Slashdot Mirror
Ask Slashdot: User-Friendly Firewall For a Brand-New Linux User?
An anonymous reader writes "I am a new Linux user; I'm on 2nd day now. Currently I am trying out Ubuntu, but that could change. I am looking for a user friendly firewall that I can set up that lets me do these things:1) set up a default deny rule 2) carve out exceptions for these programs: browser, email client, chat client, yum and/or apt. 3) carve out exceptions to the exceptions in requirement 2 — i.e. I want to be able to then block off IPs and IP ranges known to be used by malware, marketers, etc., and all protocols which aren't needed for requirement 2. It also needs to have good enough documentation that a beginner like me can figure it out. Previously, I had done all of the above in AVG Firewall on Windows, and it was very easy to do. So far, I have tried these things:1) IPTABLES — it looked really easy to screw it up and then not notice that it's screwed up and/or not be able to fix it even if I did notice, so I tried other things at that point... 2) searched the internet and found various free firewalls such as Firestarter, GUFW, etc., which I weren't able to make meet my requirements. Can someone either point me to a firewall that meets my needs or else give me some hints on how to make firestarter or GUFW do what I need?"
Shorewall is a pretty good iptables configuration tool.
I would suggest installing WINE and then running Windows Firewall.
I can understand trying to wall off Windows from what you can, but with non-Windows you just make sure you only enable services that you want. Use good passwords, lock it down so only what you want running can run, and don't listen to the script kiddies knocking on your door. Crank up the stereo.
I assume your box hangs off a router of some sort? It's probably all you need for a firewall.
"Tongue tied and twisted, just an Earth bound misfit
Many of the posts so far direct the original poster to dedicated firewall appliances or distributions. If I read the summary correctly, the OP is simply looking for a good GUI to manipulate the firewall rules built into the kernel of all modern Linux distributions.
I can't vouch for any of them, but GUI frontends include guardog, lokkit, firestarter, and probably others. They are all in various states of development and maintenance.
Part of what the user wants to do (firewall per app) wasn't possible in the past with iptables (per-gid blocking was easy), but I believe it's now possible. A primitive daemon, called Leopard Flower, seems to offer this functionality: http://leopardflower.sourcefor...
From what I can see, the most promising, integrated, easy-to-use firewalling GUI software going forward is Fedora's firewalld and it's accompanying GUI. I know firewalld is available on Ubuntu (and its command-line interface). I'm not sure about the GUI part. Perhaps someone familiar wit Ubuntu can comment. Here's an article on installing it in Mint, so I assume it's similar in Ubuntu: http://www.linuxbsdos.com/2013...
From what I can see, firewalld and firewall-config hit the sweet spot for most desktop users. I'd never use it on my router, but for a desktop, it works pretty well and is under active development. I imagine it will sport per-application feature soon, if it doesn't already.
You're making the assumption that all the bad stuff is outside the firewall and nothing evil ever gets in.
An example of how I use my firewall, is I block my email program from making any network connection other than imap/smtp. If it tries to make any other network connection (eg: downloading images from a web server), the firewall blocks it.
I just jumped into playing with pfsense. It's based on FreeBSD, but it was very easy for me to get in and mess around with. :)
bork bork bork!
The parent poster is correct. Windows and Linux are totally different animals in regards to firewalls. There is only one firewall for Linux and it is built into the system. IPTables is how the firewall is configured. All other tools are just front-ends or wrappers for IPTables.
IPTables doesn't have support for application-based firewalling. You can do that kind of thing using something lilke the Grsecurity patch for the kernel, but it is not for beginners.
Grsecurity will let you create policies exactly like what you're talking about and then some. For example, it will allow you to create a policy limiting which files and folders a given program can access. To be specific, on my machine I have a policy that Firefox can only write data to it's own folders and to my Downloads directory, and can't execute/run any files inside those folders. That way, if somebody hits me with a drive-by download or something it simply won't work.
I have to add that some of this stuffed is handled by SELinux. If you wan't an CGI script to be able to send an email on a Red Hat derivative, you have to explicitly add the rule to your SELinux configuration
You may want to have a look at: https://www.pfsense.org/ Very good option...
Nothing wrong here: the Windows firewall is designed for keeping malware inside the PC and out of the Internet, the other firewalls are designed for keeping malware on the Internet out of the computer.
Actually iptables does have support for matching based on the process. You might have run commands that include "-m recent", or similar. The "-m" is used to specify a module-name, and there are many matching modules available and included by default.
For example on a CentOS system you might allow your webserver to make outgoing SMTP connections via something fun like this: "iptables -A OUTPUT -m owner --cmd-owner httpd --dest-port 25 -j ACCEPT". (Why CentOS? Because it matches the command against HTTPD. On Debian systems the webserver process is more typically called 'apache2'.)
Hope that helps.
For example on a CentOS system you might allow your webserver to make outgoing SMTP connections via something fun like this: "iptables -A OUTPUT -m owner --cmd-owner httpd --dest-port 25 -j ACCEPT". (Why CentOS? Because it matches the command against HTTPD. On Debian systems the webserver process is more typically called 'apache2'.)
The cmd-owner match was removed in kernel 2.6.14 because it was broken with SMP.
I'm a little surprised nobody has mentioned firehol - http://firehol.org/. I've been using it for my simple needs, and it is fabulous. Easy to learn, simple language, great results, and CLI-friendly. (Prior to discovering it, I used guarddog, which I found to be good but which isn't anywhere near as good as firehol.) From the firehol page: FireHOL is an iptables firewall generator producing stateful iptables packet filtering firewalls, on Linux hosts and routers with any number of network interfaces, any number of routes, any number of services served, any number of complexity between variations of the services (including positive and negative expressions).
This expert trusts Windows 8 for my family's security. All the UAC prompts frustrate the would-be penetrators so they move on to other targets. And since there's no way to find the shutdown button, it provides my loved ones with rock solid, around-the-clock protection from evildoers.
Microsoft. Because your family's well-being shouldn't be entrusted to dirty hippies.
You want someone two days into a simple desktop linux system to get a consumer appliance?
Surely there should be some simple point-and-click app he can install from the desktop that will prevent basic misbehaviours. The very act of asking here shows that he does indeed have pride enough to want not to be a menace.
No. Well...maybe. Actually, yes. It really just depends.
he wants a global way of configuring which applications have the capability to connect to what servers or open what ports. This is a different meaning of 'firewall' than is used in the Unix world.
AFAIK there's already some capability enforcement prohibiting some programs from accessing the Internet in modern Linux distributions, but, I don't really know how it's configured either.
I simply use an alternate user to arrange this. In my case, it's the Windows games I run via Wine. I don't trust them and I have no need for single-player games to connect to remote servers.
/etc/pam.d/su. I simply add this to the file on its own line: "session optional pam_xauth.so". Now the alternate user "winegames" can open new windows on the X server started by my main user.
So I create a user named "winegames". I run all Windows games as this user. Then I add a simple iptables rule:
iptables -A OUTPUT --match owner --uid-owner winegames -j REJECT
Now nothing run as "winegames" can connect anywhere. A few games will briefly complain that they can't connect to the server so that people who don't care can see my in-game achievements but that's alright. Also, I use REJECT instead of DROP so that the programs get an instant error when they try to connect. If you use DROP they will waste a lot of time waiting for a response that will never come.
Incidentally, if your distro does not provide this, you will need to add a line to your PAM config to allow alternate users to open windows on your X display. For my distro (Gentoo) the file is
It is a miracle that curiosity survives formal education. - Einstein
I know you're new to the linux world, but while you're at it, dive into the BSD realm while you're at it.
You can do Firewalling with packet filter instead of iptables (better session tracking). BSD is generally better as a network appliance than linux for a number of reasons, and for firewalling especially. Better session tracking, better dynamic protocol handling, better error and flow control, and generally more robust. Iptables is powerful, but it has its downsides that can be felt these days with higher network speeds, IPv6, and dynamic network protocols which is why the linux kernel is moving away from it to NFTables. But NFTables is not yet complete, hence we circle back to BSD with its pf package.
pfSense offers exactly what you're looking for and probably more. It provides a gui and cli to manage the device and a robust user/support community. Beyond firewalling you can do proxy, captive portal, VPN, DNS, DHCP, NAT, IPS/IDS, and a whole lot more. It has a webGUI and sets up in all of about 10 minutes.
It packs all of the features you would see on "enterprise class" firewalls, just open source.
https://www.pfsense.org/