Re: Distributed firewall

Re: Distributed firewall

[Antony Stone]

On Monday 26 July 2004 3:03 pm, Gianni Mantellini wrote:

> Hi to all, I'm new in this mailing list. My interest is if there's anybody
> who knows a "Distributed Firewall" for PDA's who mount the Familiar
> distribution of Linux, even commercial or open source.

Does Familiar Linux load a fairly standard kernel?   If so, depending on what 
size it's allowed to be (I'm assuming that PDAs have restricted memory for 
this sort of thing, like embedded systems), you should be able to compile the 
normal netfilter options and do your firewalling as usual?

Remember that netfilter isn't an application which runs on the system - it's 
part of the kernel, so it should work on anything which talks TCP/IP.

Or maybe there's something about Familiar Linux (which I'm not familiar with, 
BTW) which means this isn't possible...?

Regards,

Antony.

-- 
The truth is rarely pure, and never simple.

 - Oscar Wilde

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Distributed firewall

[Craig Steadman]

Hi

Its still under development, has been tested on ipaq 5450 running
familiar linux with iptables (stand alone mode).  It will support
distributed control in the next release.  I'm in the process
implementing better QoS right now.   

http://bastionx.sourceforge.net/

Cheers
    Craig

On Mon, 2004-07-26 at 22:03, Gianni Mantellini wrote:
> Hi to all, I'm new in this mailing list. My interest is if there's anybody
> who knows a "Distributed Firewall" for PDA's who mount the Familiar
> distribution of Linux, even commercial or open source. Sorry for my English
> and thanks to all.
> 
> 

Re: Firewall IP change

[Antony Stone]

On Monday 26 July 2004 2:20 pm, Frédéric Gonzatti wrote:

> Thanks Antony,
>
> According to your explanations I think I 'd rather to include the following
> line in my iptable script :
> iptables -A POSTROUTING -t nat -o eth2 -j SNAT --to 62.160.X.Y
>
> But to be sure : I've got two computers on my DMZ which have IP included in
> 192.168.2.0/255.255.255.0 and other computers on my LAN which have IP
> included in 172.16.0.0/255.255.0.0  and static public IP on my WAN
> Firewall. So the best way is to use the line you advice me ?

Yes.

> Where on my script do I have to add this line ? At the beginning, just
> after a modprobe iptable_nat line ?

I like to put it just before or just after the FORWARD rules, because it's for 
packets which are being routed through the firewall.

> Last question : Do you see some clumsy things or errors in my script ?
> Unfortunately I think there are .... ;-(

You have approximately twice as many rules as I would expect to see - you are 
allowing each individual protocol (defined by its source port)n in an 
ESTABLISHED rule; most people would just use one ESTABLISHED rule to allow 
all reply packets, no matter which protocol.

Also you have specific rules for FTP data connection on port 20 - better to 
just leave these out and handle the packets as RELATED to the control 
connection on port 21.

I prefer a simple ruleset if possible because it's easier to work with.

Regards,

Antony.

-- 
The difference between theory and practice is that in theory there is no 
difference, whereas in practice there is.

                                                     Please reply to the list;
                                                           please don't CC me.

Distributed firewall

[Gianni Mantellini]

Hi to all, I'm new in this mailing list. My interest is if there's anybody
who knows a "Distributed Firewall" for PDA's who mount the Familiar
distribution of Linux, even commercial or open source. Sorry for my English
and thanks to all.