精华区文章阅读

发信人: netiscpu (说不如做), 信区: Unix
标  题: [M] Linux下的防火墙软件
发信站: 紫丁香 (Wed May 20 18:55:53 1998), 转信

        本文摘自Linux-admin Mailling-List

[问题] Firewalling for Linux

Folks,
anybody know of any _free_ firewalling packages for Linux, ie - which can
be run in a commercial environment without licensing hassles?

If not, can anyone recommend any _cheap_ packages.

Yes I know about the TIS toolkit, but the license prohibits you from
using their software commercially.

Cheers

Paul

---------------------------------------------------------------------------

                                           ,---
    Paul Wilkins                          | o o |
    Internet Operations Manager           ` \_/ '         Linux
    TMP Worldwide                         /\___/\         The Choice of
    paulw@tmpw.com.au                    |_/ . \_|        A GNU Generation
    http://www.monsterboard.com.au       \_/___\_/
---------------------------------------------------------------------------

[回答1]

I think you need squid.

--
Suman

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Suman Saraf                         | Web:: http://www.hssworld.com/     |
Satellite Networking Division,      | Phone:: 91-343703 Ext 2207         |
Hughes Software Systems,            | PGP public key on request.         |
Plot 31,Sector 18,Gurgaon,India     | Unsolicited mails read at 20$/min  |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[回答2]

ell, squid, and some others. Squid will give you your http proxy.
I'm looking for some way of proxying ftp, news, mail etc.

Cheers

Paul

---------------------------------------------------------------------------

                                           ,---
    Paul Wilkins                          | o o |
    Internet Operations Manager           ` \_/ '         Linux
    TMP Worldwide                         /\___/\         The Choice of
    paulw@tmpw.com.au                    |_/ . \_|        A GNU Generation
    http://www.monsterboard.com.au       \_/___\_/
---------------------------------------------------------------------------

[回答3]

install socks.
socks.nec.com

--
Suman

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Suman Saraf                         | Web:: http://www.hssworld.com/     |
Satellite Networking Division,      | Phone:: 91-343703 Ext 2207         |
Hughes Software Systems,            | PGP public key on request.         |
Plot 31,Sector 18,Gurgaon,India     | Unsolicited mails read at 20$/min  |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[回答4]

I think IP Masquerade can do.

-ans-

[回答5]

ipfwadm comes with most distribution of Linux secue, easy to use and
maintain.

        Chaiya

[回答6]

What's wrong with the kernel's built-in firewall? And it doesn't
get any cheaper...

-Rob
--
Rob Riggs                        Devil's Thumb Entertainment
Network Administrator            Boulder, CO - (303) 938-1200
rob@DevilsThumb.COM              http://www.DevilsThumb.COM/~rob
"The notion of errors is ill-defined." - IRIX 'netstat' man page

[回答7]

ipfwadm and port redirection.

Irfan Akber

[回答8]

Hi Paul,
here a repost of an info I give out often. Maybe it's a good idea,
to put this onto static place ? FAQ ?

The most famous firewalls for Linux are the buildin capabilities
managed with ipfwadm - no additional tools required -
and TIS FWTK and SOCKS.

1. Linux has the first type of firewall support buildin,
which is usually maintained with - see: man ipfwadm
- - -
But this is a type of packet filtering router and is
suitable for dividing subnets or as a simple
firewall, if the connection with internet is NOT
24 hours AND with a dynamic IP. If in use 24 hours with
a leased line and a static IP - it's not secure enough.

Two application level firewalls are
2. TIS FWTK
This is the most famous kit in the Linux community

3. SOCKS
The other Application level Firewall (exactly: circuit level),
called SOCKS5, look here:
http://www.socks.nec.com/
and
http://www.socks5toolkit.nec.com/

Performance diff.:
Type 1 does not need as much computing power as type 2 or 3.

The SOCKS5 package compiles and runs *smooth* on Linux (ELF)
without any problems, it's easy of use and has features which
gives you the ability for VPN.    Now any apps can be
socksified - not the restrictions as FWTK. The FWTK has
some advantage in that there can be a setup more restrictive for
the office staff, but both (SOCKS5 and FWTK) give high protection
from outside. But SOCKS5 is much more flexible and user friendly.

Additionally as I know from many other mailings, the SOCKS
has a better performance than FWTK. The machine we use
for SOCKS5 is a EPoX-mainboard, P166+ CyRIX, 32 MB RAM,
AHA-2940 + 2 GB SCSI (500 MEGA is enough also), two
NE-2000 compatible cards and if 10 - 15 ? people are mailing and
surfing, the load on the machine is pretty high sometimes... so
for a bigger office I would consider a 200 Pro + and 64 MB RAM.

The bastion host is dual homed with different IP on both network
cards. To setup/install the cards, I reserved a small DOS-
partition for the DOS tools of the cards, in Linux then, since
Linux recognizes only one card alone, I enter parameters into
lilo.conf (see HowTos for multiple ethernet...)

Even it's a server, I recommend to install X-windows for the
first time, you have a good control in several windows and
SOCKS5 has additional abilities of graphical statistics...
It'a good to be able to watch both cards and the output of
the SOCKS5 server (debugging mode) plus machine load.

(NOTE:
X-Windows has vulnerabilities concerning security !!! -
so the bastion host should run later without X. SOCKS5 has
tools for logging and statistics running on another machine)

Additionally on such a firewall can be installed a
proxy server, wich caches content for your users.
But with that I have no practical experience yet.
Squid is famous and by reading mailings maybe best.

I highly recommend to take a good book on firewalling.
It helps also to consider the right security and network
arrangement for most situations.

--
Ludwig Richter     CGI consult     http://www.cgicon.com/
Lu@cgicon.com        With Acknowledge: richter@cgicon.com
_________________________________________________________
Sent with Netscape Communicator 4.04 on Linux (K. 2.0.33)

[回答9]

Nothing if you're content with a packet level filter. I'm looking for an
application level proxying firewall. Socks or fwtk are much more secure,
though granted, a packet filter is much better than nothing.

Cheers

Paul

---------------------------------------------------------------------------

                                           ,---
    Paul Wilkins                          | o o |
    Internet Operations Manager           ` \_/ '         Linux
    TMP Worldwide                         /\___/\         The Choice of
    paulw@tmpw.com.au                    |_/ . \_|        A GNU Generation
    http://www.monsterboard.com.au       \_/___\_/
---------------------------------------------------------------------------

--

                              Enjoy Linux!
                          -----It's FREE!-----

※ 来源:．紫丁香 bbs.hit.edu.cn．[FROM: mtlab.hit.edu.cn]

Linux 版 (精华区)