Firewall software.

From: TLOlczyk (olczyk2002_at_yahoo.com)
Date: 09/29/05 

Date: Thu, 29 Sep 2005 00:02:12 GMT

For the first time, I am going to have a Linux box on the web.
( Before I had a Windows box on the web, principly for work
reasons. I only kept one box on the web; the idea being that
if anyone broke into it I would be limiting the damage to the one
computer. ) I haave completed the base installation and am now
preparing to go on. Before I connect the computer to the web,
there is one thing I feel I must do. Install a firewall.

Now the first thing, I want to clarify what I mean by firewall, since
it seems that the way the term is used in the Windows world and
the networking world in general is different. I mean a piece of
software that examines packets as they are being sent to and from
the TCP/IP stack, and either blocks the packet or lets it through,
depending on cetain criteria. I will call this a "softwarer firewall".

>From what I've seen there appears to be only one true software
firewall for Linux: ipchains. All other software firewalls are really
enhancements to ipchains, built on top of it. Can someone clarify.

Assuming there are other software firewalls, there are three major
properties I am looking for (these are the aspects of ZoneAlarm that
I really think are necessary):

1) Dynamic control of ports.
By this I mean that I want to be able to open or close a port
without haviing to reboot or restart a daemon. By example, let
us say that firefox is trying to access
http://www.somedomain.com:7999, but fails. I check the firewall
logs and see that the firewall blocked the request because port 7999
is not open to firefox. I then "send a message" to the firewall saying
open port 7999. Then I retry getting the page. This time the firewall
lets the request through.

2) Control of both incoming and outgoing packets.
Some firewalls only prevent incoming packets from coming in,
presumably to prevent someone from breaking into your computer.
But these days a lot of time when you computer has been subverted,
it is used to break into other computers.

3) Application specific control.
I don't simply want to say "open port 80". I want to say "open port 80
for firefox, but not for ssh or ftp".

Suggestions?

Thanks

The reply-to email address is olczyk2002@yahoo.com.
This is an address I ignore.
To reply via email, remove 2002 and change yahoo to
interaccess,

**
Thaddeus L. Olczyk, PhD

There is a difference between
*thinking* you know something,
and *knowing* you know something.

Relevant Pages

  • Re: keeping ports open
    ... If a port is open, it means that 1) a software or service is running on your ... and 2) you're not using a firewall or your firewall isn't ... Use firewall software and hardware and antivirus software that is ... Follow the instructions for hardening Windows and IIS at ...
    (microsoft.public.security)
  • Re: How to Maintain an IIS Server?
    ... > server running on a Windows 2000 server. ... before a firewall and antivirus have been installed]. ... open ports; however, this will not identify which program is using the port. ...
    (microsoft.public.inetserver.iis.security)
  • Re: CEICW fails at firewall config
    ... ISA Server prevents connection to a remote desktop when you connect through ... Remote Web Workplace on a Windows Small Business Server 2003-based computer ... Acceleration Server as a firewall. ... connection uses TCP port 4125. ...
    (microsoft.public.windows.server.sbs)
  • Re: [opensuse] Interactive Firewall Needed
    ... That situation is impossible in Linux, as the firewall can not track to ... not to outgoing packets, and there is no info to link this to whatever ... application might have opened that port for listening. ...
    (SuSE)
  • Re: How to Maintain an IIS Server?
    ... >> server running on a Windows 2000 server. ... > before a firewall and antivirus have been installed]. ... > program or executable using that port. ...
    (microsoft.public.inetserver.iis.security)