SmoothWall 2.0 Linux-Based Firewall Released

thegraham writes "Despite some earlier server problems, SmoothWall 2.0 has been released this evening - there are also release notes available. SmoothWall is 'a firewall operating system distribution based on Linux, enabling a low-end, possibly otherwise redundant, Intel and compatible PC to become a hardened Internet firewall', and changes from version 1 include: 2.4 kernel, new web interface, improved networking and many bugs corrected through the Beta program."

Comments

I use this one at home

[rabbit994]

I've been using the 2.0 Beta at home without any problems. It's makes a great firewall for old boxes and has support for Proxies, DynDNS and everything else you expect in a good firewall. All configured easily from a web based interface. Works great for protecting those Windows boxes too. Think Windows cowering behind a big Tux. Kudos smoothwall team.

Re:I use this one at home

[gl4ss]

i use it too..
however, i had one big gist about it. it had an old noisy harddrive, and it was made to log practically everything it seemed(well, info about everything)..

when the line that it is connected to transfers regularly several (tens of)gigabytes per day(to 100mbit lan) it was kind of annoying as it made constant noise because of logging.

well it didn't take too long before the 100mbyte it had reserved for logging filled up though..

.

Re:I use this one at home

[geekp0wer]

USE IPCOP ITS A FREE PROJECT

Re:I use this one at home

[wpanderson]

> USE IPCOP ITS A FREE PROJECT

So is SmoothWall, and always has been.

Re:I use this one at home

[gl4ss]

yeh i just read about the differences a bit down from this thread..

i guess i'll be using it next time i'll touch the thing(it could take several months, unless i see something very wrong with how it is running now). you see, i don't even touch it regularly, it's been on for few months now(the power is very reliable here, last time i touched it i upgraded from another non-hd thing to this smoothwall beta i got now).

what i'd REALLY like would be a cdrom booting distro that had a decent interface(remote interface, maybe http like smoothwall) and not dependant on hd. i used to use closedbsd but it was a real chore to hook up the keyboard and monitor to enter some (cryptic) lines on it just to forward one port(did i mention that i didn't have a floppy drive on the thingy? so all settings would be wiped in case of a power failure, which never happened).

Re:I use this one at home

[Anonymous Coward]

IPCOP forked from smoothwall because the lead developer at smoothwall was an a$$ and would not work with anyone. IPCOP is community based. They do not hold features back unless you pay like smoothwall. http://www.ipcop.org

Re:I use this one at home

[Anonymous Coward]

ipcop has had a 2.4 kernel since april 2003. Wonder why it took smoothwall this long. They should have used their time to go to 2.6.

Re:I use this one at home

[Mr Smidge]

I have had an old P200 with a 250MB (so not a web cache then) box running the Mallard beta of this for a good while now, and before that I ran a 1.X version... It's been getting a good 100+ days of uptime, and is rock-steady.

In fact, I think there's only feature I could ask for: automatically erasing the logs after they fill up the entire /var partition.. It only dedicates 100MB or so to /var, and it quickly fills..

Otherwise, Smoothwall definitely gets my two-thumbs-fresh. I used it share dialup among my home LAN, and now cable. This story has given me a good interest to donate to this fantastic company.. (Oh, and no, I don't work for them)

Re:I use this one at home

[teklob]

I've been using it too, but unfortunately it's been crashing sporadically. Sometimes 5 times within an hour, and sometimes it runs for 2-3 days just fine. But it's a hassle to go and reset it each time. The kernel reports nothing leading up to the total lockup.

Re:I use this one at home

[ScottSpeaks!]

it was kind of annoying as it made constant noise because of logging.

Solution: Switch to a package that doesn't use a hard drive. Coyote Linux only needs a 1.44MB drive, a couple old NICs, 386, and 12MB RAM. (You can send logs to another machine if you actually want them.)

Re:I use this one at home

[Anonymous Coward]

That a$$ RM was kicked out ages ago. He also has never written a line of code in his life.

Re:I use this one at home

[Anonymous Coward]

I've been using it since 0.96 (ha! ;-) ) and it's been great all along. (324 days uptime once, then I moved.) I recommend a Pentium PC with PCI NIC(s)--makes autodetection really easy. Corporate Compaq Deskpro Pentium 133-200s can be found for between $zero and $50 and SW will recognize the onboard NIC (Intel or 3Com ususally.) It's usually only 10bT but hey, that's all you need on the broadband end.

Re:I use this one at home

[Anonymous Coward]

Ok, I try not to be negative, but the good folks at ipcop.org are actually friendly and helpful. The main guy at smoothwall is a jerk. Forgive me, I know this sounds like a troll, but the people behind open-source projects affect me opinion of said projects.

Re:I use this one at home

[wpanderson]

Ok, I try not to be negative, but the good folks at ipcop.org are actually friendly and helpful. The main guy at smoothwall is a jerk. Forgive me, I know this sounds like a troll, but the people behind open-source projects affect me opinion of said projects.

If you're referring to Richard Morrell, and by the reference "main guy" I assume that you are, he left in March, as has been pointed out several times already in these threads.

Re:I use this one at home

[uradu]

> what i'd REALLY like would be a cdrom booting distro

Even better, one small enough to fit on a 128MB or less CF card. Using a CF-to-IDE adapter you could then have a nice solid state router.

Re:I use this one at home

[quigonn]

Actually, software developers have to be really harsh and impolite to make their success a real success. Just look at DJB, OpenBSD or the mplayer developers? Are they nice and friendly? Absolutely not. Is their software widely used? Absolutely yes. I don't know, maybe this is something that impresses people, like "oh, this must be a good programmer, when he can the liberty of being harsh to his users, and so his software must be really good".

Re:I use this one at home

[laa]

Make one!

Step 1: Take a debian install cd and install it into a small (700Mb) partition. Edit fstab, ifstat and a handful of other files. Burn cd image with mkisofs. Re-iterate until it works. Make the CD bootable or boot from floppy (my BIOS doesn't boot from CD, the firewall is always the crappiest hardware)

Step 2: ???

Step 3: Profit.

Re:I use this one at home

[gl4ss]

those cost money.
cdrom drives on the other hand come 'for free'.

-

Re:I use this one at home

[BlackHawk-666]

I think it's more likely to be the other way around, whereby they become a victim of their own success. When a project gets successful all sorts of noobs come along and ask the same dumb questions that are covered on the boards and in the FAQs. Developers get tired of having to repeat the answers and even RTFM and RTFF get tiring, so they tend to get shorter and snappier in their replies.

Re:I use this one at home

[BlackHawk-666]

Making a bootable CD is a fair amount of work, but if you're interested a combination of the Linux From Scratch project and the Linux Bootdisk HOWTO will really help out. I also found the Slackware Live CD site very useful.

It's the profit bit that eludes me now :-)

Re:I use this one at home

[uradu]

> Make one!

That would go against the programmer's motto: why make/write something if someone else can do it for you?

Re:I use this one at home

[Anonymous Coward]

Cool free! How many VPN Tunnels can I set up on this *free* version???

Re:I use this one at home

[Chop]

I am using 1.0 and have 4 available tunnels to use

Chop

1 comment and BAM!

[Lane.exe]

Mirros please? I want technical specs on this one. Thanks.

Re:1 comment and BAM!

[Anonymous Coward]

You might want to check the kernel release, they couldn't be bothered to update to the 2.4.23 release. There is a well known vulnerability in this kernel.

Re:1 comment and BAM!

[BlackHawk-666]

Download from here. Or check it out at Source Forge

OS?

[orangenormal]

Forgive me if this is an obvious question, but why run a dedicated "firewall operating system" when hardware and software firewalls are available?

Re:OS?

[pe1chl]

Hardware firewall?
You probably mean a box with a microcontroller running a dedicated firewall operating system.

Re:OS?

[theonlyholle]

because it's easy to set up on a bit of spare hardware, however old it may be? Because it provides all that the average firewall user needs? Because it is easy to maintain once it's running? Because most hardware firewalls are as unflexible as they are expensive? I can think of a lot of reasons. In my company, a number of offices use Smoothwall and will certainly upgrade to Smoothwall Express soon, simply because it's an affordable way to secure our network boundaries and because the ongoing maintenance work is minimal.

Re:OS?

[Liselle]

Seems as though it's a good use for computers too dated to do much else. Lord knows there are enough of them.

Re:OS?

[wud]

Forgive me if this is an obvious question, but why run a dedicated "firewall operating system" when hardware and software firewalls are available?

Software firewalls suck, for two main reasons
1. they're only as strong as the operating system they run on... if this is windows, then you're screwed
2. you're computer still has to do all the blocking, the point of the firewall is to block unwanted traffic before it makes it to your network.

now the only reasons I can think of(prove me wrong) for running smoothwall instead of a dedicated hardware firewall is that its way cheaper if you alredy have an old pc lying around(like most /.ers) plus its just plain cool.

Re:OS?

[cybermace5]

It's a Linux distribution. It's just all set up and locked down for firewall use, with all the features installed that you might want to use.

Software firewalls are not that great, hardware firewalls are not as easily updated. By using an old box and a firewall distribution, you can set up a firewall and also have a nice local DNS, DHCP, time, file, and so on server for your network.

This looks a little heavy compared to the FreeSCO floppy distribution I use, but when it's no longer Slashdotted I'll see if it has anything worth reconfiguring my firewall for.

Re:OS?

[kayen_telva]

it IS a hardware firewall. for much less money.

software firewalls dont handle things like DMZ, DYNAMIC DNS, DMZ pinnholes, etc. etc.

Re:OS?

[Malk-a-mite]

Because not all software firewalls are equal and not all hardware firewalls are able to do as much. Those that can do as much (or more) have a price tag that reflects that. Because some people don't like to throw away hardware that could be put to a good use. Because for some people it's just fun.

A few distros off the top of my head:
Smoothwall
Clarkconnect
IPcop
Freesco
C oyotelinux

Re:OS?

[muckdog]

Hardware firewalls (like checkpoint or your linksys router) are often propritary and/or may be limited in what they can do. Checkpoint firewalls aren't cheap either.

Software firewalls (like norton on your win2k desktop) may be running on top of a buggy , unsecure piece of crap like windows. Why break the lock when the door is made out of cheese?

Re:OS?

[kc8apf]

Quite simply, I have things on my wired home network that I don't want anyone on my AP to access. Using a linux box to handle routing and firewalling between the Internet, wired, and wireless networks does something that software firewalls (like ZoneAlarm) can't do and that would cost over $300 for a hardware firewall to do the same.

If i've already got an old machine laying around from my last upgrade, why waste money on the hardware firewall?

Re:OS?

[Tha_Big_Guy23]

Actually, smoothwall does handle DMZ, Dynamic DNS, DMZ pinholes, etc. You can set it up with a 3 nic configuration, and allow one of the nics to be your DMZ. For the convenience of the end users, the network zones are labeled Red(External Internet), Green(Internal Network), Orange (DMZ Network).

Re:OS?

[gl4ss]

cheap 'hardware firewalls' can only push only up to 2mbyte/s(the 100mbit 'out'-net models), where any old computer with decent cheapo nics can push 6-7mbyte/s easily. also there's various issues why cheaper hw firewall/nat boxes tend to suck.

-

Re:OS?

[i_r_sensitive]

I would suggest there are two immediate benefits:

1) Presumably the OS has been hardened, even without the firewall. You can have the greatest firewall on the face of the earth, but if the underlying OS is compromised....

2) Presumably the kernel is optimized for the task. Lean, as modular as possible to maintain the low overhead which would be mandated to perform decently on older hardware.

But, given that Linux is the OS (and Smoothwall is GPL'ed) it opens up the possibility of tightly integrating the application to the running kernel, up to and including modules which fundamentally alter how the kernel handles network traffic. This would seem to be likely, as it owuld bring immediate payoffs in performance.

I'm not saying any of these are the case with Smoothwall, but they are all reasonable reasons to use Linux to create a dedicated firewall operating system.

Re:OS?

[tekspot]

First of all, because not everyone is talking about home or one workstation application. If you have 100 computers on the network, with smoothwall you will need to configure/reconfigure/update only one dedicated box, instead of all 100 individually.

Second of all, software firewalls that run on your computer take up resources, and are generally limited by your operating system.

Finally, smoothwall will be a lot more secure, because it will not be running any of the services that can be compromised by hackers. It adds an additional layer to your security. Remember, security is about layers.

Re:OS?

[tacocat]

Because software solutions are too late. The culprit is already at your machine

And hardware solutions have two problems that I've personally seen happen.

1. If they are found to have a security flaw in them, the company will not make the effort to reveal to the community the need for a security upgrade in every case.
2. I can install smoothwall/ip-cop for free on a machine I can pick up for free. It comes with the capability of supporting a DMZ/LAN configuration (3 NICs). This costs big $$$ in hardware

There are very distinct advantages to this approach. BTW they also have squid, which hardware devices can't provide.

Re:OS?

[Anonymous Coward]

Hardware Firewall- Unplugging the cat5 from the computer.

Re:OS?

[RicktheBrick]

There are lots of reasons for me. One is cost. One has to have a nic card for every computer connected and one for the modem that is assuming there are enough pci slots. At $5 a nic card 4 computers equal $25. This compares to about $50 for the router. What is the difference in electricity cost of running a computer than a router? Than the space required for a router is much less than a computer. Than there is the need to regularly reboot the computer. Router never need to be rebooted. Than add noise(at least 2 computer fans, hard drive and heat generated in the summer time so when everything is figured in the router for me is the way to go.

Re:OS?

[Anonymous Coward]

I personally run IPCop (a close relative of Smoothwall) at home. I got there through a long process that addresses a lot of your questions.

Hardware firewalls - the cheap ones are slow and have funny bugs all their own. I tried initially with an SMC device that also handled wireless stuff. It had to be rebooted once (or twice) a dayand was way slower than IPCop running on an old 233M Pentium I had laying around. In order to get a decent hardware firewall, I would have shelled out more than $500.

Software Firewalls - most aren't worth the effort it takes to install them. I'll lay off of this and just refer you to grc.com ands the tests he ran on software firewalls.

But that above statement doesn't have much to do with my choice of firewall. What does have to do with it is the primary purpose of my firewall; I wanted to protect my Windows systems from "buffer overruns"; something that Microsoft has proven to be incompetent at detecting and removing from their software. It is impossible to protect the OS from these kinds of attacks with software running under the OS. By the time software running under the OS had a chance to do anything with packets, the OS has already been compromisd by malformed packets.

Now, there are more advantages to IPCop or Smoothwall than just protection from buffer overruns;
1. They install and run something called Snort which is an Intrusion Detection System (IDS). This software filters out malformed packets (used to cause buffer overruns) before they ever get to your LAN and it blocks/logs thousands of documented intrusion techniques from reaching your LAN also.
2. They implement a time-keeping program that automatically synchs the firewall clock to a time-pserver and then supply correct time information to every workstation on your LAN (yeah, this can be done on each machine individually, but I like the centralization of effort).
3. They install and run Squid, an Intrenet proxy server. This software handles centralized DNS lookup and caching, caching of recently-accessed web-pages and logs Internet access. All of this can reduce your Internet traffic a lot if you haveseveral station son your internal LAN.
4. and a host of others; see either's web-site for more details explained a lot better than I can write.

Re:OS?

[EverDense]

For me, its price and simplicity.

I have an IPCop firewall box at home and an IPCop firewall box at the office.

IPCop (and I assume Smoothwall), lets you set up a VPN connection between two IPCop boxes REALLY quickly.

The price for the entire set up was: My time; an hour or so, including cabling and adding second NICs to the boxes. The two old PCs I used, were just that: OLD. They would have been given away if I hadn't grabbed them for the VPN.

Re:OS?

[LostCluster]

Hardware firewalls cost money, and software firewalls have to rely on the operating system beneath them to be uncorrupted.

This is a solution that can be made out of spare PC parts, and is lightweight enough to work just fine on last generation's equipment. Any true geek likely has enough spare parts lying around in their basement from retired machines to build this.

Why does SmoothWall insist on being alone on the machine? Because the firewall is supposed to be absolutely stable, so there's no business for any other application to be mucking around. At worst, letting a user run other software could allow for the possiblity of the user being tricked into running software that undermines the firewall. It's newsworthy that SmoothWall is advancing on their Linux kernel selection, they don't do so very often because they don't often need the new OS features, and the last thing they want is to be discovering new bugs on a firewall.

Basically, this is turning a nearly-useless PC into a hardware firewall...

Re:OS?

[m0topilot]

We just recently moved our firewall/router from a D-Link to a Smoothwall Express Setup. I'm currently using the RC1 version and found it to be a very big perfomance boost over D-link. We were constantly loosing connection with the D-link and had to flogg the power to restart it. Before the Dlink we had a Linksys and had to do the same. The SOHO solutions are limited in their hardware capabilities, you can't upgrade with out buying a new little box. With Smoothwall, as your traffic needs increase, you can simply add more memory and upgrade the cpu! I have not looked at other software solutions, I am sold on Smoothwall Express. Its perfect for a small to Medium Sized company.

Re:OS?

[wobblie]

First, all firewalls are software firewalls, there's no such thing as a "hardware" firewall. Tcp/ip, AFAIK, has never been implemented in "hardware" and would be enormously stupid and inflexible if it were.

I can only assume what you mean is an application level firewall, like zone alarm or something, which are indeed neccessary in windows to both keep windows programs from "phoning home" and to keep other nasty programs from operating. You still need a good packet filtering firewall in addition to that though.

Re:OS?

[caseih]

Software firewalls suck, for two main reasons
1. they're only as strong as the operating system they run on... if this is windows, then you're screwed

How true. However, nowadays, all "hardware" firewalls do run some sort of OS, though, and many run linux-based OS's.

2. you're computer still has to do all the blocking, the point of the firewall is to block unwanted traffic before it makes it to your network

Actually this is not true. Your homemade firewall is like any other hardware firewall. It stands between your network and your outside line. Firewall's of this nature by definition have at least 2 interfaces: one for outside, one for inside trusted network. So no, firewalling doesn't allow traffic into your network before blocking it; the firewall stops traffic at the door.

Re:OS?

[Anonymous Coward]

theonlyholle wrote:
>
> because it's easy to set up on a bit of spare hardware, however old it may be? Because it
> provides all that the average firewall user needs? Because it is easy to maintain once it's
> running? Because most hardware firewalls are as unflexible as they are expensive?

This used to be true, say two or three years ago. But no longer. Take a look at new generation of commodity firewalls like the D-Link DI-604.

It is very feature rich, and certainly provides not only for the average firewall user's needs but even for the need of a very sophisticated user (though certainly not enterprise class, in this case, as it only has 4 ports).

It is also incredibly easy to set up and maintain. I would venture to say that it's probably much easier to set up than Smoothwall, as it requires no OS or application installation you just turn it on.

It's super flexible, though it's not Open Source. So you can't hack the source. But if you're going to be hacking the source you're not talking average users anymore.

And it's not expensive. At least I don't call paying $30 for a plug and play firewall expensive.

(Requisite disclaimer: I have no commercial interest in any firewall manufacturer, including D-Link... I'm just interested in what competative advantage open source firewalls can provide against commercial commodity firewalls to the average user... it seems like none to me. At least not anymore.)

Re:OS?

[ak_hepcat]

Wow. See, I picked up an old embedded PC-in-a-box.
It's only a p-166, but for a firewall, that's plenty fast. I threw in an old 6-g laptop drive to keep heat and noise down.

There's no video, no keyboard. Just a serial console, and 3 ethernet connections.

One small fan, but it's nearly silent. I don't hear the box unless the house is absolutely still.

I don't regularly reboot it -- and it's backed up to my main system via rsync, so even if the drive fails, it's pretty painless to restore to a new drive.

Just like a router, except smaller, cheaper, faster, and more open.

Re:OS?

[Anonymous Coward]

Where did you get this PC in a box?

Iv'e been looking, but every embedded solution I can find is about as expensive as a modern desktop system (with much poorer stats).

Re:OS?

[wud]

I should have known the always specific /.ers would have pointed this out. this is what i meant to say, i should have been more specific.


software firewall - anything that can be installed on a client computer such as zone alarm, tiny personal, etc.

hardware firewall - anything "purchased" to be a firewall, like a dlink router, or a checkpoint box.

i only used those terms in that manner because thats what the original post used.

Re:OS?

[ak_hepcat]

One of those old dialup-to-ethernet router in a box solutions that some company or other was tossing about like candy. Long out of business, of course.

I'd think that a low-end shuttle system would work fine, but that is much more expensive, of course.

Re:OS?

[AsmordeanX]

Advantages:
1. Router ability - Hook up a hub to it and you can have several dozen PCs served from one line.
2. A roadblock to your PC. Your IP address isn't the one to your PC, so attacking that IP attacks the firewall, not you. Doing a DOS attack against a firewall user might kill their network connection, but the PCs behind it will still work just fine.
3. Adds an extra step that hackers have to deal with. The effort required to find out that you found some uninteresting box is probably not worth it.
4. If you have a network in the house, you just plug in to the hub and any PC is now protected.
5. Proxy/caching - Smoothwall tends to do a better job at it than Mozilla. Even better is the other PCs on the network take advantage of the cache in place on the firewall to reduce incoming bandwidth.
6. Independant of your PC. Getting compromised with some malicious software is bound to happen to a few people, but the independant box won't be affected so while stuff goes out, nothing comes back in.
7. Recycle old PCs. Admit it, you never thought a P133MHz had any use anymore did you?
8. Blocking - This is very useful on a network. If you don't want people to be visiting a particular IP. Just block it at the linux box and nobody gets to see that IP anymore.

Re:OS?

[Anonymous Coward]

Actually, I just unplugged my DI-604 and installed this (well, IPCop, but I will probably upgrade to this. I just installed it hours before this came out!) I am doing this because the D-Link, though a great router, has a few bugs. In particular, it won't properly allow a few games to play online if they are not the first addressable IP. It's annoying as I can play Dungeon Siege online with this firewall software, but not my D-Link 604.. And yes, I have the newest firmware, tried openening the router to the world, etc...

Re:OS?

[Anonymous Coward]

Oh - hate to reply to myself, but to clarify: I can play DS online, but my wife cannot. And we can't both play at the same time. This is not true of many other games, but we are playing DS:LoA right now. :)

Re:OS?

[Anonymous Coward]

cybermace5 wrote:
>
> By using an old box and a firewall distribution, you can set up a firewall and also have
> a nice local DNS, DHCP, time, file, and so on server for your network.

You've also given your firewall a bunch of potential security holes. Firewalls should be dedicated to that task alone, which should make them virtually impregnable (at least compared to a box running all those other services).

Unfortunately, for the average home user dedicating a whole desktop or even laptop to being a firewall is really overkill. Which is why a commodity hardware firewall (like the 5" square by 1" deep DLink DI-604 for $33 at NewEgg) is much more reasonable.

That way your old box can still run all those other services and you'd have a cheap, dedicated hardware firewall as well. And the Dlink box is pretty feature full and flexible, as well. Commodity hardware firewalls aren't what they used to be two or three years ago. They've really evolved. Check it out.

Re:OS?

[void*]

One has to have a nic card for every computer connected and one for the modem that is assuming there are enough pci slots

Buy a switch, and you only need one nic for every network.

My firewall box has two nics - one for the outside net (plugged into the DSL "modem") and one for the inside net, (plugged into a switch (Little 8-port desktop type, which iirc was fairly cheap).

My firewall hasn't been rebooted for at least six months - there is no need to 'regularly reboot the computer'.

Re:OS?

[Anonymous Coward]

Have you tried calling tech support? The DI-604 does have a bunch of features that sound like they could be of use to you in getting your game to work. One is port forwarding, which you should be able to do to any machine on your LAN, not just the first addressable one. Another feature is made especially for games (don't recall the name but tech support should be able to help you out).

Personally, I don't play games any longer, so this isn't an issue for me. Also, right now the only DI-604 that we have is at work, so that's not an issue for businesses anyway.

Finally, some software is written in a very insecure fashion (ie. they require random ports to be open on your machine). So, if your game is one such insecure application and IPCop allows it to work that may mean that IPCop is letting connections through to random ports on your machine, which is a security hole and exactly what firewalls are supposed to prevent. Of course, this may not be IPCop's fault. Perhaps it's just misconfigured.

But, you see, it's not as simple as just casting blame on the DI-604. Yes, the problem could be with it, or maybe with the game or even IPCop or its configuration.

Re:OS?

[failedlogic]

You seem to think a "hardware" firewall has a chip specifically to filter the packets. Last time I checked, hardware firewalls actually -need- an OS and software to control filter the packets. Most of them are running an embedded Linux or BSD kernel.

Re:OS?

[cybermace5]

Um, you don't know anything. At all.

The services I mentioned were internal services, meaning they have nothing to do whatsoever with the outside world. The firewall has two network interfaces; one connects to the internal network, the other connects to the bandwidth. Caching DNS and DHCP on your internal network does not punch holes in your external security.

My firewall is the bottom half of an old HP network-enabled scanner, which means that it is a simple case with no drive bays, just big enough to house a standard motherboard. It has a 486-DX2/66 processor and small hard drive, and two 10MB/s network cards. The cost to me was zero, and it does not clamp down on bandwidth at all. In fact, it make the internet connection a little more zippy due to the caching DNS server. To the inside, it's a small web server, DHCP server, caching DNS, file server, and internet gateway. To the outside, it's an array of blocked ports.

Re:OS?

[Anonymous Coward]

cybermace5 wrote:
>
> Um, you don't know anything. At all.

Thank for the condescention. But wait! There's more! The audience watches carefully as cybermace5's smug look falls from his face as his own ignorance of security matters is exposed...

> The services I mentioned were internal services, meaning they have nothing to do
> whatsoever with the outside world.

Now, what happens when some user on one of the machines within your network decides to hack your firewall through its "DNS, DHCP, time, file, and so on" services? The hacker is really going to have his choice of vulnerabilities there. Uhhh... you don't have users? You're the only one one using your LAN? Then what the hell are you doing telling a UNIX admin with over fourteen years of experience that he doesn't "know anything. At all."???

Your little firewall loaded up with a smorgasboard of potentially vulnerable services might be just fine for your own personal little network that you fully have control over. But it is certainly **stupid** to make a firewall serve as anything other than a firewall in anything larger (say, a corporate network).

Next!

> Caching DNS and DHCP on your internal network does not punch holes in your
> external security.

Um... did I say "external security"? No!

Next!

Re:OS?

[wpanderson]

Your little firewall loaded up with a smorgasboard of potentially vulnerable services might be just fine for your own personal little network that you fully have control over. But it is certainly **stupid** to make a firewall serve as anything other than a firewall in anything larger (say, a corporate network).

This is why virtually every service (port forwarding, dhcpd, ntp, dyndns, squid, upnpd, etc) is *disabled* by default in SmoothWall. I can't speak for any other distros/packages, but I'd assume most others would ship with similarly sane settings.

Re:OS?

[cybermace5]

This is what I like about you. First you twist the argument around to a completely different angle, and then you make statements that are true in the context of the new argument. This provides the illusion of a punishing rebuttal, but it depends on the victim of the tactic not noticing the sleight-of-hand.

In this case, you twisted the argument away from home use to enterprise use. And then you begin to make obvious statements in the context of enterprise network conditions. However I fail to see what 14 years of enterprise Unix support and a $33 D-Link firewall appliance have to do with each other. Of course we were talking about a home network. The firewall/router setup I described was perfectly adequate for a home network, at least if any unauthorized wireless connections are blocked.

So what is it? Am I right, and the single-machine setup is great for a situation where you have physical control over access to the internal network? So far your only answer has been "I have 14 years of experience and a single-purpose firewall is the ONLY way to do it in a multi-user commercial installation, which has nothing to do with the fact that in my previous statement I was recommending such things as $33 firewall appliances for home use."

Re:OS?

[Anonymous Coward]

tacocat wrote:
>
> Because software solutions are too late. The culprit is already at your machine

I can't quite figure out what you're getting at here. Certainly having more layers of protection is nice, but I don't see what having a "hardware firewall" outside your machine gains you if the "software firewall" running on your machine blocks the same ports. The culprit may be "at my machine", but he's not in my machine, so what't the big deal?

Re:OS?

[Anonymous Coward]

Did I say that I was recommending the D-Link for enterprise use? No.

In fact, I clearly said that that I was recommending it for "the average home user".

From my experience with D-Link and my relatively extensive experience with UNIX administration I can recommend it for the home network. There is no contradiction in that.

Second, please reread your original post, to which I was replying.

Nowhere do you specify that you were running these services on a firewall being used for your home network.

Furthermore, even if you had that doesn't mean that you weren't introducing potential security holes in to your **firewall** by running all those services. You might not have been introducing security holes in to your **network**, if you were the only one inside your network. But you certainly are introducing vulnerabilities in to your **firewall** by doing that. It just so happens that one has to be inside your network to exploit them (if your firewall is otherwise set up correctly, which I have reason to doubt).

Re:OS?

[TaoJones]

The services I mentioned were internal services, meaning they have nothing to do whatsoever with the outside world.
A caching DNS server does connect to the outside world. A time server (unless you have an atomic clock in your basement) connects to the outside world.

Re:OS?

[upside]

Because you can get a cheap high performance box without user limitations of "hardware" firewalls. For example, I replaced a SonicWall SoHo 2 which had a 20 or 30 user limit with Mandrake Multinetwork Firewall. Same goes for VPN user limits. Also you get superior logging, routing between multiple (3+) networks, built in proxy and NIDS etc etc. The only downside is you've got a hard disk to worry about which isn't an issue in solid state boxes like the SonicWall.

BTW, the "hardware" firewalls from Nokia are just Celeron-based PCs running a modified version of BSD (FreeBSD?).

Re:OS?

[Anonymous Coward]

It's not a good idea to run such service like DNS, DHCP, Fileserver, NTP, on a firewall box.

I really prefer (when i can) use a dedicated box for the firewall

Re:OS?

[stanmann]

If you are running windows, the culprit is your machine, and that is why I still run kerio even after configuring my smoothwall.

All my network machines are running Winnt of some flavor or other... for gaming... so... I must run windows... winnt 5 likes to call home.. and chat... I don't like that...

Re:OS?

[BlackHawk-666]

So many reasons:

Smoothwall is free and runs on outdated hardware

It works and is secure

It can support a red, green, and many orange zones

You get QoS (traffic shaping) - follow my tutorial to get it running

Graphs of traffic usage

It never crashes

Logging

Intrusion detection

Proxy server (squid)

Cacheing DNS Server

Ability to add hosts entries to DNS server

Web based interface

It's cool!

I have used Smoothwall for 2.5 years now and love it. It runs on the shittiest pentium 90 machine I could find, has three network cards, operates a DMZ for me, provides VPN and QoS. The machine is almost silent, cost me nothing, and does what I need. What more could a guy want?

Re:OS?

[BlackHawk-666]

So true, they make *outgoing* connections to these services on reasonably secure protocols. They do not allow *incoming* which is where you are most likely to get a security issue. That's the big difference.

Re:OS?

[Anonymous Coward]

Yes, that's a good point. But the software firewall running on your machine should be able to block that just as easily as a hardware firewall does. Also, I think you should be able to disable the Windows services that automatically contact MS. Search Google for something like "disabling services" and "windows".

Re:Only safe bet is...

[Anonymous Coward]

So do you not wipe your ass after crapping because it's just going to get dirty again?

Crude analogy, but it's the same thing.

I use the forked IPCop

[Ridgelift]

I used to use smoothwall, but switched to the forked project IPCop. Some of the original developers forked away from smoothwall because of the founder's desire to mix open source with a business model that conflicted with the project. I was having problems with smoothwall and updates, which prompted me to switch to IPCop. I've been happy ever since.

Anyone else got opinions on Smoothwall vs. IPCop?

Re:I use the forked IPCop

[Anonymous Coward]

IPCop does have a faster upload speed for USB ADSL on BTOpenworld
(30Kb/s for IPCop, 3Kb/s for Smoothwall GPL). The IPCop team have updated
the driver, whilst the Smoothwall GPL version does not have the driver
update. Of course you can pay for the Smoothwall Home version if you want
the faster upload.

IPCop uses ext3 journaling filesystem, whilst Smoothwall GPL uses ext2.

The next version of IPCop, 0.2, will be more of a radical departure from
Smoothwall. Currently IPCop 0.1.1 is much the same as smoothwall GPL

Oh and IPCop is GPL and being actively developed, were as Smoothwall GPL is
backing a back seat to the Home and Corporate versions, i.e. new features
are being added to the Home/Corporate version and *maybe* back ported to
Smoothwall GPL.

neuro said that...' there are cool things in
the works for GPL, and some of the corporate proprietory stuff may be
backlicensed to GPL in the future.'

Richard is pushing for the money right now, not that I blame him. Though
using Smoothwall GPL means that one was much of a beta tester for the Home
and Server base versions.

Re:I use the forked IPCop

[theonlyholle]

well, since Richard Morell has left Smoothwall now, things have become much nicer again. Originally, they didn't even want to do another version of their GPLed Smoothwall... I'm quite happy they changed their mind. Although I miss the rude way that Richard used to treat his customers and fellow developers on the mailing lists... ;)

Re:I use the forked IPCop

[wpanderson]

I'll try and answer this as best I can ...

IPCop does have a faster upload speed for USB ADSL on BTOpenworld (30Kb/s for IPCop, 3Kb/s for Smoothwall GPL). The IPCop team have updated the driver, whilst the Smoothwall GPL version does not have the driver update. Of course you can pay for the Smoothwall Home version if you want the faster upload.

This refers to a long-old version of SmoothWall GPL and the Speedtouch driver - both SmoothWall GPL 1.0 and SmoothWall Express 2.0 have no problems with USB ASDL upstream.

IPCop uses ext3 journaling filesystem, whilst Smoothwall GPL uses ext2.

SmoothWall Express 2.0 uses ext3.

The next version of IPCop, 0.2, will be more of a radical departure from Smoothwall. Currently IPCop 0.1.1 is much the same as smoothwall GPL

This shows how old the parent post is, information wise. IPcop 1.4 alpha/beta still bears a lot of resemblance to SmoothWall GPL 1.0 / Express 2.0.

Oh and IPCop is GPL and being actively developed, were as Smoothwall GPL is backing a back seat to the Home and Corporate versions, i.e. new features are being added to the Home/Corporate version and *maybe* back ported to Smoothwall GPL.

Untrue - our commitment to the GPL is a firm as always, and new features are constantly being backported from the commercial products into the open source project.

neuro said that...' there are cool things in the works for GPL, and some of the corporate proprietory stuff may be backlicensed to GPL in the future.'

Yes, this has happened.

Richard is pushing for the money right now, not that I blame him. Though using Smoothwall GPL means that one was much of a beta tester for the Home and Server base versions.

Possibly true. We do occasionally deploy features into the open source project to see how they pan out - if they work well, we roll them into the commercial products with proper source attribution where required.

Re:I use the forked IPCop

[Anonymous Coward]

Grandparent is 2 year old post from usenet. link

Re:I use the forked IPCop

[jazman_777]

well, since Richard Morell has left Smoothwall now, things have become much nicer again.

I looked at Smoothwall a while ago. I picked OpenBSD. Who needs to get harangued by Morell? Theo de Raadt is simply a saint by comparison.

Re:I use the forked IPCop

[Anonymous Coward]

heh... i was one of those lucky enough to be kicked from good ol' Rich's mailing list after pointing out his whining.

i won't bring up the entirety of the argument but it seems others here were quite aware of it too.

i will say that i am glad the developers were able to continue, both with the original line and IPCop. They make a great product.

i'll probably try IPCop but i now feel better about telling folks to use Smoothwall knowing that Richard is gone.

kevin

Re:I use the forked IPCop

[Anonymous Psychopath]

I too switched from Smoothwall to IPCop after an, um, interaction with Morell. Although Smoothwall is a good product, IPCop is equally good (if not better), and I've been using it without any problems for quite some time. Frankly, I'd crawl through glass in order to avoid anything with Morell's name on it.

Re:I use the forked IPCop

[Awptimus Prime]

Yeah, I made the same switch. After the developer of smoothwall started acting like a 10 towards anyone that had a question or concern about Smoothwall.

The community, especially /., should consider not supporting the more goulish of developers.

here here and here are some quick links concerning the man's social skills. Do a google search if you like and you'll find thousands of links concerning his poor attitude towards end users.

Aside from that, IPCop is nice because the supporters of it have made a point to be nice to folks when they have questions about the product.

I've been running it for about 1.5 years and have had no troubles. I did hose up the box with a bad IDE cable, but replacing it and running the install CD took about 30 minutes to get things back to normal. If I were in charge of a small IT infrastructure, I'd definitely pick this over the other pre-fab Linux firewalls.

PSA, I have been using *nix for 9 years professionally. I'm well versed in security and can deploy firewalls built from scratch on virtually any platform, I just like the simplicity of a small firewall distro so I can focus my time and efforts elsewhere. :)

Re:I use the forked IPCop

[Anonymous Coward]

Dick Morrell has never been a developer of SmoothWall - he was the co-founder. He left the project a long time ago. Your reasoning is out of date.

Re:I use the forked IPCop

[Awptimus Prime]

Yeah, I just noticed that. Anyway, it still doesn't say much for those that worked with him and defended his actions and they are still around.

Why post AC? Scared of something?

Re:I use the forked IPCop

[Anonymous Coward]

Why do you need an account? Does slashdot karma do something for you?

Re:I use the forked IPCop

[Anonymous Coward]

The people that defended him were usually bullied into it or had not had an attack on themselves. Sooner or later those who come into contact with the evil man realise what sort of person he is and get the hell away. Since he left SmoothWall has got rid of its worst problem.

Scared - yes - of abuse from him.

Re:I use the forked IPCop

[Anonymous Coward]

He 'left' eh? I heard he was kicked out for being abusive to customers, potential customers, smoothwall team members and probably ltd staff. Best thing those Smoothwall guys ever did was kick him out. His site is so full of lies and crap about him knowing jack shit about anything technical. The idiot is never going to get a job again or will lose it withing days as he is a technical fool or they will find out what a prick he is. He should be put in a mental home for the psycotic. Best he can do is sweep the roads. 'manage' - he could not manage his way out of a wet paper bag unless there was someone to cajole into doing it for him for which he would then take the credit.

Re:I use the forked IPCop

[gnu-generation-one]

"Anyone else got opinions on Smoothwall vs. IPCop?"

They should write that on the bottom of fireworks, in place of the traditional "light blue touchpaper and retire"...

Re:I use the forked IPCop

[Awptimus Prime]

You make it sound as if he beat them with sticks.

I dunno..

[grub]

Using an old Pentium with two NICs for this is great, but the $699 licensing fee is a bit steep. Better stick to OpenBSD..

Re:I dunno..

[Anonymous Coward]

troll?!?!?! That is 2 funneeeeeee

Re:I dunno..

[barc0001]

Use IPCop instead. I do. I tried both, but I prefer IPCop. And it's free

Re:I dunno..

[Anonymous Coward]

OpenBSD isn't free?

Re:I dunno..

[iggymanz]

Darl said he is going after BSD next year, but maybe the license fee for that will be cheaper if he's in a good mood.

Re:I dunno..

[raodin]

Since you obviously missed it.. Its a shot at SCO's 'linux licensing' for $699 that got so much press a few months ago.

alternatives

[kayen_telva]

IPCOP is an alternative (fork) of the smoothwall project. they do a nice job as well. thanks to both groups. Ive been relying on IPCOP for years.

Can't wait to try it out.

[Tha_Big_Guy23]

I've been using version 1.0 of their firewall for just over a year now, and I have to admit that it is a rather good firewall. I was able to load it on a p100 box with only a 540MB hard drive. Granted with a hard drive that small, my firewall doesn't do alot as far as web cache is concerned, but otherwise it operates great. The patches are easy enough to install, all you have to do is download the gzip from the patches page built into the firewall web client. Upload the gzip's and they're installed.

Managing the firewall is exceptionally easy as well. You can setup port forwarding to internal computers in under 30 seconds. All-in all the firewall takes the major annoyances out of running a firewall. I highly recommend it for anyone who's got an old system lying around, and doesn't have the time to bother with setting up a firewall.

Re:Can't wait to try it out.

[Anonymous Coward]

I've been using the 2.0 beta releases for about six months now, and I have to say I'm extremely impressed.

Oh, and I'm running it on and old i486-100Mhz / 32M RAM / 500M hard drive. Works beautifully.

Re:Can't wait to try it out.

[Anonymous Coward]

all this talk about HDs, in the 500 and up range. U have no idea about picobsd then. The point of using old hardware in my mind is ditching that old whiny HD. Run that shit off a 1.4MB floppy and a ram drive, u know, mount_mfs. fbsd talk.

anyway freebsd.org : google: picobsd

Re:Can't wait to try it out.

[Derf_X]

I was using Slackware on a 486 with 8 MB and a 400 MB hard drive last year. It ran Apache, ProFTPd, dhcpd, ssh, and gShield as firewall software. gShield is pretty easy to set up (one or two files to edit). Sure it does not do web caching, but is it really necessary?

I tried smoothwall then switched to ipCop

[lww]

ipCop is a fork of the smoothwall source that has more of an open source community behind it. Personally, I found the whole "Buy Smoothwall Now!" experience just a little too annoying to use.

But, let me be the first to say that I love the concept behind this type of distro. A boot-cd and 20 minutes turns any old wintel machine into a damn god firewall appliance (one that has a shell!).

Re:I tried smoothwall then switched to ipCop

[wpanderson]

> Personally, I found the whole "Buy Smoothwall
> Now!" experience just a little too annoying to use. ... something we try hard not to do these days so as not to alienate folk. Yes, we'd love it if everyone who used the open source version bought the commercial version, but the real world doesn't work that way. That's why a lot of the banners and stuff from 0.9.9 aren't in 1.0 (when fully patched) or 2.0 (out the box).

Re:I tried smoothwall then switched to ipCop

[theonlyholle]

yeah, for some time they were really annoying, it seems that mainly Richard Morell was driving them that way. If you look at the pages now, you will see that they are actually called " The Smoothwall Open Source Project" - that's a lot different from the "yeah, Smoothwall GPL is our stripped down version of a commercial firewall package" attitude they had a year ago.

Re:I tried smoothwall then switched to ipCop

[DroopyStonx]

Surely a firewall applicance that damns god can't be that great... can it?! ;)

Re:I tried smoothwall then switched to ipCop

[lww]

That's fair, my perception is definitely dated to the time I was looking at the distro v0.9 I think. At this point I'm not in the mood to muck with picking another firewall distro ("If It Aint Broke..."), but if ipCop breaks or doesn't keep up or otherwise forces me to start looking again, I'll definitely give Smoothwall another chance.

Re:I tried smoothwall then switched to ipCop

[lww]

Ha! If it saves me the trouble of doing it...

Seriously, I swear it said "good" during the preview. Must be another slash-bug ;)

Re:I tried smoothwall then switched to ipCop

[mariox19]

Well, if God wanted us to have a firewall, we would've been born with them!!!

Re:I tried smoothwall then switched to ipCop

[Anonymous Coward]

We are, it's called ipchains..

Of course, by 'we', I mean Linux 2.4-based robots like myself.

Re:I tried smoothwall then switched to ipCop

[gilgongo]

I tried both and went with IPCop simply becuase I found it easier to use and it seemed to have more features. That was about six months ago though.

Re:I tried smoothwall then switched to ipCop

[Anonymous Coward]

"We are, it's called ipchains..

Of course, by 'we', I mean Linux 2.4-based robots like myself."

You must mean IPTables?

Re:I tried smoothwall then switched to ipCop

[Anonymous Coward]

You must mean IPTables?

Or maybe he meant to say he is a Linux 2.2-based robot.

new?

[oohp]

And this is new how? There are dozens of firewall distros out there, does SmoothWall have anything special or innovative?

Re:new?

[LittleLebowskiUrbanA]

Yeah, it's special in that a LOT of people are running it as evidenced in the comments for this story.

Re:new?

[PReDiToR]

Every article that gets selected for the front page has a post like this,
Why is this news?

Because people have too much time on their hands and will read any old shit, I guess.

If you DGAF about SmoothWall or its releases, why click the article, and why take the time to reply?

If you notice, some people here actually enjoy posting about SmoothWall, IPCop, Richard Morrell, all the rest of the stuff here.

IHBT, yes, I'll HAND, but I think I won this one (if one can ever win a trolling, even one that some dumbass modjockey modded insightful).

Re:I downloaded Linux

[Anonymous Coward]

I couldn't agree more. With XP's firewall, I'm able to completely lose all access to the internet. I never have to worry about getting infected with virii, because they have no chance of being downloaded on my bulletproof machine.

I wonder when the rest of the OSs of the world will realize that XPs new focus on security first is the way to go.

Re:I downloaded Linux

[dasmegabyte]

Is there a -2, Obviously Retarded?

Great protection

[Spackler]

This thing is great. It is preventing my unauthorized slashotting attempt.

Astaro

[Anonymous Coward]

That's what a Linux firewall distribution is all about. :)

IP Accounting

[Anonymous Coward]

Great to see another firewall solution maturing. Congrats to the developers!

I've always hoped that someone would write a turnkey network/Internet authentication and user IP accounting app (no way do I have the skill at this time). Something that would create an IP table entry when a user authenticates, and track the Internet usage of their machine. Even better, it would be great if I could create a fake network interface for accounting, one which is associated with just one authenticated user, so I could measure each user's actual usage, rather than all the usage for the one machine. This is useful when you have more than one user logged in to a machine at a time, sharing the same NIC, or if there's other processes using bandwidth. Something that had Linux, Windows, OS X, etc. clients too... Impossible?

Re:IP Accounting

[Anonymous Coward]

Whatever, what's with your damn fixation on snooping, ya some kind of pervert?

Re:IP Accounting

[pturley]

www.rocksteady.com
Our software does most of what you've described here. We dynamically authenticate users and construct/destroy firewall rules as they enter/exit the system.
</shameless>
I could go on, but I dislike spamming people with information they haven't asked for. If you'd like to know more, you're very welcome to visit the site.

Re:IP Accounting

[Anonymous Coward]

Nope, network admin wanting to provide a reliable quota system for company employees. We don't care what, we just care how much...

Re:IP Accounting

[Homology]

I've always hoped that someone would write a turnkey network/Internet authentication and user IP accounting app (no way do I have the skill at this time). Something that would create an IP table entry when a user authenticates, and track the Internet usage of their machine.

OpenBSD has this via authpf, or if you prefer, here is an authentication done via web browser : phpauthpf

Re:IP Accounting

[Anonymous Coward]

Smoothwall has ipac-ng, so you can easily do bandwidth tracking per PC with Smoothwall.

Re:Only safe bet is...

[Anonymous Coward]

I stopped wiping mine back in '92.

It's solved a lot of problems. I used to have difficulties relating to people. Now that they avoid me entirely, I no longer feel inadequate due to my social skills, I know it's because my pants are full of crap.

Google to the rescue

[Hal The Computer]

Cached:

• Main Page
• Download Page
• Release Notes aren't cached, sorry.

Re:Google to the rescue

[elmegil]

Thank you, someone should mod you up further.

However, looking at the cache for the about page, there's one thing that isn't clear. How does this compare to floppy-based distros like Coyote? In particular, it says absolutely nothing about whether it does or does not require a hard drive. Noise and heat are big considerations for me, and a HD is one of the biggest sources of both....So can I run Smoothwall without a HD or CD?

Re:Google to the rescue

[EverDense]

Noise and heat are big considerations for me, and a HD is one of the biggest sources of both....

Its a FIREwall; it takes care of the heat for you.

Re:Google to the rescue

[Daemonik]

It's really hard to run Snort from a floppy distro.

Also, think about it, if the distro is a 33mb ISO chances are damn good that it won't install to a floppy.

Re:Google to the rescue

[PReDiToR]

It installs to about 250MB.

Noise shouldn't be a problem with old hardware, they only need one fan usually, and someone posted earlier about using a laptop drive for it.
This is a great firewall, the ease of use factor is out there with anything you can find. I've played harder Commander Keen levels.

Re:Google to the rescue

[elmegil]

I'd say Coyote is pretty darn easy too. And no HD or CDROM to worry about. I don't have even ONE fan in that box right now, and it's been running continuously for 3 years. On the other hand, if this could have been run on that box I would have considered whether to switch. C'est la Vie. 250MB is bigger than I want right now.

To start with...

[HoldmyCauls]

Higher levels of configurability, maintenance, ability to audit the code, possibilities for adding other server capabilities...

Someone else continue this thread, please, I'm bad at this...

Here are the release notes.

[EinarH]

/.'ed

SmoothWall Express 2.0

SmoothWall Express 2.0 was released at 21:00 GMT on Monday 8th December 2002.

http://www.smoothwall.org/

** Please see http://smoothwall.org/ for the latest release
** information, downloads and updates!

SmoothWall Express 2.0 Release Notes

** Please note that the https web access port has moved from
** TCP/445 to TCP/441! Use https://x.x.x.x:441/ from now on!

Changes from SmoothWall GPL 1.0:

* SmoothWall GPL is now SmoothWall Express!
http://community.smoothwall.org/topic/1086

* Stateful packet inspection using Linux 2.4 kernel with iptables
and netfilter.

* Improved installer:

- Network card skip.
- Displays MAC address of detected cards.
- Prefilled IP addresses.
- Configure upstream web proxy for fetching update list.
when a direct connection cannot be made or is not allowed.

* Improved web user interface; more user friendly, better error
reporting, more orange :)

* Improved connectivity device support:

- More USB ADSL modems; ECI chipset, USR SureConnect.
http://smoothwall.org/beta/eci.html
- BeWAN PCI ADSL.
- BT Home Highway USB TA.

* Universal Plug-n-Play support for Microsoft Windows XP users.

* Improved network usage graphs with RRDtool.

* Improved proxy performance through diskd and other squid tweaks.

* Static assignments in DHCP server options based on MAC address.

* SmoothWall time sync with internal or external NTP server. Can
sync from a built-in list of servers. (Does not provide ntpd
service to Green or Orange network however)

* Configuration backup to floppy disk for quick install on another
machine, or re-install on same machine (compatible with backup
floppies from Express 2.0 RC1, timesync server list bug when
using backup floppy from Express 2.0 beta7 "pendolino" - see
http://community.smoothwall.org/topic/2180 for more info)

* Simpler port forwarding; no need to open ports with external
access page, the port (or ports - port ranges are allowed now)
is opened and forwarded on one page.

* IP Blocking feature; block any given internal IP address or
subnet from accessing your SmoothWall or any port forwarded
hosts. Additionally, blocking rules can be added from the
firewall log interface.

* Advanced networking features; block ICMP ping, block multicast
traffic and enable SYN cookies.

* Improved VPN; no need for "next hop" setting, optionally enable
compression on the tunnel, still possible to connect to a
SmoothWall GPL 1.0 VPN.

* Perform network diagnostic (ping, traceroute) from web interface.

* New Java SSH client (replaced due to licence conflict).

* Added clear cache option to web proxy.

* Updates list location changed
http://updates.smoothwall.org/express/2.0

Thanks to those on the team and the forums for their hard work on
mods and patches :)

-----
Rebooting
-----

During the reboot, notice the nice boot screens. :)

You will notice differences if you use either the ECI or the USR
SureConnect USB ADSL modems.

For all USR ADSL modems, have the unit plugged in prior to booting.
If you are using an ECI-chipset driver (generic of FDX310), you will
see your screen fill with diagnostics as the firmware is uploaded and
the line synced. Occasionally this can appear to hang part way
through, but it should not stall for more then 30 seconds at a time.
The line should be synced when this process is complete.

The USR SureConnect will behave in a similar fashion, but with less
diagnostics.

---

Re:Only safe bet is...

[Anonymous Coward]

That doesn't sound half bad

Smoothwall support

[DaveJay]

Congratulations to all those who made Smoothwall's latest release possible.

Based on personal experience, I highly recommend that anyone planning to use, donate to or purchase support for the Smoothwall product first research the company and primary members of the development team, such as founder Richard Morrell, before making a committment. Of course, that's a good idea under any circumstances, with any software product. :)

Personally, I use the Mitel SME Server distribution (formerly e-smith) for my needs, but the feature set is somewhat different and it may not be a good fit for you. The community of users supporting users, however, is a great assett to the SME server project.

Re:Smoothwall support

[Anonymous Coward]

Yes, make sure you donate first, otherwise Richard Morrell and friends will treat you like a total leach and leper, for even considering using it without paying.

Hey, I think I have coined a new term - Guiltware

Re:Smoothwall support

[wpanderson]

Please note the following caveat before researching anything about SmoothWall - Richard Morrell has left the company and the project.

Re:Smoothwall support

[wpanderson]

There's no requirement to donate or anything of the sort. If you'd like to purchase the company's commercial software, that's great, but the point of open source is that it's open, free, and libre :)

Please don't perpetuate stale attitudes!

Re:Smoothwall support

[Anonymous Coward]

LOL, research like you did? NOT. He left at the beginning of the year.

Re:Smoothwall support

[DaveJay]

I hope that it didn't appear I was suggesting donation or purchase was required, as that wasn't my intention at all. The project is, indeed, open source, with all that it implies.

As to Richard Morrell's leaving the project, thanks for that piece of information. I personally find that extremely useful, and will be reevaluating smoothwall shortly. :)

Re:Smoothwall support

[Anonymous Coward]

It's a good thing he left to.

I had a problem with USB and the Speedtouch USB Modem. the hardware worked fine under windows & the USB card worked under other distro's.

I said that while asking for help on their IRC server / channel only to get banned by Richard Morrell.

Probably a bad move as I'm a Senior Linux admin at a large hosting company in the UK. When asked about a firewall distro I've said avoid this one if you ever need support.

Re:Smoothwall support

[nmg196]

We bought a license for SmoothWall, tried to get it to work, contacted support, experienced Richard Morrell, promptly binned the product and decided that spending any amount of money was better than having to talk to Richard Morrell. So we bought a competitors product and have been fine ever since.

His absence probably makes the product worth looking into again.

I had a job interview with these people

[palfreman]

I had a job interview with these people earlier this year. Actually they are all fine and very friendly - contrary to their public perception (in the opinion of the guy who interviewed me). And I thought so business stratergy was basically sound - to have a less featureful open source product, and to have a licenced extra-feature product aimed at the commercial and managed-system customer.

Anyway, I didn't get the job with them, although I did find another *nix job much to my relief. I wouldn't use this myself though - IMO an experienced admin should take a minimal install of his favorite generic Linux/BSD distro, and build from there. Smoothwall is good for the less experienced though, who need an out of the box solution right now, not after 6 months googleing :-)

Re:I had a job interview with these people

[Daemonik]

IMO an experienced admin should take a minimal install of his favorite generic Linux/BSD distro, and build from there. Smoothwall is good for the less experienced though, who need an out of the box solution right now, not after 6 months googleing :-)

No, a junior admin should take the time to build a firewall from scratch.

An experienced admin is much too busy playing Nethack and downloading pr0n from his bosses logins while running a couple of Quake servers off the company T1 to devote that kind of time to a project.

Re:I had a job interview with these people

[Awptimus Prime]

Amen to that. It's nice to see someone else who has experience but still uses 'n00b t00lz' that do their job well so that we have more time to frag.

Save your leet admin attitude for the stuff that brings in the bacon. Leave the trivial stuff to those who do it best.

Re:I had a job interview with these people

[PReDiToR]

I read this with a +4 Insightful.
Good moderating. Any old fool could have modded it Funny, but we know the score, right?

Developer issues/fork

[Anonymous Coward]

I believe part of the issue was not with his distribution model, but if anyone has talked with the main developer personally, you would know he has quite an attitude problem. While in the smoothwall IRC room, I would advise not asking any questions unless you donated some money or he will go off on a tangent about how you haven't given anything to him. I believe his name is "Dick" as well. Just a word of advice, I would rather go with Astaro.

Re:Developer issues/fork

[dang-a-pin]

I might say the same thing if I was not building and supporting a free firewall. I have been RTFM'd by the best of them , but these guys mean business and so a good job for an easy-to-install, solid piece of software. In other words, if you have a question, you'd better have a real problem, not simply a need to learn usage. It would be different if these guys were a bunch of dumbasses, but they make a decent firewall.

So really, if you want to use Smoothwall, better read hard or get a thicker skin somewhere. Perhaps that's good advice for the rest of us anyway.

Re:Developer issues/fork

[jazman_777]

So really, if you want to use Smoothwall, better read hard or get a thicker skin somewhere. Perhaps that's good advice for the rest of us anyway.

But Morell was in a league of his own. Most rude types are simply rude. Morell was the strutting peacock of rudeness amongst a rabble of sparrows and starlings.

Re:Developer issues/fork

[Anonymous Coward]

Dick hasn't been involved with Smoothwall for quite some time....

Re:Developer issues/fork

[throwaway18]

>I believe his name is "Dick" as well.
Yes, he uses that name. The subject of internet connection sharing came up on my local linux usergroup mailing list. I suggested a cheap NAT router on the grounds of noise (no fans or whirring drives). It's a friendly local discussion list and I was a bit shocked to get a flaming rant from Mr Morell in response.

Re:Developer issues/fork

[91degrees]

Well, there's rudeness, and there's rudeness. This is what Richard said to one person concerned about security issues (i.e. storing plain text passwords)

1) you arent a customer
2) you're a muppet
3) I deserve the respect - I earnt it - you don't


Sure, this is only a sample. It's indicitive of his attitude though. It's not just against people who don't read the manual. He had a lot of hostility towards people who point out security flaws.

While we're at it, there's no need for his sort of hostility for people who don't read the manual. Simply pointing out that it IS in the manual is sufficient.

Re:Developer issues/fork

[Anonymous Coward]

Is the Smoothwall Project going to be stained with the dirt of dick? Dammit people. He's been gone for nearly a year!

Worth a try.

[Anonymous Coward]

It's a really nice product now.

Once upon a time I wouldn't go near it - one of the original founders was a real rude little shite and a huge liability to the project. And when I say rude, I mean rude - he used to tell potential or even existing customers to fuck off on a fairly regular basis, and that was when he was being polite!

Only his small circle of friends stayed on the IRC support channel - anyone else got kick-banned without even saying a word (either party).

Basically he used the wrong license, as in the end he seemed to detest the GPL and the "freeloaders" that were "stealing" copies of "his" work (perhaps he was the inspiration for SCO, huh?)

Thankfully he fucked off. It a nice project now, supported by nice people! Give it a try.

The title is misleading

[Anonymous Coward]

I thought someone was actually using the 2.0 kernel for something

Re:The title is misleading

[Anonymous Coward]

I'm using the 2.0 kernel for something.

I used smoothwall for a while

[Chunky Kibbles]

And I highly recommended it for many moons.

Unfortunately, the developers really annoyed me. One time, they released a patch that added a splash screen to the web interface that popped up EVERY time you changed page. And set chattr+i on the file on the server, then deleted the {ls,ch}attr commands on the server.

Which was just offensive. I went into their [community] IRC channel and mentioned how to fix it, and was kickbanned.

They make a big thing about being GPL and community-friendly, but in practice I just find them offensive.

I cannot highly enough recommend that people don't use this, and use ipcop instead.

Gary (-;

Re:I used smoothwall for a while

[wpanderson]

And I highly recommended it for many moons.

Thanks! :)

Unfortunately, the developers really annoyed me. One time, they released a patch that added a splash screen to the web interface that popped up EVERY time you changed page. And set chattr+i on the file on the server, then deleted the {ls,ch}attr commands on the server.

That patch was pulled very quickly after the backlash, and nothing of the sort would ever be contemplated again. Ever.

Which was just offensive. I went into their [community] IRC channel and mentioned how to fix it, and was kickbanned.

This sort of offensive behaviour does not happen anymore.

They make a big thing about being GPL and community-friendly, but in practice I just find them offensive.

I'm sorry to hear you were mistreated.

Re:I used smoothwall for a while

[Chunky Kibbles]

See, here's the thing; there's enough choices out there that nowadays I tend to have a "one strike and you're out" policy for a lot of software.

Don't like distro XX? Use a different one.
Don't like firewall softare YY? There's more available
Don't like mail server ZZ? No-one else likes Qmail, either.

I used to be a huge RedHat proponent, then they released 7.0, and I quit using RedHat.

The behaviour of Smoothwall once was so spectacularly bad [and I mean SPECTACULARLY], that I simply can't trust Smoothwall ever again, no-how, no-way. To the point where I'll actively encourage other people to avoid it also. Redhat is on my list of distro's I recommend newbies try, although I don't like it for my own personal use. Smoothwall is on my shitlist for the rest of time.

And since there's other, just-as-good-if-not-better choices out there, I see no reason to use Smoothwall.

In all seriousness, what benefits do I, a normal user, gain from using non-commercial smoothwall [with hopelessly untrustworthy developers] over using somethign else like IPCop?

Gary (-;

Re:I used smoothwall for a while

[Anonymous Coward]

"I went into their [community] IRC channel and mentioned how to fix it, and was kickbanned."

By dickmorrell - I'm certain. Lead developer and joint founder at the time, and a complete asshole. (He tried to use GPL as a shareware model and got REALLY pissed off when people wouldn't buy the "full" version)

He's left now, though, and the remaining team are really nice guys. It's a true open source project again. All water under the bridge, don't let their past put you off :)

Re:I used smoothwall for a while

[Trogre]

Now that Richard Morrell (the projects founder and by far the worst troublemaker) has left the project, things might not be as ugly as they once were.

Does anyone know whatever came of Mr Morrell? Perhaps Microsoft hired him.

Re:I used smoothwall for a while

[Mr2cents]

I agree with you. In fact, I go even further. I never use any commercial distributions any more (Smoothwall is not a 'firewall operating system', it's a specialized distro). The software is free and so should be the distribution. If there is anything I want to spend money on, it's not more features, it's support. But then again, I can solve my own problems most of the time.

IMHO, the problem with commercial distributions is that at some point in time they will need more cash and will try to squeeze it of of their users. Volunteer projects don't suffer from this kind of "strategic decisions".

Re:I used smoothwall for a while

[Cloud K]

He seems to be working on "new projects" (solo by the sound of it) going by his slightly ranty website at dickmorrell.com

I'll be sure to avoid them!

Note he makes a point on the site of pointing out his remaining ownership of the Smoothwall copyright despite the fact that he resigned. What that means I don't know, but it smells very SCO-ish. He's an asshole of similar caliber to those guys.

Re:I used smoothwall for a while

[91degrees]

Note he makes a point on the site of pointing out his remaining ownership of the Smoothwall copyright despite the fact that he resigned. What that means I don't know,

Reading through posts on linux usenet groups, I get the feeling he has verypoor understanding of how copyright works.

Re:I used smoothwall for a while

[Anonymous Coward]

This is great information. Maybe it should be in an "Open Source Hall of Shame" that could be a clearinghouse for users to see which products they should be wary of.

Re:I used smoothwall for a while

[Chordonblue]

"Reading through posts on linux usenet groups, I get the feeling he has verypoor understanding of how copyright works."

Oh. You mean like Darl McBride and SCO. ;)

Re:I used smoothwall for a while

[Anonymous Coward]

Why are people calling dick morrell a 'developer'? He was a co-founder. Not a developer.

Re:I used smoothwall for a while

[ScrewMaster]

No, he and Darl are forming a new company, called SmoothScrew GPL, to advance the ongoing attempt to stick it to Open Source.

Re:I used smoothwall for a while

[Anonymous Coward]

You wrote:

Does anyone know whatever came of Mr Morrell? Perhaps Microsoft hired him.

No such luck. And he's still flaming away, as usual. Since he parted ways with SmoothWall it looks like he really has it in for them:

Time to start kicking SW's butt out the park big time. This is personal.

Alan's WiFi, Dang's interface and some of the cool stuff in CVS should piss all over SW GPL 2.0.

Posted by richard at August 22, 2003 10:24 AM

FWIW on his site I found this interesting page:

July 17, 2003
IPCop vs SmoothWall - Stats

Was talking in the wee hours to my friends at Sourceforge on the phone. Talking about the changes since Adam Frey finally left VA and the topic was brought up of IPCop vs SmoothWall. Wasn't malicious just a query "why has SmoothWall traffic died a death ?". I didn't have the answers to their question but it was weird to find out from the horses mouth that there are now more than 23 times the number of downloads for IPCop than there are for SW GPL (both versions), that there are on average 15,000 more visitors per day to the download pages for IPCop than SmoothWall and that for every four visitors to SmoothWall, three then click through to IPCop and download 1.3.0.

Linux Magazine is this month running a three page professionally written article on IPCop which I read when my subscription copy came through the door. No doubt new ver GPL 2.0 will get press coverage if SW have garnered Linux Format and PCPro into carrying it (hell I even made the calls to Nick Veitch in March so I know it will - I started the ball rolling).

It's interesting now that the sensible money now follows IPCop. The numbers totally back this up.

Morrell also says this: "The GPL isn't legal in the UK where SW is published."

His November diary page has this gem:

With the release of IPCop 1.4 there will be no value add proposition to buying SmoothWall product or product from other companies as 1.4 is essentially everything a corporate needs to firewall, VPN and protect its users. That dramatically reduces any and all benefit SW product can muster on the market.

Re:I used smoothwall for a while

[PReDiToR]

Almost, except that
"very poor understanding of copyright" != "spawn of satan"

Re:I used smoothwall for a while

[wpanderson]

I had to laugh when I read this:

it was weird to find out from the horses mouth that there are now more than 23 times the number of downloads for IPCop than there are for SW GPL (both versions), that there are on average 15,000 more visitors per day to the download pages for IPCop than SmoothWall

The reason there aren't click-thrus from the SmoothWall project page on sourceforge is because we don't use those links or that page to generate downloads. The bulk of our downloads come from our download page (at the moment suitably lightened in weight to combat the /. effect), whereas that other firewall distribution uses their Sourceforge project download page (or 'Files' page) almost exclusively to host downloads. This is why that other distribution appears to get hundreds and thousands of downloads, while SmoothWall appears to get a mere handful through Sourceforge. The ~ seven million hits and 300-400 gig of bandwidth we chew through every month (with half a million hits and 250 gig of those being hits to download.smoothwall.org), coupled with the fact we use other mirrors in addition to sourceforge to host our files, suggest to me that using sourceforge to gauge our overall popularity and download counts is a flawed strategy at best.

and that for every four visitors to SmoothWall, three then click through to IPCop and download 1.3.0.

How can someone "click through" to another project site directly when there's no direct link between them? Incidentally, from what I can tell, the huge number of hits to that other distribution's sourceforge stats is due to their inclusion of the sourceforge stats-collector logo in their web interface, thus generating thousands more hits for their project while people administer their firewalls. Cute, huh?

As for the final comment, if this were the case, how could any commercial security vendor survive? There will always be a market for boxed product, while the degrees of openness within such product will invariably differ from product to product, market to market, and over time.

Re:I used smoothwall for a while

[Reziac]

Maybe he's angling for a job at SCO ;)

linksys box?

[Anonymous Coward]

A rather newbie sounding question but can anyone explain solid reasons to use this instead of the standard linksys firewall that comes with the router? Note that I'm talking about a home user with less critical requirements than a business.

Re:linksys box?

[RatBastard]

If you have an old PC with two NICs and don't want to buy a Linksys box. Or, if you want more control of your system and need SSH. The Linksys boxes do a pretty good job and work for most people. Some people want more control and power. That and some people just like building their own.

Re:linksys box?

[Anonymous Coward]

I think all and all its more secure. If theres an exploit with linksys then its much more well known than if ipcop, or smoothwall had one. seems that everyone and their brother has a linksys router.

Re:linksys box?

[Hayzeus]

A rather newbie sounding question but can anyone explain solid reasons to use this instead of the standard linksys firewall that comes with the router? Note that I'm talking about a home user with less critical requirements than a business.

I used to use a Linux box for firewalling/masquerading and had to switch to a LinkSys because of DHCP issues with my broadband provider. One big advantage of the Linux setup was the additional functionality offered by the IP masquerading helper modules; stuff that couldn't normally be masqueraded (CuSeeMe comes to mind) could have "helper" kernel modules that allowed traffic to be masqueraded properly. You could also do web caching to disk on the same machine -- obviously not possible with the linksys.

Re:linksys box?

[Anonymous Coward]

i had a linksys device once. It also did NAT. Well, since i use freebsd on the lan, i would ssh out through it to a diff freebsd machine. I would come back the next day, and all my ssh connections were dropped. These small devices dont do NAT like a full blown freebsd machine does. It has fucked up timeouts for things we take for granted. That is why i marked it as defective and used it at a customers site who needed a small switch/firewall/thingy

Non-intel

[shystershep]

Anyone know of anything comparable for old Macs? My father-in-law gave me an old PowerPC that I hate to throw away, but don't have any real use for.
Thanks.

Re:Non-intel

[nestler]

OpenBSD or NetBSD could probably run on it.

OpenBSD is a better firewall (pf is very nice), but NetBSD is a bit more portable (in the unlikely event that OpenBSD won't run on it). I think the platform you are looking for is called mac68k or m68k.

Re:Non-intel

[Malk-a-mite]

I know you can run YellowDogLinux on the PPC
http://www.yellowdoglinux.com/

And do routing with it:
http://www.yellowdoglinux.com/support/solutio ns/yd l_general/ethernet_connections.shtml

Not sure if there is a stripped down firewall distro for it yet. If you're up for it you might see what you could put together.

Re:Non-intel

[Anonymous Coward]

Does it have SBus or PCI expansion slots?

If SBus, you won't run any modern Linux kernel on it. Maybe NetBSD would be better in that situation.

But, if it's got 2 Ethernet ports (or can be expanded easily (and CHEAPLY)). It can be done.

Re:Non-intel

[YOU ARE SO SUED!]

You're right, but I think you mean NuBus. SBus is found in SparcStations. I was discouraged from trying a different OS on my NuBus Mac for the lack of OS's that supported it. If your mac is PCI you're in luck!

Re:Non-intel

[BlackHawk-666]

Perhaps you'd like to expand on this statement. Can you tell us why Open BSD is better. I know it has Packet Filter, but I also know a friend who has had enormous issues with it and he just told me today his PF on a P90 can't handle all the traffic across a home ADSL connection. Basically, I'm just interested in why OpenBSD is a better firewall (not starting a flame war).

Love it for small businesses

[smellystudent]

I look after a few small businesses, and use SmoothWall a lot. They often have an old box sitting around I can use, they can all afford the 180 for the commercial version, and keeping on top of patching it is a point and click operation which takes seconds.

The higher end products (SmoothTunnel for VPNs, SmoothConnect for traffic shaping) are also great value for money.

I've only had to use their support once, for an odd VPN problem, and they fixed it professionally and quickly.

I've been trying to get Smoothwall to work...

[teamhasnoi]

I just can't grasp it. Sure, I RTFM, posted in the forums, etc, but I haven't been able to get a handle on it. The install goes smoothly, but configuring it seems to be anything but slick. It's like the answers just slip through my fingers and I'm left featureless software. I thought the forums would help, but they've been a blank slate with no feedback.

At least there hasn't been any friction with my boss about this. I just hope in the future, they polish up the documentation, rather than gloss over the important parts.

Re:I've been trying to get Smoothwall to work...

[PReDiToR]

This isn't a support group, but what's got you stuck?
The dangerous stuff is all pointed at the RED NIC [80.12.23.34 DHCP ISP]], SmoothWall sits behind that and lets safe stuff to and from the GREEN NIC [10.0.0.254 DHCP server for your internal network].
You can set up SSH to configure it, but remember to use the IP addy or hostname of the server and the correct port [read the documentation for this].

Grab a copy of VMware and run up a test system for familiarisation with stuff like this. Reboots and formatting can be a real PITA when you're doing trial runs.

Well, since the site appears to be slashdotted,

[Anonymous Coward]

can you boot it off CD and just use that (without a hard drive)? Devil Linux is a firewall distro that specializes in just being a bootable CD firewall. You store your config on a floppy and set the floppy's no-write tab once you are set.

Suggestions for hardware?

[Inode Jones]

Long ago I ran OpenBSD with IPfilter and NAT on a 486 box as my firewall.

I now run a LinkSys BEFSR411. Not as secure - it cannot do both SPI and redirect, and it does not do VPN.

Why the switch? I wanted to get away from an old PC with moving parts that could fail, and I wanted the four-port 10/100 switch, which finally gave me the ability to run 100 Mbps between the computers that supported it.

Recent issues with business clients have brought security back to mind, and after looking at the popular canned products (LinkSys/NetGear, etc.) I conclude that the old roll-your-own approach OF TEN YEARS AGO is more secure.

I want a roll-your-own solution (possibly SmoothWall, possibly something else) that runs on the equivalent of LinkSys hardware:

- No moving parts. Preferably not even a fan.
- Flash memory for filesystem.
- Multiple 10/100 ports, preferably independently controllable so you can set up a DMZ, or different rules for different machines.

Does such a beast exist, in a relatively user-friendly form and without being more expensive than the old desktop that would otherwise be used?

Re:Suggestions for hardware?

[JonMartin]

I want a roll-your-own solution (possibly SmoothWall, possibly something else) that runs on the equivalent of LinkSys hardware:
- No moving parts. Preferably not even a fan.
- Flash memory for filesystem.
- Multiple 10/100 ports, preferably independently controllable so you can set up a DMZ, or different rules for different machines.
Does such a beast exist, in a relatively user-friendly form and without being more expensive than the old desktop that would otherwise be used?

Soekris. Check out their net4801. Whack OpenBSD on that and you are pretty much done.

Re:Suggestions for hardware?

[Leebert]

http://www.soekris.com/?

Re:Suggestions for hardware?

[SonicBurst]

While you could always roll your own solution, what you want is essentially all put together here: Mikrotik OS.

You can download the free version, or buy the whole thing installed on an IDE flash disk. You can also buy the flash disk/OS preinstalled on a SBC. Not quite free, but not badly priced either.

Re:Suggestions for hardware?

[crotherm]

The GCT Allwell is a set-top-box type PC that has no moving parts. There are articles on how to use it with linux as a firewall. You can get a box for as little as $300 USD

Re:Suggestions for hardware?

[GirTheRobot]

For hardware I would recommend a VIA C3 mini-atx system (no fan necessary for the slower processors), use aliases on your network adapter, and connect it to a cheap switch; or an underclocked Pentium with a monster passive heatsink and filled with cheap NIC's.

For software run Debian Stable, and use WebMin to administer your firewall (and system). Set up a cron job to "apt-get update; apt-get upgrade" every day. The system will run like an appliance. Stable, reliable, secure. You might have to reboot the thing for a kernel security update once in a blue moon.

WebMin's web interface makes firewall configuration extremely easy (as well as configuration of your entire system). You will only need a monitor to do the initial install of Debian. After that...go headless.

Re:Suggestions for hardware?

[gl4ss]

such beasts are out there, but it's pretty hard for them to be cheaper than 0$ that the old desktop usually costs. one other reason for using old desktop i've found is sheer speed(the cheap fw/nat+switch boxes aren't that hot when it comes to transfer speeds, even the ones that are advertised as 100mbit for the outside connection as well).

as for rolling your own, there's flash hd thingys and some very small pc's with multiple lans. www.gadgetcomputer.com has one such a thing, then there's the via's and others but they all end up costing more than 0$(+nics) of course.

Re:Suggestions for hardware?

[schmoli]

m0n0wall runs on Soekris as well as a PC with just a floppy and cdrom (no loud HDD needed). I've been running this at the office for a few months now and I love it. (FreeBSD based).

Re:Suggestions for hardware?

[jojo80]

Have a look at the Via Epia boards. The slower processors don't need a fan. Also, some boards don't need a power supply, but use a small plug to get their power - laptop like.
You could use a usb stick as your hard drive.

Re:Suggestions for hardware?

[Anonymous Coward]

IPCop can be run on a flash disk and with a low power single board computer i.e. LART etc., this is not a hard project

http://www.traverse.com.au/downloads/ipcop/ipcop _c f_howto.pdf

Re:Suggestions for hardware?

[Anonymous Coward]

Check out the Dlink DI-604. It's feature rich little commodity hardware firewall with four ports (plus a WAN port). It can set up a DMZ and a VPN. You can have different rules for different machines. It's really flexible.

Like you I used to run OpenBSD with ipfilt, when hardware firewalls were in their infancy and were either way overpriced or lacked any but the most basic features. But the hardware firewalls have caught up to open source firewalls running on an average computer, from what I can see, and surpassed them (considering their size, only 5"x5"x1" for the Dlink, and lack of moving parts). I got that little D-Link for work, and it really impressed the hell out of me. Now I'm going to have to get one for home too.

(Requisite Disclaimer: I'm not affiliated with Dlink or any other firewall vendor... I'm just telling it like it is)

Re:Suggestions for hardware?

[Anonymous Coward]

Check out the LIGHT book size PC - can get it fanless, can use DOC or compact flash, has option of three Realtek 10/100 or two Intel 10/100 and one Intel 10/100/1000 ethernet ports.

clicky

I believe you can even get them with DSL modems or 802.11b wireless inside.

OpenBSD

[Zebra_X]

Has been doing this for a long time...

Re:OpenBSD

[amplt1337]

Has been doing this for a long time...

You mean... dying?

Re:OpenBSD

[Zebra_X]

No, it has been used as a "hardend" firewall.

Re:OpenBSD

[Anonymous Coward]

Damn, this got rated 4 on humor? Welcome to grade school, Slashdot. This is called a pun. It is about as sophisticated as rap.

Tip for amplt1337: next time try incoroporating a reference to Microsoft or the Slashdot effect. You'll surely soar to a score of 5 in no time.

Re:OpenBSD

[Anonymous Coward]

Ah. Hardened as in rigor mortis. I get it.

~~~

Re:OpenBSD

[HSpirit]

Using OpenBSD 3.3 on a Pentium 75 {yes, that's a seven and a five with no digit in front) as a firewall for a 4 client small office network. Have been for quite some time now.

I don't see what any special linux firewall distro can offer me that OpenBSD can't - that's apart from a little ease of use for those who are command-line averse, I guess... We don't have any special requirements such as VPNs, proxies or anything like that, but from what I remember from the documentation OpenBSD can handle that, too.

Or am I missing something, here?

Re:OpenBSD

[Zebra_X]

Yes... the fact that these peeps get all exceited when the word "Linux" is attached to something. which was my point when i posted that. :-) OpenBSD is the bomb. I bet this linux distro doesn't send daily security and status reports.

I've also used the IPSEC and Tunneling features of OpenBSD,it took a weekend to create the machine, install the OS and configure the FW and IPSec rules. I'd never done it before - says alot about the quality of the OpenBSD's warez.

Multi Network Firewall

[joestar]

There is also MandrakeSoft's Multi Network Firewall which is a very nice firewall + network infrastructure management software that provides many features, including a multi-VPN support. And it's very easy to use.

Re:Multi Network Firewall

[dnotj]

you actually got it to work? last time I played with MNF, it required several patches off Florin's personal server, having this file and that file. Not what I wanted in a firewall.

perhaps there is another release.

Re:Multi Network Firewall

[charnov]

I never had a problem with it. It was the $1400 price that got me.

Big network

[mathd]

Does anyone are using smoothwall in mission critical situation. I am thinking of replacing the expensive and complicated Cisco Pix at the office with something more simple (smoothwall or ipcop).

Is this secure and scalable enough for my 3 transactional web site in the dmz and the 30 workstations?

Re:Big network

[thinwater]

Smoothwall (at least the free version) will not work for you with 3 web sites. Smoothwall Express 2.0 ONLY allows 1 external NIC address (they call it the "red zone"). If you're looking for free - try either NetBoz or MonoWall, both allow IP Alias to add more external IP addresses to your FW. You might consider a commerical product if it's truely mission critical. Check out GNATBOX products (www.gta.com). Great products, very secure, easy web admin, and great (but paid) support. I've used GTA stuff for 5+ years and have never looked back to PIX. For smaller businesses, I've been using NetBoz with good sucess.

Re:Big network

[Homology]

Does anyone are using smoothwall in mission critical situation. I am thinking of replacing the expensive and complicated Cisco Pix at the office with something more simple (smoothwall or ipcop). Is this secure and scalable enough for my 3 transactional web site in the dmz and the 30 workstations?

Why not use OpenBSD? The excellent stateful packet filter have builtin bandwidth management, and the operating system is known for it's focus on security.

Re:Big network

[Anonymous Coward]

IPCop does support multiple aliases so your three web servers become no problem.

Sheesh...

[theskipper]

I installed it and not once did it ever pop up a browser informing me how to protect my children from the internet. Needless to say I deinstalled it pronto.

Btw, anyone know of a hardware solution for this problem?

Re:Sheesh...

[Anonymous Coward]

Btw, anyone know of a hardware solution for this problem?

Scissors?

Re:Sheesh...

[Anonymous Coward]

Hardware solution: a pair of wire cutters. Your children will be *quite* protected...

Sounds similar to ClarkConnect

[Anonymous Coward]

I'm using ClarkConnect (www.clarkconnect.org) at home, it sounds similar to this.

ClarkConnect is easy to install and configure, and seems to work well. Not sure how it compares with smoothwall

Re:Sounds similar to ClarkConnect

[Anonymous Coward]

I tried ClarkConnect on two boxes (that ran smoothwall) and could never get it to work. When I reinstalled Smoothwall on both boxes, no problems.

Not a plug for smoothie, as I really did want to try ClarkConnect. I even downloaded and burned it on another pc for the second attempt...

I could get the gui started but never get any services from another box regardless of what buttons I pushed/changed, etc.... :(

Re:Sounds similar to ClarkConnect

[Anonymous Coward]

Clark Connect took a couple of tweaks for me to get working. Needed to swith eth0 & eth1 (in /etc/modules.conf) and needed to manually start dhcpd the first time. After that it ran great.

Re:ee

[Anonymous Coward]

Why not use a secure system in the first place, like Windows XP Professional. I hear it is very good.

If only it had...

[amplt1337]

... the ability to filter connections on port 80 based on the referring url.

Hooray for googlecache...

LEAF is very solid

[Arkahn]

The LEAF distribution of Linux (leaf.sourceforge.net has performed excellently over the years. Various sub-distributions have tackled different things, and I've happily been using Bering at my company for years now. Smoothwall and Bering sound similar: Bering offers a 2.4 kernel, one floppy default running size, easy setup, good documentation, an active and helpful mailing list, and Shorewall for those of who don't want to muck around with iptables scripts. (I'm guilty of using iptables by itself for some time. Shorewall's thorough implementation is sobering to this do-it-yourself-er).

hotbrick

[ironhide]

recently i bought a hotbrick hardware router/firewall which is based on linux. Neat little box, with a webinterface, logging, vpn, nat and backup dsl line failover. Maybe one of the first in a whole generation of embedded linux hardware.

Not too shabby

[t0ny]

As long as they can avoid some small issues, they should be ok. Since they only have two vulnerabilities (although one allowed remote execution of arbitrary code), they seem to be doing well.

IPCop

[balamw]

I was looking at Smoothwall a few months back, but found that I was scared off by the various versions etc... It really didn't seem clear if the GPL version would be supported for long. I ended up rolling my own Debian based system, but looked carefully at IPCop too.

(Actually just posting to eliminate some bad modding.)

Balam

What do you mean "hardware firewall?"

[mindstrm]

Like, give me an example?

Checkpoint? That runs on Linux/ Solaris / NT or whatever....

Checkpoint Nokia appliance? Just a rack-mount computer, running one of the above operating systems... they are not a "hardware" firewall.

Every firewall I"ve seen is just a fancy PC dressed up to look like some kind of hardware box.

Not sure what you mean by "your computer still has to do all the blcoking".. a firewall IS a computer that does blocking, by definition.

Smoothwall is not some add-on to your existing box.. it's for buildling hardware firewalls....

Re:What do you mean "hardware firewall?"

[Anonymous Coward]

Excellent point. However, most people do make a distinction between hardware and software firewalls along lines that actually have nothing to do with the division between hardware and software.

The difference is that hardware firewalls fail in the "off" position. Software firewalls fail in the "on" position. So when the embedded software in a "hardware" firewall fails, all network traffic through this device stops. When a software firewall fails, traffic goes through unfiltered. This is why people like to say "software firewalls suck" even though there are (to my knowledge) no true hardware firewalls.

Re:What do you mean "hardware firewall?"

[Anonymous Coward]

The Dlink DI-604: a hardware firewall for your pleasure

No moving parts, not running any of the above operating systems, it's a dedicated hardware firewall. Certainly not a "fancy PC". In fact, even a "no-frills PC" running Smoothwall is pretty bloated compared to this little 5" square by 1" thick baby, which has pretty much all the features you get with a "software firewall" like Smoothwall or whatever, but for just $30 and a hell of a lot less deskspace.

Re:What do you mean "hardware firewall?"

[Anonymous Coward]

Mod this guy waaaaaaaaaaaaay down. I don't know what screwed-up firewall he's been using, but every time iptables has failed on me, the connection simply drops.

In fact, come to think of it, what on earth is he talking about? If the OS fails, it can't route packets any more, surely?

Re:What do you mean "hardware firewall?"

[Slime-dogg]

It's pretty easy to give an example. Say you have a network of five machines, one of them has the http port forwarded to it. Some kid outside finds your address, and starts flooding you. You immediately notice a hit in performance, because your personal web server is getting pinged from hell, or it's uploading tons of crap.

So, you have a firewall at the in-pipe that you set to deny all packets from this kid's IP. You will immediately see packet traffic on your own network decrease, and you can resume your happy protected life.

If you had a software firewall running, your network would still be bogged down from the ip traffic, and your machine would be working twice as hard because it's serving, and it's checking ip headers.

Re:What do you mean "hardware firewall?"

[DoXaVG]

I want whatever you're smoking. I think you're mixing up your terms.

A Checkpoint/NOKIA solution may be software, but it does NOT run on your web server, it runs between your network ingress point (a router of some sort) and the rest of your network. Well, put simply. IE. it runs on another (dedicated)box.

As for something closer to a hardware solution, vs. the software running on a general purpose OS (but still dedicated hardware) check out NetScreen.

FWIW, I can't recommend either vendor, I think they both suck pretty bad.

--Dox

Re:What do you mean "hardware firewall?"

[batkiwi]

So what if i load this:
http://m0n0.ch/wall/

onto one of these:
http://www.soekris.com/

HW or SW?

Are you saying that no HD makes it hardware? Fine, you can get an IDE pcmcia slot and load it on that

No fans?
Fine, get an old p100 with just a heatsync

OR did you not realize that a HW firewall is, as others have said, a SW firewall?

Re:What do you mean "hardware firewall?"

[djrogers]

Like, give me an example?

How about this? NetScreen makes purpose built ASIC based Firewall/VPN devices, and has been doing so for years...

Re:What do you mean "hardware firewall?"

[altamira]

Look at how NetScreen (someone mentione it before), Fortinet or Watchguard Vclasses work you claim everything is software running on top of commodity hardware...

Advantage?

[milesbparty]

Is there any advantage of using something like this over just using iptables?

Mirror of ISO image

[baximus]

PlanetMirror's got this now:
HTTP | FTP.

Is it possible to have a NATed VPN?

[crush]

I see the release notes talk about being able to do VPN through this to one of their own products. However I want to be able to masquerade through to a Cisco VPN server. The VPN-Masquerade-HOWTO (as of Oct 2003) says:

I don't have the resources to follow the development kernels, so at this time no work on VPN Masquerade for 2.3.x or 2.4.x has taken place. If you know someone who is working on this, please let me know.

So, will this allow me to run multiple clients from home through the firewall? I have two workstations and a wireless laptop and can't run the vpnclient through the firewall.

Re:Is it possible to have a NATed VPN?

[cocotoni]

Depends what kind of VPN you want, and what kind of Cisco VPN server you have. PPTP can run through NAT, but only one machine at a time, whereas L2TP over IPSEC can pass any kind of NAT nowdays. It is called NAT Transparency (NAT-T), and is supported on Cisco IOS routers v12.2.13T upwards (12.3 included) and Cisco VPN concentrators (don't know for PIX).

You could have some problems on the client side though, I have tested this setup only with WinXP, and for that you need a hotfix (KB818043) which was responsable for disconnecting some computers I believe a year ago...

Search Cisco site for NAT-T...

Re:Is it possible to have a NATed VPN?

[crush]

Thanks for the pointers. I have a lot of reading to do on this and your response was extremely helpful.

Re:Is it possible to have a NATed VPN?

[crush]

Got some more good info on this that I thought I'd share back in case anyone else is interested. Basically if the VPN is relying on AH (authentication headers) instead of ESP then NAT becomes a problem. Good docs on this are available at the FreeS/WAN project

why linux?

[Anonymous Coward]

Now, why would I want to take all the space, trouble, and expense of setting up a computer to run Linux for a firewall when I can simply pay around $30 and get a hardware firewall like the Dlink DI-604 which is tiny (a mere 5" square by 1" deep), feature rich, and completely plug and play?

This is an honest question, not a troll, and I have no stake in any firewall vendor. I really want to know if there are any advantages at all to using Linux (or OpenBSD's pf) as a firewall. There certainly used to be, when commodity hardware firewalls were in their infancy, lacked a lot of features or were seriously overpriced. But now they are very mature products and are seeming to give open source firewalls stiff competition, for a very reasonable price.

Astaro Much Better

[All Dat]

Personally, I've used Astaro Security Linux for a long time since moving from Smoothwall, and I find it far superior.

It's of course free for home use, runs on anything down to a P100, and all the up2date is handled by Astaro themselves.

Hell, they even have FREE evaluation webinar-live-workshops for people to get acquainted with Astaro if they are new (and presumeably to help with a purchasing decision for business) You can signup for the Eval Workshop for free here.

When they release their version 5, I hope it gets the same kind of publicity, they are hands down the coolest internet firewall and don't seem to get much press.

Re:Astaro Much Better

[dnotj]

I'm running Astaro. Everytime I check out the current competition, nothing comes close. Perhaps it fits my needs well, but it just works. Haven't found anything close in terms of features either (for free).

Heck, even a M$ lozer could download the iso and have a firewall up and running with 2 hours (so long as they have Mozilla installed).

Experienced Astaro admins can have a firewall up in 15 minutes, tops.

Re:Astaro Much Better

[gilesjuk]

Smoothwall and IPCop support cheapo USB rubbish ADSL modems like I'm using. Plus they are also quite compact compared to some Linux based firewall solutions. Mandrake MNF is really bloaty.

Re:Astaro Much Better

[Anonymous Coward]

Oh in 2 whole hours! You gotta be kidding right? If it takes that long to setup a basic firewall that denies everything by default I'd hate to think of the security implications.

Re:Astaro Much Better

[ebbe11]

Oh in 2 whole hours! You gotta be kidding right?

The two hours includes the time spent downloading the .iso file.

Smoothwall kicks ass.

[pair-a-noyd]

I've been using Smoothwall 2.0 beta X for over a year now and I've had very few problems.

The most recent I'm using is Pendolino and it's great.

I have installed several customer sites with Beta5 (after extensive testing at my site) and they are all very pleased with it.

I highly recomend it. You can take an old PC and load it up and really be covered.
It's very easy to use, very reliable, very flexible.

What's even better is that you can use the built in,
transparent proxy (squid) to block ads. (sorry /., your ads too)..

I made a dull gray "this ad zapped" gif and put it in /home/httpd/zaps and edited the wrapzap file to tell adzapper to look on smoothwall ofr it's images rather than using the resources of sourceforge. I found that the black and yellow gif was more annoying than the ads it was blocking.

Man, it's great. EVERY machine that I plug into my lan automatically gets it's ads zapped. Friends and customers are freaked out and impressed with that. Then after seeing how cool it is they want a smoothwall too. Problem is I end up setting them all up for free.. ;-/

Smoothwall is very cool, get it....

Re:Smoothwall kicks ass.

[AssFace]

Excellent! This is what I want - someone that has used it and I can bounce some questions off.

I am a Windows admin for a small network (20+ machines). I am more of a programmer than I am an admin in terms of my knowledge, but alas, it is my position.

Our network connection is 128K to be shared between us all. *PAINFULLY* slow. I can currently block out domains on our current firewall, so that gets some of the ads. I look in the url logs to see what is getting downloaded a lot and then block the ad servers that show up in there.
That is good because it is less stuff for network to have to download.

That said, what I really need from the firewall beyond blocking ports and the like is good logging, and then good VPN.

Can you tell me the level of the logging and if you have done anything with the VPN (ideally on a Windows to Windows setup)?

The logging I'm looking for (I have another post on this thread), would be to see what computers inside our network are doing. Not to track the users and what they are doing, but in order to track viruses, spyware, and worms.
Our current firewall will show the top urls visited on the web. It will show the amount of data that the top 25 protocols allowed. And it will show the top ip addresses - in terms of data transferred to them - which can be in or outside of our network. (Which is awful since one of our IPs could be sending out 50 megs to an IP on the outside and they both will then show up on the list - awful).

Basically, I want the granularity that is beyond that so that I can see that our inside IP address went to A, B, and C web pages which amounted to 800 hits and 50megs, and also checked 8 megs worth of POP3 mail. They had 2 megs of AIM data, and 1 meg of MSN data. Then there was 1 meg of data sent out over TCP port 6699.

That sort of thing - I have checked out the website, and while they mention that "it logs" - the images of it (at least last week), were... pretty much non-existant.

Also, what sort of hardware does it need? It is hard for me to get hardware here, even low end - so it might cost me as much to get a desktop machine new as it would to get a 486.

Re:Smoothwall kicks ass.

[pair-a-noyd]

Hmmm.. I haven't seen the *final* release yet so I can't say for sure what the level is of logging but the logs that smoothwall provides are very decent.

Using the adzapper method as I mentioned above is very, very good at knocking out ads, thus conserving bandwidth. It's very effective.

You can also modify the iptables to block outgoing traffic to certain sites or blocks.
I've blocked access to/from *ALL* of Asia on mine at home and blocked all incoming Asian traffic on a customer site (20+ units on a 368kb cable modem) and NO ONE complains.

It even blocks email spam, in that any email that contains html code that ad driven, such as from a cgi ad server, gets blocked right in the email program, no matter the platform, Linux, win32, OE, kmail, whatever. If it comes in on port 80, it gets ad filtering. You can fine tune the system as much as you want, remember, smoothwall is Linux and it's really a stripped down Redhat. With IPTables, *YOU* are in control of all incoming and outgoing traffic, to whatever your skill level permits. Smoothwall has basic iptables tuning tools but you can manually edit them any way you like..

When you use smoothwall and setup another machine as a mail server that runs spamassassin, you will be amazed how much bullshit you stop and how much bandwidth you conserve.

Set up a mailserver and point all internal machines to it. It can also virus scan incoming email too.

If you really want to stop the nonsense you can, smoothwall is a good, easy to use system, but it's just *one* of the several tools you'll need to deploy to get your system under control..

Re:Smoothwall kicks ass.

[AssFace]

We have virus scanning on all machines that talk over the network to a central server that nightly grabs updates. We have Exchange server also with virus scanning. And then I used EventSinks to interface into Spamassassin. It doesn't kill the mail, it just marks it with its decisions and then let's it through.

We are upgrading to Win2K3, Exchange 2K3, and Outlook 2K3 - this will allow more spam filtering options and more built in stuff for the end users (take the load off of the server - and me since I have to adjust the whitelists for new clients).

There are about 5 main ad servers that get the bulk of hits for us in terms of ad traffic - so blocking that is easy.
Then when someone manages to get spyware, that will show up in the logs eventually and I can then try to narrow it down based on who's IP is very active.

I am trying to work out the VPN stuff now, and it isn't going well. Technically, the new Exchange will make it easier on us - you don't need to VPN to get secure Outlook access, it will do it all for you just by pointing it to the web server. But that doesn't help if they want to access the files too.

Still - I'm curious how detailed the logging gets on SW.

Re:Smoothwall kicks ass.

[Anonymous Coward]

A VPN is usually done to join remote networks so that users can treat them as one. As such, it's usually done at the firewall/IP level, so Windows or Linux or Mac clients don't need to know what's going on (like a well-configured NAT).

We have an IPCop box with VPN between two locations and it works great with windows clients talking across it.

I've had bad (read: awful) experiences with the Smoothwall people and it's probably easier to go with anything else.

Re:Smoothwall kicks ass.

[AssFace]

Thanks for the tip, I'm new to setting up VPNs (they have always already been setup in the past when I've had to deal with them - and then when I ask people for help setting them up, I get a lot of shuffling of feet and mummers, but not absolute details).

I am seeing now that it will be much easier to setup a Linksys router at each home installation for our users - those will VPN very easily (so I'm told, and given the settings) to the Sonicwall.

Re:Smoothwall kicks ass.

[Eil]

I've been using the ancient junkbuster on a home-built for a very long time now and have been thoroughly satisfied (with the exception of not being able to remove block patterns without logging ino the machine, though).

If you've used junkbuster, can you tell me how your solution stacks up to it? I tried Privoxy once, but found it intolerable that I had to wait for the whole page to download to the server (over a modem) to get analyzed before finally being shipped off to the browser.

Thanks in advance.

Linux Security Vulnerability affects Debian Proj.

[samj]

I see these larrakins are still out trying to stand on toes wherever possible, this time by making a comparison between the security of two distributions based on the setup of their administrative systems. This courtesy the front page of their web site under 'SecurityNews'.

Monday 8th December 2003

A Linux vulnerability allowed attackers to elevate user privileges in a recent attack upon the servers of the Debian Linux distribution. The vulnerability can only be exploited by people who have already have access to a user account on the Linux system.

Unlike a standard Linux distribution, SmoothWall is a hardened system that does not create standard user accounts. Furthermore, all access for management or maintenance purposes is normally restricted to specific IP addresses.

For general purpose Linux systems using a kernel prior to 2.4.23 we recommend that the system be updated to remove this significant vulnerability. Check the website of your Linux distribution for applicable patches or see Network World Fusion for further information.

Suspect a bad connection inside the computer.

[Futurepower(R)]

Suspect a bad connection inside the computer. Pull out all connectors and adapters and memory modules one millimeter and push them back. That refreshes the connections by wiping off oxides and other corrosion.

Re:Suspect a bad connection inside the computer.

[Anonymous Coward]

Huh? You're all wrong. The best way to do this is to use crystals tuned to the right freqency. If they're grown listening to Mozart, all the better, but it'll cost you a bit extra.

Re:Suspect a bad connection inside the computer.

[ScrewMaster]

The best way to do this is to use crystals tuned to the right freqency. If they're grown listening to Mozart, all the better, but it'll cost you a bit extra.

You know, you really shouldn't say things like that on Slashdot. There are a lot of people here that will believe you. Can you recommend a good source of Mozart-grown crystals?

CD upgrade from good ole 'freesco'

[Anonymous Coward]

I like the new SmoothWall.
I used diskette based 'freesco' for years but finally moved to a new firewall version.
When I first looked at 'smoothie' I saw they really discouraged customization. I moved on to IPcop for awhile and then switched back to smoothie GPL v2 beta.
I now see some customization on the smoothwall.org site and it seems to be more supported then in the past.
I'll stay here for awhile, try it.. you might like it...

It'd be nice to have Comparisons of these puppies!

[ivi]

Similar products to SmoothWall (eg, IP Cop,
e-Smith, Clark Connect, et al.) get mentioned
from time to time, and - as a user of only
one of them, I sometimes wonder if it's the
best for our situation.

It would really help to have some point-by-
point comparitive review of all of them, so
people could try to fit their situation(s)
to each of the sets of parameters & pick a
likely-best-fit from the review.

Eg, minimum & recommended system requirements,
ISO size, security tests that each has survived,
logging features, services provided (eg, file-
server, mail server, web mail, MySQL/PostgreSQL)
above & beyond firewalling, etc.

Someone care to add to the parameter list, eg
so some of us could each fill-in the blanks
for our current choice of system & publish the
set of resulting reports in a repository, eg
a bit like benchmark tests for various config-
urations get stored together, even though they
come from lots of invidual home test-labs.

If we start with a fairly complete list of
parameters we'd likely come up with reviews
that make sense to compare, especially if
folks give the numbe of workstation they
serve, on the network.

What'cha think? ;-)

My though on the type of distros

[bogie]

I think these are Awesome for small businesses and technically advanced home users but really not too great for the average home user. I think they will be better served with something like a low end SMC router. It's cheaper,smaller, costs less to run, and even compared to the easiest of these distros tends to be easier to setup. Usually you just plug it in and go. No need to open up a PC to install extra NICS and no need to worry about a powersupply going. I used to run a PC for a firewall, but really with the features you get on these cheap routers I'm more than happy. Hell the low end SMC7004VBR has an SPI firewall, VPN, Virtual Servers, and Access Control. All for under $40! You may have more fine grained control on something like Smoothwall, but for who don't need it it's really no contest on which product is a better fit.

I guess most of what I said is common sense, and I'm sure those in the market for a PC based firewall have thought about it as well. I just thought I'd post in case you needed to be pushed one way or another.

Re:My though on the type of distros

[Anonymous Coward]

You could argue that I guess - personally I'd argue that the cost of setting up smoothwall for me was ~15 pence...

The machine is the first PC I ever bought, a P200 MMX with 64meg of RAM. It had been sat in a cupboard for 8 months as my wife (the only person that used it for the proceeding year) bought herself a faster machine. We then got broadband and smoothwall was suggested to us by a friend. It already had one network card installed, and I nicked another one from a machine that was about to be scrapped from work (they're quite happy for us to help ourselves to kit thats about to be chucked - costs them less to get shot of it) and that was it - my only cost was the CD I burned the installation image to - everything else was either free or obsolete.

It was dead easy to set up (I'd never so much as touched Linux at that point) and worked flawlessley - this was 18months ago or so now and has been taken offline for one of only two reason - security updates or moving house :)

How is the logging?

[AssFace]

At work we have a Sonicwall SOHO 2 on a Windows network. It was in place before I got there. We "need" to keep it because we have a client that theoretically wants to come in and look at data on one server. They have yet to ever do this, and it isn't clear if it would even work (the VPN should work since it was tested when it was made, but the server's data is supposedly questionable from something one of the accountants told me).

The Sonicwall SOHO 2 serves its purpose in that it keeps out the worms and I can block/open ports.

But where it is truly awful is the detail of its logs. It will tell me the top IPs that got the most traffic - but it includes IPs that are outside of our network, and inside of our network. It will tell me the web URLs that get the most hits. And it tells me which protocols transmit the most data and how much that is.
But while that is nice in theory, it is largely useless.
I want to know what pages and what protocols specific inside IPs are doing. I want to know which inside computer is connecting to what outside computers over what protocols.
Also, if I block a protocol/port, it will still log all of the attempts towards it exactly the same as if it were being allowed in. It doesn't say that 1000 hits were attempted on it but didn't get in - it just says that there were N megs of data against it (apparently not through it).

I don't care about logging what they do - I'm pretty laid back about all of that. If they are doing naughty things, that is their deal (my superiors have yet to tell me otherwise).

But I do very much care if people have spyware or viruses on their systems - and a firewall is a great way to track down who has those issues. I can do it with what we have now, but it could be far easier.

I looked into Smoothwall and thought that it looked good - and it is free. Even then, I don't know if I can get money even to get a lowly machine to run as the firewall.
It isn't clear on their site how detailed the logs go.
And it isn't clear if I can mimic the same VPN processes that are in place now, with the Smoothwall system.

I would love to hear feedback about the software. That way I can make a more informed decision as to what to do about the overpriced SOHO (in order to use features on it, you continually have to pay to have them turned on, such as VPN or virus checking).

One word.....

[vwjeff]

Geek. I use smoothwall on a 133mhz Pentium at home not because it is the easiest firewall in the world. I use it because I can. Linux firewall=fun. Sure plugging in a Linksys router would be easier but there is no fun and adventure in that.

PC-104 form factor

[raceface]

I worked on a small pc system to do just this a few years ago. I used a pc-104 form factor. We picked up a cpu/power supply module for 200 USD, a monitor module for 75USD. I installed a linux system at the time and used it as a firewall/router between a 10Mb network and a celular modem. There was already on NIC on the motherboard i got but you can buy a module with another on it. they're realy small and have a CF card they boot from. Sorry I cant remember the vendor we used.

Another Mirror

[trawg]

http://www.ausgamers.com/files/details/html/9733

My 604 has sucked

[nurb432]

While i may just have bad luck, but the 2 604's ive had have been dismal performers..

1 - after extended heavy load, it will slow down. needing a reset to get it back to life..

2 - it resets its self every so often.. REALLY annoying...

Re:My 604 has sucked

[Anonymous Coward]

I have to admit that I haven't run mine under load. I was just impressed by:

1 - Its size - 5"x5"x1" is tiny compared to an average sized desktop or even a laptop
2 - Its features - commodity hardware firewalls like this used to be very inflexible and lacked a lot of features compared to software firewalls, but obviously no longer... this thing can do most anything you'd want out of a firewall
3 - Its price - you can't beat $30 for a 4-port hardware firewall

But if it does slow down or die under load then that's a serious problem. Has anyone else had experience with this model that could confirm or deny this?

Re:My 604 has sucked

[Anonymous Coward]

By the way, do your malfunctioning 604's have the latest firmware?

I chose ipcop instead

[agwis]

I'm one of many that were turned off of smoothwall for different reasons (rudeness by one of the developers mainly) and chose to go with ipcop. I've never looked back since then nor had a problem with ipcop.

I hope smoothwall has straightened out some of there earlier problems and is successful but I'll continue using ipcop for the forseeable future.

Both of these projects are absolutely awesome though. They allow you take an old machine and easily turn it into a good firewall/router. I've set up a few now as they have made some computers I picked up from a school useful again. All my ipcop installs go on p2's with 64mg of ram and 3 cheap nics. I can have a firewall/router set up and running in 20 minutes which includes DMZ, NAT, Snort, DHCP, VPN, and a proxy...all easily configured via a web browser over SSL.

These projects are real gems in the OSS world IMHO and I doubt I'll be looking at hardware firewalls in the near future again.

Hat's off to all the developers (except 1) that have been working on these :-)

-Pat

if you're looking for a small firewall....

[Malor]

I've been running a Soekris net4801 for a few weeks as a firewall. I'm very happy with it. It's not intended specifically as a firewall, you just buy the basic computer from Soekris and then install what you want. Getting it going can be quite involved, as it has no VGA circuitry; you have to administer everything over a serial cable. This is almost exactly the opposite target market from Smoothwall; the Soekris products are meant for people who know that the heck they're doing.

The 4801 I bought is a Pentium/266 with 128 megs of RAM, 3 network ports, a mini-IDE port (used for 2.5" hard drives [notebook style]), a compact flash port, a mini-PCI slot, and a 3.3v (only) regular PCI slot. This chipset has several known bugs, including a bad data-corruption bug with DMA mode hard drives that has not yet been worked around in Linux, to my knowledge. It's better to use it with a CF card (which can't do DMA) because of this, at least until they get that bug fixed. You can find some patches for the kernel via links off the main Soekris page, but I don't think there are any patches yet for the HD bug.

After about a week of futzing around with it, I finally got it running. Much of the pain was learning how PXE booting works. At this point, I have a Debian firewall with one external and two internal ports, and a 256MB internal "hard drive" (compact flash card). Everything is set up to log to RAM (instead of writing to the CF card, which is bad). The neatest part is that the machine is about the size of a trade paperback (it would be even smaller if they hadn't left room for a PCI card in the case), is absolutely silent, takes about ten watts of power, and has NO moving parts, so flinging it about isn't a problem. The chip is passively cooled, and doesn't even need a heat sink; the case gets mildly warm but never really gets hot. One of the neater gadgets I've played with recently.

Total net cost, including the CF card, was about $375, so it's not for the poor, and it's definitely not for the Smoothwall crowd. But if you're looking for a very sweet solution to the space-and-noise problem with a good, Linux-based firewall, this is a great solution.

As an aside, OpenBSD has patches to run with the net4801. I was having trouble getting OpenBSD's boot program to read the CF properly, and then suddenly ran short on time because my old P133 firewall started losing its hard drive. Pressed for time, I gave up on OpenBSD and installed Linux.... but, at least in theory, it should run well. OpenBSD also has support for hardware crypto accelerators, which you'll need if you want to do VPN with a box this slow. (that's one good use for the expansion slots.) I only saw one Linux hardware crypto driver, and it looked unfinished and primitive. Definitely a spot where OpenBSD looks to be ahead.

Nice little box. I'm very fond of mine.

Re:if you're looking for a small firewall....

[Anonymous Coward]

I could build a better small platform box based on Smoothwall that is cheaper and better. Try again...

Re:if you're looking for a small firewall....

[Anonymous Coward]

I could build a better small platform box based on Smoothwall that is cheaper and better. Try again...

Why don't you tell us all about it. Be sure your solution has no fan and no hard drive.

Re:if you're looking for a small firewall....

[Lilkeeney]

Fine I will. I run IPCop on a EPIA 5000. I got the mobo, case, AC-DC adapter, DC-DC power supply, PCI riser card, compact flash to IDE convertor and case (about the size of a text book) for 200 dollars. I got a 2 port ethernet card on ebay for 10 dollars. I use a 128MB CF card I had lieing around. So for 210 dollars (plus the free compact flash card) I get a passively cooled no moving parts firewall. It uses about 14 watts. I could of done it for cheaper if I made my own case and probably shopped around more. But I was happy with a passively cooled, silent, no moving parts firewall running IPCop. I found an image of IPCop online and just had to dd it over and then it booted right up. It has VGA and even RCA and S-Video output. All in all I am very pleased. I only have 64 MB of ram and it could probably use 128, but other then very please. Oh, that reminds me. I had the 64MB of ram lieing around as well.

Re:Need paper trail

[FreakWent]

Am I missing something? /--PC1
--ADSL--- eth0 - FWALL - eth1 ---HUB---PC2
\--PC3

So you don't need a NIC for each PC -- you just set it up as shown.

Total requirements: 1 old 486 PC, 2 old 10Mbit ISA cards (all from the dump) and Freesco. Add a HDD for IPCop or Smoothwall, and pref a pentium. You only need 10Mbit since your net connection is probably not more than that. Or just drop eth0 and the ADSL modem and replace with a regular 56k modem, the principle is the same.

It's really really easy -- trust me, I've done six freescos and I know stuff all about Linux....

OpenBSD

[LittleLebowskiUrbanA]

I tried Smoothwall and IPCop. Couldn't get either one running behind due to my lack of experience and dealing w/ my landlord's Linksys router. Tried OpenBSD and the OpenBSD community at Screamingelectron.org helped me through the OpenBSD learning process and configuring my box. Now I have a secure, stable firewall for free. Before I get flamed, I've bought a T-shirt and CDs from OpenBSD to support the project.

Smaller Alternative - freeSCO

[nurb432]

Its bad naming aside, ( but who could have predcited the SCO mess several years ago ) its a rather powerful Firewall/router solution that fits ( and runs if you like ) on a SINGLE floppy.

its worth checking out.. www.freesco.org

Re:Smaller Alternative - freeSCO

[geomon]

Maybe this is the source of the confusion and current litigation between SCO and the rest of organized humanity.

SCO must think this 'freesco' thing is something that the Linux community stole from them and are now distributing without their permission.

We need to let Darl know that this is a huge misunderstanding and that he should stop this madness before his company's reputation is irreversably damaged!

Poor Darl!

No way keemosabee.

[jotaeleemeese]

After struggling at work with these issues the last thing I want at home is to do more of the same.

A solution out of the box, that you can troubleshoot if needed, is the sensible way forward, even for time starved professionals like yours truly.

I can't be arsed upgrading...

[solanum]

because I've been using Smoothwall v1 now for quite a while and have had absolutely no problems whatsoever. It currently has an uptime of something like 60 days and the only time I've had to reboot it in over a year has been when security updates have been installed (and it tells you when they are available and installs them from the web interface).

Firewall on a floppy, anyone?

[thirty2bit]

Nobody mentioned the Floppy Firewall yet? It can be found at http://www.zelow.no/floppyfw/

One single floppy. It can be write protected to prevent rooting. No hard drive needed, so a quiet junk PC can be easily used.

Re:OS? picobsd

[Anonymous Coward]

dont forget about picobsd.
it comes with every fbsd install
when u install full source.
it makes a fine 1.4mMB firewall.
has sshd, and all that jazz.
anywho

Who ya gonna trust?

[rbrander]

It was trivial indeed to implement a firewall for 486/33, 16MB (or better, of course) machines using OpenBSD.

We wrote up some instructions on what old NICs are supported and how to configure them (not needed if you have Pentium/PCI of course), plus very, very explicit OpenBSD install instructions based on the floppy-boot, over-the-net install.

Then we wrote a little Perl script to make the few changes to vanilla OpenBSD into a home/SOHO firewall, and called it "BSDwall".

See www.bsdwall.org

based out of the Calgary Unix Users Group site. It's been recently checked to work OK with OpenBSD 3.4. I can't imagine why anybody would use Linux for a firewall with OpenBSD also free; I use Linux on the desktop, but....if both BMW's and M-1 Tanks were free, and you had to drive through Iraq tonight, which free vehicle would you use?

Enjoy

Re:Who ya gonna trust?

[Anonymous Coward]

Because it has an easy to use interface than makes the firewall extremely easy to administer? Perl scripts can't compare to the web interface that Smoothwall offers. I'd take Smoothwall anyday over any homegrown stuff from a user's group - but imho. It's been tried and tested by MANY unlike your solution...

Re:Who ya gonna trust?

[rbrander]

Well, I'd say that OpenBSD firewalls have been "tried and tested by many"...many banks, many gov't agencies, etc...

We debated setting up web administration, but it opens a vulnerability; every complexity you add creates another possible hole.

The focus of the debate was that it would be a rather unusual individual who

1) DID have enough computer expertise to open and close particular ports or screen out particular IP domains or whatever you wanted to admin;

2) DID NOT have enough expertise to run SSH to the machine and edit a rules file with a text editor.

As for me and most of the users, there's no admin anyway; I just leave the default rules running and "administration" consists of a reboot every hundred days or so, whether it needs it or not.

A long time ago...

[Anonymous Coward]

...back when it was free, and they were still in pre 1.0 testing, I used to run it. Even then it ran well on a 486 box that I left in a spare room to NAT the internet to my network. I don't know whats changed, but anyone can do exactly what that does with a iptables script. Anything else seems bloated and thats why I dropped it. Not to mention, its coders were pricks. They have(had) an irc network that would gline anyone that came on asking for help. The IRC network I used to oper had one of the security coders as an oper, he pointed out how insecure it was and they told him to bugger off :) So he left the project.

-dl

why and who cares

[Anonymous Coward]

so, this is all in any linux dist. why not set it up yourself. it is VERY easy to setup iptables, dhcp, dns, (with ddns) stun, squid, or whatever service you need on a linux install. all you need is a 500mb hd, and a couple of cd's of a boot disk and an internet connection. i would also suggest openbsd and pf, but iptables is faster, and linux has ecmp. which to my knowlage obsd does not have. but obsd has better traffic shaping, and handels fragmantation better. and is a lot more secure out of the box. who care about smoothwall.

$50 router makes less noise, and prettier to boot

[Anonymous Coward]

So why waste your time?

Such forgiveness...

[The Tyro]

One of the Smoothwall guys just apologized to you (even though he has no way of verifying your "I was mistreated" story) in a public forum, admitted they were wrong, and did it in front of several hundred thousand slashdotters (something he didn't have to do, BTW)... and you won't even consider the software? Ever?

Projects evolve, abrasive people are often forced out over time. Seems to me you are missing out on a potentially useful tool, based on a past beef with some guys who are no longer there...

I'm not saying you don't have the right to feel they way you do... it just doesn't seem very pragmatic.

Re:Such forgiveness...

[Chunky Kibbles]

Aye, what you're saying does make sense. I didn't mean to make it sound quite like that.

It's more that I've had this thoroughly bad experience with smoothwall, but I haven't yet had any bad experiences with IPCop. What good reasons are there for using smoothwall now, given an alternative that I see as just as technically good.?

Gary (-;

Why not run LOTS of these puppies in series?

[ivi]

Eg:

Internet OpenBSD lotsa firewalls LAN

'any obvious vulnerabilities here?

Could connection order affect
the effective security level?

Re:Why not run LOTS of these puppies in series?

[Anonymous Coward]

With VMware you could even run all those on one PC.

I can imagine some black hat hacker busting through the one-hundred-thirty-fifth firewall and having his head explode because there's no end in sight.

Do you want to learn?

[The Tyro]

Buying a "hardware firewall" (cheaper ones are just an NAT box) is easy, but teaches you nothing.

Honestly... there is no substitute for building your own stuff, particularly if you want to increase your understanding of networking and security. If you don't have time for that kind of thing, or just don't want the hassle (you say hassle, I say "learning experience") of rolling your own, then buy the Linksys/Dlink/Netgear box and be done with it.

You will get far more options and much better control with the one you build yourself... but it doesn't come for free; it takes effort on your part. Seriously... build your own, then set up an ethernet tap with Snort to see what's coming and going on your network. The latter step with Snort personally taught me more about networking, protocols, and packets than any Man-page or article.

Build it... you'll be amazed at what it does for your networking/security skills.

Re:Do you want to learn?

[Anonymous Coward]

Buying a "hardware firewall" (cheaper ones are just an NAT box) is easy, but teaches you nothing.

In many cases this is true, but when you are dealing with Cisco hardware, there is no alternative. Granted you might learn alot of stuff if you are building your own Firewall/NAT box, but you will never learn Cisco unless you get one of their routers/firewalls and start messing around with those. You can try to use emulators or free alternatives, and they might mimic Cisco equipment to a certain extent, but it just isn't the same.

I'm not saying you cant learn stuff about firewalls or networking in general with a home-built brand, but just getting used to the syntax, commands, etc. for Cisco gear you need the real deal.

Re:Do you want to learn?

[pacman on prozac]

What you say is true, but I've just switched from being a 4 year user of PC firewalls to a $50 ADSL router.

Why?

Because I will save so much on electric over the next year I can probably buy another computer at the end of it. Running a PC 24/7 will burn a not insignificant amount of electricity over a few months. The router can be turned off/on without waiting more than 5 seconds for it to connect up and doesn't give any problems to the non-techie people using it.

The only thing I'm missing from my linux firewall is the constant logs of windows viruses trying to infect me. I'm sure I can handle that. It is annoying having a much looser control over what the system is exactly doing, but all the needed features are there for home use.

I'd prefer some kind of embedded linux device that gave these advantages, but until one arrives I'll stick with the router.

Re:Do you want to learn?

[SillySlashdotName]

Watchutakinbout, willis?

P=IV, so that DI-604 uses 5x2.5=12.5 watts. A PIII 500MHz will use about 30 watts. Difference = 17.5 watts.

17.5 X 24 X 365 = 153,300 watts, or 153 Kilowatts.

At $0.06 cents per kilowatt, that is about $9.20 savings per year if both are left on 24/7.

Assuming ZERO electricity for the router, 30 watts x 24 hours x 365 days / 1000 watts per kilowatt x 0.06 cents per kilowat = $15.77 for electricity FOR THE YEAR for the PC firewall, minus the $50 paid for the router gives $34.23 loss (assuming the hardware for the PC firewall is legacy stuff and costs $0). So you would have been better off NOT going with the router.

A 100 watt lightbulb burning continiously for a year uses (((100*24*365)/1000)*.06) $52.56 in electricity

Your modern power supply is rated at 350 wats - constant load is much less, but using 350 watts for worse case gives (((350*24*365)/1000)*$.06)=$183.96. Subtract the cost of the router ($50) and you have a maximum savings of $133.96 by going with the router. $133.96 won't buy much of a computer.

Heh... same here

[The Tyro]

I had one of these, tried to set it up for a neighbor (a surgeon who's a non-geek)... it worked for about two days before it died.

Cheap is right. It wasn't even worth the trouble of RMAing it.

Filed in the round file.

Hardware Suggestion

[sootman]

If you don't have an office nearby that's throwing away old Compaq Deskpros, Computer Surplus Outlet is a good place for older machines that are perfect for smoothwall & IP Cop. The slowest & cheapest thing I can see there are 233 PIIs for $29. Actually, that's *all* they have--they used to have a lot more, but if they're selling PIIs for $30 (I remember when the first PII/400 came out , the CPU itself was over $1,000) I guess they can't go much lower on that. Who wants to pay $0.50 for a 486 & $22 shipping?

Dumb question?

[climberkid]

Hey, this might be a dumb question but is it necessary for a static IP to be used with smoothwall? Will DynDNS suffice?

Re:Dumb question?

[KronicD]

Neither are neccisery, but it supports both :)

RM != Smoothwall?

[TellarHK]

I came into this thread expecting to see even more echoes of my own interaction with RM than I have, and was pleasantly surprised to see some positive developments as well. I wasn't exactly the most blameless person who ever had a fight with RM get to the seemingly common "Dick Morrell Barratry Special" stage, but I did wind up getting an apology from him.

I'm glad to see both IPCop and Smoothwall continuing to progress, and hope that some competition between the two projects can make the experience of a firewall system better for everyone who uses either package. I'd try and work on either now that I've graduated with a totally unused programming degree, but with a 10 hour work schedule I'm a bit out of the loop.

Glad to see things still moving along, and glad that Dick isn't dragging you all through any more mud. The notes from folks that I see RM still claiming copyright on Smoothwall are a little bit curious, but I'll take it on good faith that I'd never encounter him if I dealt with Smoothwall again. Maybe when it comes time to get my home LAN configured a little more flexibly, I'll give Smoothwall GPL a shot.

And a side note, one thing that would make any firewall project -highly- desirable for the more anal-retentive (and blinkenlighten fetishistic) users would be a status display screen. I've got a hacked iOpener box that would be incredibly well suited to firewall usage if the display were used to show network traffic details in realtime or semi-realtime.

Question About Smoothwall or firewalls in general

[Pengo]

wpanderson, if your reading this.. I would love some insight on future of Smoothwall, and features.

Is there any plans of adding features such as a very easy interface for Packet shaping.

Is there an easy way to track and monitor the trafic, based on source of the request , type of traffic and the destination.

Is there an easy way to access the network with an out of the box VPN service.

Is there support for multiple external IP's.

Is there support for mixed STANDARD MODE and NAT MODE for external interfaces. And rules that let you push back and forth between the different zones.

Does smoothwall support 3 physical devices, or more, for DMZ/Lan/WAN configuration.

Does SW support 1-1 NAT and filters/services based on that nat configuration?

External logging, eventlog, traffic, etc?

Support for various devices above mentioned and a 802.11b sharing device with authentication.

I am assuming that SW uses SNORT for it's IDS. Is there plans for automated updates of rules on that or an easy way to manage those rules.

I am very interested in Smoothwall, I would love to dig into it when I have time. How friendly is the SW community with rolling features back into the project if one so chooses? (I definately am not interested in adding features to a system which will only be sold at a commercial level... if so I would probably go help the people at IPCop...).

Looks like you guys have worked on this project and congradulations on your 2.0 release. I might fire up a machine in my closet to give it a kick. and see how it runs at home, maybe even start hacking on it. We have a couple medium / small offices where I work, and we could use such a toy to help secure the networks. (netgear cablemodem routers are so boring).

I think you are mixed up.

[mindstrm]

You aren't talking about software firewalls, youa re talking about running a firewalling layer on a host, -vs- a dedicated firewall box for a network.

This whole article is about a linux distribution used to build what you are referring to as "hardware firewalls".. not some software you load up onto an existing system.

Re: Firewall?

[Anonymous Coward]

Because Windows has too much underlying weakness, regardless of the firewall software you may be running or what Bill Gates has to say. I was seriously surprised at the kinds of junk my Smoothwall stopped that I never knew about. I will never go "barefoot" into the internet again, and as an added bonus, I also got a real cheap proxy server made from a 133 MHz Pentium and a 4 gig hard drive.

Nothing of the sort.

[mindstrm]

I'm not saying anything like that at all....

I'm trying to figure out what the guy means by "hardware firewall".

It turns out what he means by "hardware" firewall is "dedicated" firewall... as opposed to host-level firewalling (like, say, using iptables on your webserver, or blackice defender on your windows box)

Still software.

[mindstrm]

Unless the filtering logic is actually on the silicon, it's a software firewall...... I don't care how big it is.

It still runs an OS, and still does it's filtering in software, with a microprocessor.

A "hardware" firewall would be something that blew it's filtering logic into FPGAs or something, and filtered in silicon.

Sure a linux box is bloated compared to your little dlink box.. but then, your little dlink box has nowhere near the firewalling capabilities as the typical linux box, nor can it handle anywhere near the same load. It might be fine for your home office, but no way on earth would I use it in production.

Problem i had with smoothwall

[Anonymous Coward]

I tried smoothwall but couldn't get it to work because my firewall box has only one network card which connects to the switch. I have my pppoe adsl modem connected directly to the switch.

will the new smoothwall work with my setup?

Re:I downloaded Linux

[PReDiToR]

Back in the old days of Windows 3.1 we didn't need a firewall at all.

Not having a modem or ethernet made the box as secure as any computer you ever used.

I think that this is the way forward, we could go round to a friend's house with the internet and bring portions of it back on floppy disks like we used to in the old days.
Mind, CDs would probably be more efficient these days., I dunno. Maybe without the dataloss and downtime that businesses could miss out on we could get to a place where DVDs and DVD burners dropped in price to make them cheap as chips for you me and everyone.

*sigh* In an ideal world, right?

Re:Question About Smoothwall or firewalls in gener

[wpanderson]

The best thing for me to say in reply to this is go check out the SmoothWall Community forums, as I'm about 15 seconds away from disappearing to bed :)

Re:Question About Smoothwall or firewalls in gener

[Anonymous Coward]

lol why don't you just by a commercial firewall you cheap bastard? It's amazing how cheap some dumbasses are. If you want all that functionallity for nothing you are a piece of work.

Re:Question About Smoothwall or firewalls in gener

[omega9]

Please:

Check out the product before asking so many damn questions. You haven't even been to the website or you wouldn't be asking some of these.

Re:Question About Smoothwall or firewalls in gener

[Pengo]

"If you want all that functionallity for nothing you are a piece of work."

Sorta like someone wanting the functionality of a commercial database, operating system and desktop, web servers and development environments?

Hypocrite

Re:Question About Smoothwall or firewalls in gener

[Pengo]

Hmm... actually I have. Those appear to be the missing features I would be interested in.

Looks like I stick with openbsd.

Re:Question About Smoothwall or firewalls in gener

[Anonymous Coward]

Get OpenBSD,
1. Configure your BPF (Ultimate in Granularity!)
Features here include, native ssl support, native IPv6 support, shapeing....in fact more crap than cisco could shake a stick at.
2. If you need it get zebra (advanced BGP/OSPF/RIP routeing system).
3. Install Snort
4. Install NMap
5. Install Nessus
6. Install one of the following (Demarc/Bigbrother/Bigsister/MTRG/Nmon...)

Eh voila
Need a DMZ? Install a third nic.

For all it's woes OpenBSD still kicks the crap out of linux which usually re-tools the BSD stack anyway (just like everyone else).
Remember the following rules, Firewalls do NOT need compliers, Routers are designed to do one thing and one thing only, and Ettercap is your friend.

Logging - HD or syslog across network

[billstewart]

If you're going to do logging, CD-ROM just doesn't cut it :-) You either need to use a hard disk, or else do your logging across a network. Alternatively, don't do logging, or only keep some summary logs in RAM.

Donwload over ed2k

[dassdraugen]

I find it rather cool that you can download it over emule/edonkey. Why can't more software vendors provide their demos / free releases over ed2k / bitT ?

Re:Need paper trail

[ted_nugent]

You're missing a DMZ port. If you're hosting any externally available services, and/or running wireless, you need a separate untrusted segment.

The trouble with smoothwall specs....

[L-s-L69]

I like smoothwall but the lie to you. Ive got it running on a 486 with 8M of RAM, not anywhere near the recommended 32M+. It works but i dont think im going to try VPN and caching with it. This is with both V1 and the V2 beta.

Any other Sonicwall experiences?

[markxsd]

It's a long story about how I got hold of it, but I use a Sonicwall SoHo as a firewall (+NAT gateway) for my home ADSL connection. I have to admit I do like the simplicity and Sonicwall's "buy what you need" policy. However, I'm not convinced as to how secure it actually is. For example, I believe my FTP client was spoofed while I was downloading a BSD distro. The Sonicwall did report and (supposedly) block an attempted spoof (from a Polish IP range), but I noticed that my PC (running a fully patched Linux distro) made a call to an unusual port on the address listed as the source of the spoof (this was blocked on the way out by the Sonicwall). Scary... Having said that, that is the one anomaly I've noticed in 6 months of use, so maybe it's not so bad.

As far as your need for enhanced activity reporting goes, have you considered using an IDS like Snort?

Re:Any other Sonicwall experiences?

[AssFace]

We are all on a single switch (theoretically that is, the actual hardware is more like 3 or 4 switches, but they are just pass through), so I suppose Snort might make a good option.

I will look into it - that would be a nice thing if I could just leave the firewall as is and get around it by sniffing - it is just a matter of how well I can format the logs. And I haven't looked in awhile, but I don't recall there being a Snort for Windows - I suppose there is likely a Cygwin option and then perhaps a "logs2html" sort of thing?

As for Sonicwall, I haven't seen anything like that on our systems - but then again, it is much easier to track down an issue with one user like that on this thing than it is to track down the issue between 20+ computers.

That said, we have had a few oddities with it off the top of my head that I have noticed:
1) Occasionally it will just freeze up and need to be rebooted - that is fine enough I guess since we are on a Windows network we are used to such things

2) Once in 6 months it has gone into "oh crap" mode where the wrench light on the front turns on and it kills our net connection, which is when we switch over to an emergency Linksys (home network) product that chokes under us usually (that was one thing that made me appreciate the Sonicwall more). Then we have to pass of the hardware to one of our IT consultants and he reformats the thing for us.

3) The other day I setup the firewall to allow port 6699 in (it was Friday, and I didn't mind if the user wanted to hog the network over the weekend when nobody was really here). I came in on Monday and the access on that was turned off. I didn't do it, and nobody else has access to the thing - I can think of one guy that technically knows the password, but he wouldn't know what is what in the layout in there.

In general, I'm not saying it is a bad product. But for our uses, I would have preferred something different if given the choice to do it from the get go.

Re:Any other Sonicwall experiences?

[markxsd]

Thanks for the info...

...Then we have to pass of the hardware to one of our IT consultants and he reformats the thing for us.

You can do this yourself by holding down the reset button on the back of the unit (need to use a pen or a screwdriver for this) for 30 seconds on power up. Of course, you'd need to download and apply the firmware patches through the web interface afterwards. This might save you some down time in future if you didn't already know about it...

FYI something else: I have had problems the power supply units on this and a previous Sonicwall (I've had two failures in 3 years - power supply stopped working and then managed to nuke the internals of my first Sonicwall appliance, the other power supply just stopped working). It might be worth spending $25 on keeping a spare given the number of reliant users you have...

Re:Any other Sonicwall experiences?

[AssFace]

We actually did try the reset in house and that didn't do anything on it. Then we did the total reset (the one that wipes it), but that broke it within our network - so that was why the consultant brought it out - he had a backup of settings close to what we needed and tossed those on. Then brought it back and used another backup that we had here (but which wouldn't work at first)... all in all, it was extremely annoying and confusing for the both of us (it wasn't behaving in a logical way). Part of me wonders if the device was just toasted and then he took it away and brought back a working one.

A user's machine just died today and I rebuilt it and got it working, but then someone from above authorized that she (his wife) get a brand new and nice machine (I think someone complained).
So that is on the way and this machine that I fixed up and is still a pretty decent machine - I am going to try to put this machine before our network, but after the Sonicwall.
That way I can run Snort on the network and get some proper logging.
For now I will leave it as an XP machine, but if I can't get enough functionality of it, then I will upgrade it to Linux or FreeBSD.

Got.. To.. fight.. the..black.. Ice!

[arabagast]

*sigh* useless, that`s some tough ice comrado.

Re:The trouble with smoothwall specs....

[Anonymous Coward]

The problem I encountered with small configuration like yours is that Smoothwall installation sets swap space to a rigid amount equal to twice the RAM amount. This is really too small.

Firmware

[nurb432]

I've tried all the available versions from their web page..

None seemed to make any difference, either better or worse..

We purchased SmoothWall

[siberian]

I run smoothwall corp on my network. With the hosting add-on its a real time-save. Feels more like an F5 then a linux'y firewall thing.

Sure, I can configure IpChains and all that crap, but why bother. I just need a simple webUI to move some rules around and allocate IP space between the public and private networks.

We're loving it. Well worth the few hundred bucks.

Complements to the Current Staff of Smoothwall

[os2mac]

at the risk of getting mod'd for doing a me too. I would just like to say that I started using smoothwall at home about 3 months ago. The install was simple and painless and took less than 10 minutes. and every time I have upgraded since then has only been better... I have not found any of the negativity that others are speaking of nor have i never NOT had a question answered to the fullest of their ablilities.

The Joys of Ownzor-ship

[poptones]

I had a problem with someone breaking into my home system. So, after giving up on a "software firewall" (ha!) I decided to give smoothwall a try - based, in large part, on positive comments here. I didn't care for the "license" part but I bit my tongue and gave it a shot.

OOB install, within just a few days my network was owned yet again.

After googling for a more objective balance of info on smoothwall I found the numerous (negative) comments about the guy behind it, as well as many positive discussions leading me to ipcop. Took me about an hour to wipeout smoothwall and install ipcop, and it has performed fantastically ever since.

Sorry, but I see absolutely no value in smoothwall. Why agree to a more restrictive license for the "opportunity" to use a less secure product?

problems with Vonage, TiVo, Xbox Live???

[The Lynxpro]

Has anyone experienced problems using IPCop or SmoothWall with such services as Vonage and devices such as TiVo or Xbox Live?

I currently use a Linksys router/firewall and Norton Firewall2003 on my XP machine, but I also have Xbox Live and my TiVo connected to my network and I want to sign on to Vonage so I'd like to know ahead of time if anyone has experienced problems with these services using these great firewall "solutions."

And yes, I know Vonage has "issues" with Linksys firewalls. Funny how a wholly-owned subsidiary of Cisco has P***-poor support (or lack thereof) for Mac OSX and Linux...

Re:problems with Vonage, TiVo, Xbox Live???

[wpanderson]

Has anyone experienced problems using IPCop or SmoothWall with such services as Vonage and devices such as TiVo or Xbox Live?

I've been using both TiVo (over Ethernet/ADSL) and Xbox Live over a SmoothWall connection since June 2002 / Dec 2002 respectively, no problems with either whatsoever.

Re:problems with Vonage, TiVo, Xbox Live???

[The Lynxpro]

"I've been using both TiVo (over Ethernet/ADSL) and Xbox Live over a SmoothWall connection since June 2002 / Dec 2002 respectively, no problems with either whatsoever."

Thanks for your testimony, Wpanderson. If you can do that over ADSL, I have more confidence in setting out with my little "experiment" using Comcast for my broadband connection. Now if only someone has used it with Vonage I'd really be a happy virtual camper right now! Thanks again! :)

Excellent idea

[Anonymous Coward]

go to it, my boy!

Re:It'd be nice to have Comparisons of these puppi

[BloodAngel_Au]

Ditto... I know I stubled onto something like this comparing linux distros, and it did have a section for these ones too, but danged if I can find it now. Can anyone help ?

READ THE FINE PRINT

[Anonymous Coward]

Installation Statistics

We anonymously collect when you install SmoothWall GPL or Express. This information is as follows: CPU type, speed, RAM, HD size, network card, connection type (modem/ISDN/ASDL/etc) and what version of SmoothWall GPL or Express you're running. We also try and figure out where you're from based on the first two octets of your RED IP address (i.e. the 12.23 part of 12.23.34.45). This allows us to gauge the penetration of usage by CPU and connection type, and plan ahead for future developments.

If you do not wish to have this information collected, then do the following before you first put your SmoothWall GPL or Express installation online:

* enable the SSH service under Services -> Remote Access
* login as root via SSH on port 222 to your SmoothWall GPL or Express installation using an SSH client
* enter the following command:

rm /var/smoothwall/notregistered && exit

and press RETURN
* this should remove the flag that tells your install to send the information anonymously to us, and disconnect from the login session
* you may now disable the SSH service under Services -> Remote Access if you wish

We will soon be publishing aggregate statistics based on the information collected to help users see both the scope and usage of SmoothWall software.

Re:Question About Smoothwall or firewalls in gener

[Anonymous Coward]

Um nope not here. If I want high end features I don't mind paying people for the work. They should be paid. People don't pay rent and feed their kids by pats on the back genius.