods) and is called The Rainbow by humans. It's so strong that it will not be destroyed until Ragnarök - the end of the world. Bifrost is guarded by Heimdall and the red color one can see in it, is a flaming fire that prevents the giants to climb up to Asgård.
For those looking for instructions on building a linux floppy take a look at some documentation I made up while working on my own.
I had not found any good linux floppy firewall distributions running 2.4 the kernel so I figured out how to do it myself. This document doesn't include the instructions on how to include iptables but I will be adding that soon (it isn't too difficult).