Slashdot Mirror
Build a Cisco PIX for 800 Australian Dollars
tallguy_wt writes: "Why fork out thousands of dollars to learn Cisco's PIX firewalling product when you can build your own for under 800 Australian Dollars, as shown in this article by Routermonkey."
← Back to Stories (view on slashdot.org)
Why fork out thousands of dollars to learn Cisco's PIX firewalling product when you can build your own for under 800 Australian Dollars?
Because it is illegal and you will go to jail for stealing CISCO's intellectual property.
...posting links to a story which encourages you sourcing stuff from a warez site ?
Gentlemen, start your penguins
ACTON, Mass.--August 30, 2002--OSDN today announced it has rethought it's company direction and expanded into the lucrative market of publically breaking the DMCA. "Cisco can't do shyat," cited Slashdot General Manager CmdrTaco, "We give props to our box0r hacking homeys" OSDN stock rose to a 2 cent high on the pinksheets following the announcement.
s200.org - visit it (me), love it (me).
Well, I think it's good to do some hardware hacking, like TiVo modding and whatnot.
Using opensource software instead of using their expensive counterparts is also a nice thing to do.
But, excuse me, what is this fucking thing about?
This puts the whole community into a bad light.
This whole "hack" or "tutorial" or whatever you might call it is nothing but two things:
Take some standart hardware and install stolen software. Wow.
Would you call this an intelligent hack? Maybe the folks over at something like scriptslashkiddiedot.org would...
Go to www.freesco.org or any other single floppy OSS based distro, get an old pc and two NIC's and go. $100 max.
The reason to use CISCO is ultimate durability, stability, service, configurability, speed etc etc.
hacking this thing together is gonna give none of the above!
In what setting am i gonna need a cheap ripoff of a professional router?
Those places that need the real thing usualy also deserve the real thing !
Why are other peoples sig's always more witty ???
Linux iptables HOWTO
How to Build a FreeBSD-STABLE Firewall with IPFILTER
The OpenBSD Packet Filter HOWTO
Acts@core.mailboks.com Acrux@core.mailboks.com Adam@core.mailboks.com Adar@core.mailboks.com Ada@core.mailboks.com
Thanks to this insightful article, I've realised the true money-saving potenial of stealing.
For all the column inches devoted to how the DMCA/RIAA/whoever is immoral, you go and put a link to someone advocating theft. This isn't far from advertising warez... even if the server can handle the traffic, the slashdot effect still allows a lot of eyeballs to see that site.
I disagree with software piracy, and stealing music online; I occasionally do download MP3s, I won't deny it; just as I drank alcohol when I was under 18 (UK), but I would consider myself only a 'minor' user - these files are never on my HDD for too long (I think the record is about a week)
But this is qualitatively and quantatively very different from
How can any movement to safeguard our rights be taken seriously with this sort of lunacy? Valenti et al will be rubbing their hands in glee. This is another victory for them - if one of the most popular advocates of free software is advertising piracy, then that reflects very badly on the community as a whole.
And yes, I do consider my MP3 use to be wrong - I'll buy these songs if they release the single but I don't want an album of pricey crap because there's one song ion it I like - I can't wait for services where a comprehensive list of songs can be bought at a reasonable pprice, individually...
This idea was invented by Shampoo.
Details on how to do this surfaced on some cisco study boards 12-18 months ago. Most of the people on the board were interested in this to be able to add a Pix to thier home study lab. Groupstudy had a very long thread on this. They were dubbed the 'FrankenPix'
Cisco is very well represented on the board, and they never said a word to anybody about not doing this, and sort of allowed it to happen.
On the other hand, when FrankenPix's started appearing on eBay, they cracked down, hard and quick. But, to this day, they still haven't said anything during the discussions o the cisco study boards.
My view on this is they really don't care if people build FrankenPix's for home study, after all, that's just going to help sell more Pix in the long run. (Checkpoint, afterall, will gladly give you 30-day trail licenses for FireWall-1 for home study) But, if you try to build and sell these, they WILL get you. (And honestly, if you want to use these boxes in a professional enviorment for day-to-day usage, you are asking for trouble.)
--dirt
I guess there is a lot of people who have been playing with ipfw, iptables, ipchains etc
And would realy, sincerely, like to know:
What can I do with a Cisco PIX that I can't do with Linux and IPTables ?
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
I recommend avoiding smoothwall (search usenet for "richard morrell smoothwall" for more info..).
Try IPCOP for a GPL fork of smoothwall that is not a hidden attempt at selling things and is GPL in spirit, not just name.
This article shouldnt have been how to make a pix it should be how to make a legal,cheap,open source alternative to one.
no sig.
Well, first yesterday they provided a direct link to a tool to DOS a Windows NT/2000/XP box, and today they're linking to an article on how to build a Cisco PIX and steal their software to run on it?? WTF is Slashdot becoming? If you are just downloading the PIX software you *are* stealing it. It's several thousand dollars.
As stated before, this "hack" is piracy and therefore illegal. Furthermore it is a stupid waste of money.
Why spend $800 for a amateurish, rigged up, pirated Pix when you can have the real thing for less. If what you really want is to learn about the Pix and its configuration simply hop on to eBay and buy the real thing. On eBay Pix 501s and 520s can be had for $400 and $500 respectively.
This has been mentioned above, but not very clearly. As far as I know, the PIX software also requires an activation key, which costs money. You might be able to get one from a warez utility, but it is an extra step, and it is illegal. Also note that Cisco charges extra for the ability to just secure shell into your firewall(!). Unless you cough up a whole bunch of extra money, you have to use TELNET to configure a FIREWALL. This is really lame.
/proc filesystem. I searched and searched and could NOT find any way to do this on BSD. It may exist, but I couldn't find it.
Further, the PIX just isn't a very good firewall.
The hardware is well-built but incredibly underpowered. The one we have at work is only 200mhz. I don't know how far that will scale, but, personally, I don't think I'd want to be putting more than about 5 megabits through it. And Cisco charges about 12,000 dollars for the PIX.(!)
The command syntax is really hard to figure out. It just makes no sense at all. The documentation on Cisco's site is excellent, but I always have to resort to cookbook examples, because I don't use it every day.
The default configuration is 'allow all outbound traffic and all inbound replies'. It is very hard to change this. If you want a fairly secure network, you shouldn't allow direct outbound connections, but rather only through a proxy device of some kind. If your security policy requires outbound connection restrictions, this is really awkward to implement with the PIX.
The PIX isn't a very good router, either. It doesn't support most of the 'real' IOS commands. You can do some routing with it, but it's not very flexible.
I've worked with a lot of firewalls and have done a lot of firewalling, and in my opinion, Linux with iptables is about the best thing going. You will have to spend significant learning time to figure it out, as the documentation is not very good, but once you do, you can do pretty much anything with it. Linux has always been a great router, and with the introduction of iptables, became a great firewall too. If you don't want to build rules by hand, there's a program called 'fwbuilder' that gives you a Checkpoint-like GUI. FWBuilder also speaks OpenBSD's pf and I *think* Checkpoint's firewall language, but I'm not sure about that last.
OpenBSD has a good reputation as a firewall. I used it at home for a couple years, but I have moved to Linux since then. The PF language is very clean and easy to read, and if you're just starting with firewalling, it can be a good first opensource firewall. However, there were big performance problems with OpenBSD's bridging firewall code in 3.0; it choked hard over about 25K connections, and past about 30 megabits it just froze up for random periods of time. Very frustrating. Linux on the same hardware (with the iptables bridging patch) handles over 60 megabits flawlessly. And going over 30k connections is trivial; you simply echo a large number into a variable in the
They may have fixed the performance problems in more recent revs of OpenBSD. 3.0 was the first release of pf, and I threw it into a monster production environment based on the OpenBSD team's reputation. The later revs may be much better, but as of 3.0, Linux absolutely destroys OpenBSD as a firewall.
There's one cool thing the PIX does that I haven't figured out how to duplicate manually. It has an 'established' command, which allows you to say: "If I open a command on port X, allow a return connection on port Y for a short period of time." This is useful, for example, for IRC, where you connect on port 6667 and an ident connection comes back in on port 113.
I asked about this feature on the OpenBSD newsgroups, and got scoffed at... according to them, it's more secure to leave the port open all the time to everyone than just to allow return connections from a host to which you have connected and only for a short period of time. Frankly, I think that's just stupid. It's the typical apologist reaction... "that's a dumb feature to ask for because it's hard to do". They'll say it's stupid until someone takes the time to implement it, and then suddenly that's the only way to go and any system that doesn't do that is obviously broken.
I haven't found that capability in the Linux iptables stuff either, FWIW. As far as I know, only the PIX does this, and I consider it a very useful feature. (you can sort of simulate it with some of the kernel modules for different protocols, but I haven't found a way to do an arbitrary set of ports).
If you can live without the 'established' command, though, I'd probably, overall, recommend the Linux/FWBuilder combo. If you want to learn more about firewalling, OpenBSD's pf language is a nice simple way to start.
And if you really want to spend money on a firewall, Checkpoint is a much better solution than the PIX. It has many enterprise-class features that the free alternatives lack, like good VPN support and great support for managing clusters of firewalls. The Nokia Checkpoint boxes are *really* cool; they are based on a custom BSD-derived kernel. They cost more than the PIX, but in my opinion are wildly better and well worth the extra. (when I last looked, the prices on the Nokia boxes were in the 20K+ range. They may have dropped since the dotcom blowup.) The administration is easy, you get the power of BSD, and the hardware is really well-built. Very, very cool boxes.