RE: documentation netfilter

["John A. Sullivan III" <jsullivan@opensourcedevel.com>]

On Wed, 2005-09-14 at 11:20 +0200, kossentini_3@voila.fr wrote:
> hello,
>  Within the framework of my project of end of study, I must choose best the firewall open source and then I must develop new functionalities so that it is same level as check point or another owner firewall (for example cisco Centri Firewall...). 
>  
> can you help me in this subject? which is the best  firewall open source (if there is one of the bonds towards site, a study)...? 
> thank you in advance 
<snip>
From everything I have seen, iptables combined with other open source
projects such as iproute2 and {open,strong}swan is far superior to
CheckPoint and most other commercial firewalls.  In fact, it amazes me
that no one has commercially exploited this yet with significant
success.  Even some of the more successful linux based solutions are
using fairly old technology.

iptables not only excels in functionality but in flexibility.

The main disadvantage I have found is the dearth of enterprise/carrier
grade management tools.  One can do more with iptables than one can do
with Checkpoint if one administers one firewall at a time (or several).
For smaller environments, it is better than learning a complex user
interface.  But there is nothing akin to Provider1, Solsoft or
SmartPipes for very large deployments of hundreds and thousands of
firewalls with thousands to hundreds of thousands of users with highly
complex security.

Although one can make iptables do far more than Checkpoint in such
scenarios, the manpower cost of managing such an installation with open
source tools is prohibitive.

That is why we have been working on the ISCS project
(http://iscs.sourceforge.net). This project exceeds the capabilities of
tools like Provider1, Solsoft and SmartPipes yet is entirely open source
and works with open source products like iptables, iproute2 and *swan.
Unfortunately, I've been mostly pulled off the project for the last year
+.  If anyone would like to jump in and help so we can fill this missing
gap and make open source firewalls a superior choice to commercial
products on all fronts - not just functionality and flexibility but
management, too, please let me know - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@opensourcedevel.com

Financially sustainable open source development
http://www.opensourcedevel.com