UNIX Firewalls

[Infernus]

I just wanted to ask if anyone knows of a really good firewall for UNIX that could compare to Bastille. I am very happy with Bastille and have been unable to find anything better within the past few months. I am not looking to get rid of Bastille, just looking to see what I can find. And, of course we all know that iptables/netfilter configured to your liking is the best of all but i am trying to see if there is a configurable one that can meet the quality of Bastille. Tell me if you find one.:)

[Chris]

Re: UNIX Firewalls

Originally posted by Infernus
I just wanted to ask if anyone knows of a really good firewall for UNIX that could compare to Bastille. I am very happy with Bastille and have been unable to find anything better within the past few months. I am not looking to get rid of Bastille, just looking to see what I can find. And, of course we all know that iptables/netfilter configured to your liking is the best of all but i am trying to see if there is a configurable one that can meet the quality of Bastille. Tell me if you find one.:)

You might want to qualify that...as in..FREE! Cuz there are TONS of commercial firewalls that I will take over bastille or ipfilters/chains anyday!

[Infernus]

FIRE

Yes, I am referring to freeware firewalls.

[converge]

Well... I'll pipe in and inquire about the commercial firewalls. Not everyone is in the position to evaluate commercial firewalls, let alone gain an opinion of one over another. So... to those who can, what is your favorite / most reliable? Why?

[netrambler]

I haven't used it , but you can try IPcop, I might try it soon. I'll tell you how it goes.

I've been using IPCop for about a month between my DSL connection and intranet and haven't had many complaints. All you need is an old computer with two NICS and the ISO image of IPCop that can be downloaded for free. Very easy setup and maintenance. I would highly recommend trying if you haven't already.

[bascule]

And, of course we all know that iptables/netfilter configured to your liking is the best of all but i am trying to see if there is a configurable one that can meet the quality of Bastille.

I'm not sure exactly what you would consider to be "quality", however as far as raw packet filtering power I think you'll be hard pressed to match the world's foremost stateful packet filter, pf

[skroo]

Well... I'll pipe in and inquire about the commercial firewalls. Not everyone is in the position to evaluate commercial firewalls, let alone gain an opinion of one over another. So... to those who can, what is your favorite / most reliable? Why?

Cisco's Pix series. Good configuration, solid, and when coupled with a properly-configured dynamic network IDS, extremely effective in keeping idiots at bay.

[EeeekPenguins]

I would have to second skroo on using the Cisco pix firewalls. They are confusing though.

[sysctl]

checkpoint FW-1 hands down.

however since i don't have $30k+ to drop on a personal firewall appliance (estimated cost of initial software, hardware, support contracts, features, etc), my vote goes to ipf. well supported by several unix and unix-like operating systems (*bsd, irix, solaris, qnx, etc), stateful inspection, transparent proxying (through ipnat), extensive logging features, etc. pf comes in a close second though. logging to pcap format, QoS (altq merger), etc. the only reason i prefer ipf is the portability. i'm a lazy person by nature and being able to migrate my rules script from OS to OS is nice (with the exception of network interfaces/names).