Slashdot Mirror


IPCop 0.1.1 Review

Selanit writes "I just found a link on Distrowatch to a SecurityFocus Review of IP Cop 0.1.1. IP Cop is a fork of the GPL version of the Smoothwall Linux firewall distro, which had a review linked by Slashdot. Though it has a slick, easy install. and good features, a number of people had issues with Smoothwall.. IPCop has implemented shadow passwords to fix the security flaw, and their mission statement includes a provision that they will "Provide an enjoyable environment for the Public to discuss and request assistance." The to-do list of features for the upcoming 0.2 version is also interesting. "

6 of 104 comments (clear)

  1. IPCop as a quick solution to firewalling by freeio · · Score: 5, Informative

    We have tried IPCop 0.1.1 at the office, and it has one very big advantage over using a general purpose distribution: it installs and comes up running very quickly. From inserting the CDROM to completion of the install on a typical system (200MHz Pentium with 64MB memory) it took about 14 minutes to having it running.

    We use it as a three-way firewall with a DMZ, and that is stone-cold simple to install. Slick, with no problems.

    Highly recommended!

    --
    Soli Deo Gloria
    1. Re:IPCop as a quick solution to firewalling by paenguin · · Score: 5, Informative

      I've done a lot of IPCop installs and I can have it installed and configured in 10 minutes pretty much every time. That includes from the time I boot the CD to start the install to doing all the patches, turning on all the services I like and defining the dhcp ranges it will be serving.

      This is one nice Linux security distribution. It requires minimal skill to install and there is a huge FAQ on the website.

      Highly recommended!

      Here's what you get:

      - Totally GPL
      - Friendly support on mailing list
      - All source code available on public CVS
      - Installs from bootable CD, or with a floppy to kick it off, installs from CD, http or ftp.
      - 2.2.21rc1 Kernel
      - EXT3 File System
      - IPChains based firewall
      - Network Address Translation (NAT)
      - Analog/ISDN/ADSL modem support
      - Support for almost any connection type
      - CheckPoint Soft. SecuRemote Support
      - Full DMZ Support
      - Web Based GUI Admin & Config System
      - Full Status Display
      - Full Traffic Graphs
      - Full Connections Information
      - PPP Settings/Configuration Area
      - PPtP ADSL Support
      - PPPoE Support
      - USB ADSL Firmware Upload Area
      - Modem Configuration Area
      - SSH server for Remote Access
      - Password Control Area
      - HTTP/FTP/HTTPS Web Proxy
      - DHCP Server
      - Caching DNS
      - TCP/UDP Port Forwarding
      - External Service Access Control
      - DMZ Pinholing Capacity
      - Dynamic DNS Support
      - Intrusion Detection System (SNORT)
      - VPN Support (FreeSWAN) with Control Area
      - Full System Logs
      - Web Proxy Logs
      - Firewall Logs
      - Intrusion Detection System Logs
      - Remote Shutdown/Reboot Area
      - Integrated JAVA Based SSH Shell Area
      - IPCop Linux Updates Area

      --
      We should start referring to processes which run in the background by their correct technical name... paenguins.
  2. Redundant Solutions? by bleckywelcky · · Score: 4, Insightful


    I have read over IPCop configurations and documentations several times before, and it is definitely a good solution for a simple home office or other small business network. It is fairly simple to use and setup, and fairly robust in operations. However, there is one thing that it lacks, as well as what many other solutions lack: the ability to handle redundant internet access. Although I have not looked at every single software solution for routing and networking on this scale, there still seems to be a lack of redundant-internet-connection support in the field. The ability to use multiple internet connections for backup in a single software solution, as well as to use multiple internet connections to increase overall bandwidth, seems to be missing.

    Has anyone run across developing projects (or already developed projects) that are trying to accomplish this sort of feat? I have seen a hardware solution or two that have tried to work this problem, but they are rather impractical for a home office user who needs redundancy (telecommuting, etc) or expansion of their bandwidth (kids playing games while they need to transfer projects around, etc) for their home network. Can anyone comment on this subject?

  3. Re:Uprising Politechs... by TellarHK · · Score: 4, Informative

    Actually, as a member of the IPCop user mailing list, I'd have to say that any ill-will has been pretty well restrained. The list might occasionally flare with the occasional flame, but the moderators of the list do a pretty good job of keeping it all in check.

    IPCop has the goal of planning a large rewrite for the .2 release, and I'm looking forward to seeing where these efforts go. While Smoothwall GPL support seems to have stalled in a few areas (most notably USB Speedtouch modem speeds) IPCop continues with the full effort of the team.

  4. IPCop kicks Smoothwall's ass, for these reasons: by joebp · · Score: 5, Informative
    • IPCop lacks Richard Morrell.
    • IPCop fixes the long-known USB ADSL bug with Smoothwall -- which cripples upload speed to 3K/s instead of 30K/s.
    • No nagware, adverts, requirements to donate to get basic support, etc.
    • Smoothwall GPL is treated and referred to as 'trialware' by the Smoothwall development team, and is essentially dead as GPL project.
    Smoothwall is in my opinion perhaps the most ungraceful transition from a pure open-source project to a business in recent history.
  5. Re:Uprising Politechs... by Anonymous Coward · · Score: 5, Informative
    the reason ipcop doesn't currently appear that technically different from smoothwall is because currently it's not. the 0.1 release was just a stop-gap measure to provide people an immediate alternative to smoothwall; not a technical alternative, but a logistical alternative.

    matter-of-fact, phil barnett, who use to run the unofficial smoothwall mailing lists (even before smoothwall.org had an "official" mailing list), says something along those same lines here.

    a major rewrite is planned for 0.2, which will clearly differentiate ipcop from smoothwall.

    but was the logistical problem really that big, big enough to necessitate a fork? what follows is a repost from the official smoothwall "users" mailing list where all i did was inquire about the GPLed kernel sources and patches used in the distribution. i didn't ask for the smoothwall project to provide them, but only to state what they were so that i could find, download, and rebuild the kernel sources with qos (quality-of-service) capabilities enabled, one that would be as similar as possible to the smoothwall kernel (for a drop-in replacement).

    i thought one of the original benefits richard stallman intended for GPLed software is that the user can infinitely customize and tailor the product to suit them and there is no vendor lock-in as the source code can be altered for the customer by third-parties? isn't the GPL about the customer? obviously smoothwall management (richard morrell, "project manager and founder") doesn't have anything (especially ideals) in common with stallman besides a first name.

    note: yeah, i've removed the email addresses and phone numbers contained in the following message. as much as i disagree with richard morrell's attitude, i don't wish spambots or people upon him or his email addresses (see "Golden Rule", Matthew 7:12 & Luke 6:31).


    From: Richard Morrell
    Sent: Saturday, September 22, 2001 2:58 PM
    To: Wright, Corey
    Cc: users@
    Subject: Re: [users] What kernel source and distro-base?

    DONT

    If you think you have something to add use your brain

    Come talk to the team

    QoS is so so so unneeded.

    You will get fuck all help from us dude

    Richard Morrell, project manager and founder - SmoothWall
    Technical Director - Caveonet Ltd

    On Fri, 21 Sep 2001, Wright, Corey wrote:

    > What kernel source (plus patches) and distribution (if any) is 0.9.9 based
    > on?
    >
    > I'm wanting to add QoS capabilities to SmoothWall using kernel modules
    > (sch_*), the tc application, and a script borrowed/modified from LRP
    > sec-EtherToEtherFiles.html>.
    >
    > I know from looking at the smoothwall-0.9.9-kit.tar.gz tarball that the
    > kernel config's are included in that and that the kernel was 2.2.19, but
    > what kernel source was used (stock, patches, etc)? If the kernel was
    > patched, is the modified kernel source provided somewhere, or at least the
    > patches to apply to the stock kernel?
    >
    > What distribution was used as the base for the SmoothWall, if any? If all
    > the apps came from a distro, then I can simply see if that distro provides
    > tc (ex. in Red Hat's iproute rpm) instead of having to statically compile tc
    > (or try to match library versions).
    >
    > The "donor" computer I currently use for SmoothWall 0.9.8 had Red Hat 6.2
    > installed on it (just two weeks ago, right before 0.9.9 was released) and I
    > had QoS set up, but with a simpler script. The script I used only provided
    > "Stochastic Fair Queuing" and didn't discriminate between different types of
    > traffic (like the LPR script does), but it really helped make web surfing
    > and chatting tolerable while apt-getting debian packages over a dial-up
    > link. (Instead of one large queue, like the tcp/ip stack has, SFQ creates
    > multiple queues based on origin and destination ip address pairs [and
    > possibly including destination port; can't remember], and pulls a packet off
    > of each queue round-robin style. So even though there may be tons of
    > packets queued, bound for a particular ftp server, packets bound for a
    > [different] web server don't have to wait at the end of the line behind all
    > those backed-up ftp packets, because those http packets have their own
    > line.)
    >
    > I would be happy to document my work (assuming I get it to work) so that
    > this could be incorporated into SmoothWall.
    >
    > Or if the SmoothWall team isn't interested, I'll just have to ask for this
    > same information next time/version around. ;-)
    >
    > Corey
    >
    > PS Thanks for SmoothWall and I look forward to installing and modifying
    > 0.9.9.


    i never received any follow-up or further assistance from the smoothwall team (if you even dare to call the above "assistance"), but eventually reached my goal with the helpful detective work of another smoothwall user, who had also received a similar reply from smoothwall management to a similar request.

    and this is why i do not recommend nor support smoothwall, and instead point to the ipcop project.