Ask Slashdot: User-Friendly Firewall For a Brand-New Linux User? 187
An anonymous reader writes "I am a new Linux user; I'm on 2nd day now. Currently I am trying out Ubuntu, but that could change. I am looking for a user friendly firewall that I can set up that lets me do these things:1) set up a default deny rule 2) carve out exceptions for these programs: browser, email client, chat client, yum and/or apt. 3) carve out exceptions to the exceptions in requirement 2 — i.e. I want to be able to then block off IPs and IP ranges known to be used by malware, marketers, etc., and all protocols which aren't needed for requirement 2. It also needs to have good enough documentation that a beginner like me can figure it out. Previously, I had done all of the above in AVG Firewall on Windows, and it was very easy to do. So far, I have tried these things:1) IPTABLES — it looked really easy to screw it up and then not notice that it's screwed up and/or not be able to fix it even if I did notice, so I tried other things at that point... 2) searched the internet and found various free firewalls such as Firestarter, GUFW, etc., which I weren't able to make meet my requirements. Can someone either point me to a firewall that meets my needs or else give me some hints on how to make firestarter or GUFW do what I need?"
Shorewall (Score:5, Informative)
Re:Shorewall (Score:5, Insightful)
Bastille-linux is also something that was fairly easy to use in the past. I used that before shorewall, but I haven't used bastille for years, must be a least a decade so I don't know what the current state of it is.
Re: (Score:2, Funny)
Shorewall is very nice. For the user I would suggest using it and installing webmin to configure it. Webmin does an OK job configuring shorewall which is already pretty easy to set up, just it can be fairly confusing for the first timer with all the config files. After the first few times with webmin you learn how to do it with the command line and vim.
So let me sort this out, in order to easily configure iptables, shorewall is a good solution, but to configure shorewall, I will want to use webmin. So what do I need to install to configure webmin?
No wonder why the year of the linux desktop will never be.
Re:Shorewall (Score:5, Funny)
So what do I need to install to configure webmin?
The IQ of a chimpanzee should suffice.
Re: (Score:2)
With our without poop throwing?
Re: (Score:2)
The throwing of fecal matter is optional. That's the beauty of open source; it allows the user to have a choice.
Re:Shorewall (Score:4, Informative)
So let me sort this out, in order to easily configure iptables, shorewall is a good solution, but to configure shorewall, I will want to use webmin. So what do I need to install to configure webmin?
You might be surprised to find that using several layers of abstraction is relatively common in the computer world, and that your much vaunted probably does something very similar.
Re:Shorewall (Score:4, Informative)
You a word there.
I think you meant Windows does the same thing? Indeed, netsh is used to manage firewall rules on the command line level, and the Windows firewall snapin uses netsh. There are 3rd-party programs that replace the snapin or make it more intuitive like wfc from BiniSoft. I'm not sure if it replaces the regular snapin or runs on top of it.
Re: (Score:2)
Re: (Score:2)
< and > are your friends.
Re: (Score:3)
Go back to the original spec. The poster wants a stable, sophisticated, flexible firewall. They also want it to be easy to configure. These are distinct, and to some extent contradictory requirements. And yes, for a new admin, the built-in "iptables" and most Linux firewall tools are confusing. Shorewall has a good reputation as robust and stable, and Webmin has an _excellent_ reputation as being a tool that makes system management much, much, easier.
In fact, testing webmin with just "Linux Firewalls" confi
Re: (Score:2)
Then he needs to install DD-WRT on a router in front of his PC.
Re: (Score:3)
Then he needs to install DD-WRT on a router in front of his PC.
+1 insightful.
Even though that's not what he asked for, that's the best suggestion so far. Yes, the parent poster obviously realizes that firewalls are still needed on the PC's. Castles need moats as well as walls.
He's worried about security, and this will *HELP* do the job on all his PC's, and automatically provide some protection to every box that happens to connect to his network. It will also do it's job no matter what gets plugged in, and even provide some protection if he happens to plug in some ma
Re:Shorewall (Score:4, Informative)
_This_ is why many people hate asking It for help. Rather than answer the questions as stated, the poster is being told to buy more hardware and learn to program it himself by fan boys of half a dozen different toolkits, many of them requiring new hardware, without a good guideline to compare them, and many of them that require quite a bit of learning to master. Many of the suggestions are completely unsuitable to many environments: carrying a spare router around to put in front of a laptop is impractical. And even with a commercial grade firewall router in _front_ of a local network, that provides no protection against internal attack by infected laptops or houseguests:. And let's be honest, many households do leave their home wireless networks open to visitors.
The built-in iptables in most Linux systems is not *bad*, and quite suitable for home use. I just took a look at the current release of webmin, and the interface to manage iptables is really quite good: just remember to not accidentally cut off the webmin interface while firewalling off other traffic.
Re:what he actually wants to configure is applicat (Score:4, Informative)
he wants a global way of configuring which applications have the capability to connect to what servers or open what ports. This is a different meaning of 'firewall' than is used in the Unix world.
AFAIK there's already some capability enforcement prohibiting some programs from accessing the Internet in modern Linux distributions, but, I don't really know how it's configured either.
I simply use an alternate user to arrange this. In my case, it's the Windows games I run via Wine. I don't trust them and I have no need for single-player games to connect to remote servers.
/etc/pam.d/su. I simply add this to the file on its own line: "session optional pam_xauth.so". Now the alternate user "winegames" can open new windows on the X server started by my main user.
So I create a user named "winegames". I run all Windows games as this user. Then I add a simple iptables rule:
iptables -A OUTPUT --match owner --uid-owner winegames -j REJECT
Now nothing run as "winegames" can connect anywhere. A few games will briefly complain that they can't connect to the server so that people who don't care can see my in-game achievements but that's alright. Also, I use REJECT instead of DROP so that the programs get an instant error when they try to connect. If you use DROP they will waste a lot of time waiting for a response that will never come.
Incidentally, if your distro does not provide this, you will need to add a line to your PAM config to allow alternate users to open windows on your X display. For my distro (Gentoo) the file is
Re: (Score:2)
Using different users is a nice solution, which I use to run the browser. You can also start the applications using kdesu or gnome-sudo; then you don't need to add a pam configuration. Just a heads up to the parent, I can't find a damn way to get sound from the applications after adding pulseaudio. (Every time I need to watch a video with sound I have to copy the URL into a browser running as my own user. I've got the browser user to use a dummy sink, so it just doesn't play sound, doesn't crash or anything
Re: (Score:2)
I never installed it on my Gentoo system. On my Mint systems, removing Pulseaudio is one of my first post-installation steps.
If I want to play sound over a network I export a read-only filesystem containing my media to the machines on my LAN (Samba does this nicely). Then I can play video and anything else over the network too, in a transparent way. I've never seen a single benefit of running Pulseaudio but I have seen lots of diff
Re: (Score:2)
AFAIK there's already some capability enforcement prohibiting some programs from accessing the Internet in modern Linux distributions, but, I don't really know how it's configured either.
Can't add much, but the systems are called AppArmor and SELinux. Just wanted to note that this may indeed be a great opportunity for the security focused. You have to choose a distro that supports the system you like best. There are GUIs for configuring them, but they aren't very mature I think.
Re: (Score:2)
AFAIK, Fedora 20 has a very good firewall offering, and it is presented as a dynamic software, meaning that you can make changes to network protections, etc., on the fly.
Astaro / Sophos (Score:1)
I've used Astaro for years and been very happy with it. It includes many free features (VPN is great) and there are other features you can add for a fee. Sophos purchased it a couple of years ago and still have a very featured free version.
http://www.sophos.com/en-us/pr... [sophos.com]
Re: (Score:2)
Totally concur. Best product I've used in decades.
Re: (Score:2)
Totally concur. Best product I've used in decades.
That being said, it runs on a separate box and supports things like balancing multiple uplinks and fail-over, so it's a wee bit beyond the stated requirements.
Re: (Score:2)
Re: (Score:2)
Because it is no longer updated. I used to use it too, but it doesn't work with the latest stable Debian and its Kernel versions. :(
Re: (Score:2)
Re: (Score:2)
It totally was. :(
User friendliest: (Score:5, Funny)
Re: (Score:2)
I would suggest installing WINE and then running Windows Firewall.
WTF !!! are you "fracked in the head " ?
iptables is way better
anyway you could not even do that
Re:User friendliest: (Score:5, Funny)
case $- in ;; /dev/ttyx ]; then
*i* ) # Interactive shell
if [ -f ~/noob ]; then
source ~/noob
fi
esac
if [ -z "$DISPLAY" ] && [ $(tty) ==
whoosh
fi
Re: (Score:2)
Re: (Score:2)
Do not feed the trolls.
I don't think that phrase means what you think it does.
Re: (Score:2)
Re: (Score:2)
Geek Squad
Experts Recommend (Score:1)
Something based on Windows XP if you value your family's security.
Re: (Score:2, Funny)
This expert trusts Windows 8 for my family's security. All the UAC prompts frustrate the would-be penetrators so they move on to other targets. And since there's no way to find the shutdown button, it provides my loved ones with rock solid, around-the-clock protection from evildoers.
Microsoft. Because your family's well-being shouldn't be entrusted to dirty hippies.
OpenBSD (Score:1)
If you are willing to learn how to use a text editor, OpenBSD's pf is a pretty great home firewall. I run it on little Soekris box at home.
You will have a little learning curve, but you'll be getting a real firewall out of it.
The pf documentation is pretty good, and there are a ton of tutorials out there. Calomel.org has what is possibly the best one.
some notes (Score:2)
I know you've said you're trying to avoid screwing it up, but if you want, the CentOS wiki is pretty good for explaining what and why, and since it's a kernel firewall, it applies to Ubuntu too. In fact, I suspect all other "firewall tools" are basic GUI frontends to iptables. If you are indeed concerned about firewalling (though not quite as concerned as crypto-specialists), you probably at least want to have a go at it manually with some easy to understand notes
When in doubt, try it on a virtual machine o
Re: (Score:2)
I agree - all the 'firewalls' are really just iptables configuration guis.
In the day I used to use APF [rfxn.com], a text-based configuration tool. It was very easy to use.
Little Snitch (Score:2)
Have you tried Little Snitch [obdev.at]? When an app tries to open an outgoing port, it intercepts it and pops up a dialog giving you the option to allow the app to open any port, just that port, just to that target -- and then you can qualify that with once, until reboot, or forever.
You can edit these settings later if you have a reason to.
I've found it to be very useful, and certainly not difficult in any way.
Not affiliated, just a happy customer.
Why? Is it really necessary? (Score:4, Insightful)
I can understand trying to wall off Windows from what you can, but with non-Windows you just make sure you only enable services that you want. Use good passwords, lock it down so only what you want running can run, and don't listen to the script kiddies knocking on your door. Crank up the stereo.
I assume your box hangs off a router of some sort? It's probably all you need for a firewall.
Re:Why? Is it really necessary? (Score:5, Interesting)
You're making the assumption that all the bad stuff is outside the firewall and nothing evil ever gets in.
An example of how I use my firewall, is I block my email program from making any network connection other than imap/smtp. If it tries to make any other network connection (eg: downloading images from a web server), the firewall blocks it.
Re: (Score:2)
... you just make sure you only enable services that you want.
I block my email program from making any network connection other than imap/smtp.
Is there an echo in here?
Re: (Score:2)
1997 called and wants its comment back...
Re: (Score:2, Insightful)
1997 called and wants its comment back...
For machines which are not routers the comment is just as valid now as it was then. If you use a GNU/Linux distribution that takes security seriously then it will not install any externally-visible network services by default. The attack surface in that condition is small enough that installing a firewall won't help much, and might even make matters worse. If you deliberately install any public-facing network services then you need to add matching firewall rules, so again no benefit.
A firewall does help if
Re: (Score:2)
When was the last time you were party to a serious information security audit? I get the feeling you don't protect data of substantial value for a living.
In any event, this only protects against internal incompetence rather than external malice, so is not a necessary part of running a secure system.
You forgot to mention internal malice.
Re: (Score:2)
In any event, this only protects against internal incompetence rather than external malice, so is not a necessary part of running a secure system.
You forgot to mention internal malice.
Let's put my comment back into context. I was talking about forgetting to bind a private network service to the loopback interface. That would normally be done by an administrator. If an administrator is acting maliciously then you have fairly serious problems with or without a local firewall. In fact, this is a pretty good demonstration of my point that if you are going to use a firewall to protect against that kind of threat then the firewall wants to be on a different box (eg. a router or dedicated firew
Re: (Score:2)
Firewalls are about keeping things in as well as out. One of the reasons that there are so many problems on corporate networks is that there's often times no firewalls once you get to the LAN. I remember when I was in college the set up in the dorms was dire. People would be sharing things read and write and you'd wind up will all sorts of nasty things on the network, and then there was the malware.
Yes, but I presume you are talking about Windows machines which run an SMB/CIFS server out of the box. Most GNU/Linux distributions rightly don't do that. Typically if you want to run Samba, or an FTP server, or an HTTP server on the default port then you need to be root to do that. Once you are root then you can also poke a hole in the firewall.
Granted you can run servers on high-numbered ports, but within a LAN all that does is allow two machines that had already been compromised to communicate with each
Re: (Score:2)
What if it is a portable machine and wants to use public wireless Internet? Also, what if (s)he wants to block outgoing connections and stuff which hardware firewalls can't do?
Re: (Score:2)
That's fine as long as you are sure there are no bugs in the services you run and the TCP/IP stack, and you keep them all up to date, and you don't mind kiddies hammering on your door 24/7 trying to guess your passwords.
Re: (Score:2)
That's fine as long as you are sure there are no bugs in the services you run and the TCP/IP stack, and you keep them all up to date, and you don't mind kiddies hammering on your door 24/7 trying to guess your passwords.
If you need a service to be publicly accessible then you will need to configure the firewall accordingly, in which case it typically provides no protection if the service is exploitable.
If the service doesn't need to be publicly accessible then either turn it off or bind it to the loopback interface. Why add extra software to protect against a vulnerability that you could have avoided creating in the first place? Note that operating systems that take security seriously do not install public-facing network s
Re: (Score:2)
I use DroidWall (iptables frontend) on my Android phone (=non-Windows) to keep apps from sending my private data out. As an added bonus, it blocks most ads.
Yes, you can choose to not install those apps, but most of them want a network connection and access to storage...
Re: (Score:2)
A windows software firewall is not the same thing as a standard firewall, it's a rather specialized bit of software that, unlike normal firewalls, does NOT just look at the packets and judge them for themselves. Instead, it keeps track of which *programs* on the machine are allowed to connect and how. On Windows, it's needed, and can be very useful i.e. even if the trojan gets installed using a drive-by exploit, it still cant call ho
Re: (Score:2)
Never had a Linux computer hacked that I noticed. (have had Windows boxes hacked to the point they'd hardly run.)
If this box was supplying connectivity to a LAN of Windows boxes, that would be a different thing. That isn't the case here.
Wrong paradigm here (Score:1)
The days of innocence have ended (Score:1)
Linux's "outbound connections are open" paradigm was designed in the good old days of innocence, before malware grew to current levels and before applications were phoning home.
In today's world, that early innocence is badly misplaced. Third party applications need to be restricted to nothing more than the outbound connections which the user permits.
Re: (Score:1)
Unless you use NoScript, you run 3rd party SW (Score:2)
If it is doable w/o JS, it should be doable w/o JS (Score:2)
Re:Wrong paradigm here (Score:4, Insightful)
IPTables doesn't have support for application-based firewalling. You can do that kind of thing using something lilke the Grsecurity [grsecurity.net] patch for the kernel, but it is not for beginners.
Grsecurity will let you create policies exactly like what you're talking about and then some. For example, it will allow you to create a policy limiting which files and folders a given program can access. To be specific, on my machine I have a policy that Firefox can only write data to it's own folders and to my Downloads directory, and can't execute/run any files inside those folders. That way, if somebody hits me with a drive-by download or something it simply won't work.
Re: (Score:2)
Re: (Score:2)
Actually iptables does have support for matching based on the process. You might have run commands that include "-m recent", or similar. The "-m" is used to specify a module-name, and there are many matching modules available and included by default.
For example on a CentOS system you might allow your webserver to make outgoing SMTP connections via something fun like this: "iptables -A OUTPUT -m owner --cmd-owner httpd --dest-port 25 -j ACCEPT". (Why CentOS? Because it matches the command against HTTPD.
Re: (Score:3)
For example on a CentOS system you might allow your webserver to make outgoing SMTP connections via something fun like this: "iptables -A OUTPUT -m owner --cmd-owner httpd --dest-port 25 -j ACCEPT". (Why CentOS? Because it matches the command against HTTPD. On Debian systems the webserver process is more typically called 'apache2'.)
The cmd-owner match was removed in kernel 2.6.14 because it was broken with SMP.
Re: (Score:2)
cgroups may help.
Re: (Score:2)
This is changing though. If you run a distribution with SELinux enabled, many applications and daemons are likely to be blocked from making outbound connections. Changing the rules is somewhat difficult though; distributions generally assume that the user does not have a clue when asked whether frobnitzd should be allowed to connect to Slashdot, so there is no GUI for asking the user.
AppArmor can do it too, and the configuration is perhaps a bit easier. I have no idea how much Ubuntu restricts by default.
Re:Wrong paradigm here (Score:5, Funny)
Nothing wrong here: the Windows firewall is designed for keeping malware inside the PC and out of the Internet, the other firewalls are designed for keeping malware on the Internet out of the computer.
Re: (Score:2)
Blocking outbound on per-application basis is needed, if you do not trust your software. But untrusted software can evade this anyway. Just call "firefox http://malwareserver?mydata=i+... [malwareserver] 2;kill %1"
So, how does the "~/bin/untrusted-download" firewall rule protect you now?
There is one simple rule for untrusted software: Do not run it.
Linux makes this easy, you need the execution bit, a download or an e-mail attachment will not have it by default. And Linux provides you with a big trusted software repo. You d
Re: (Score:2)
of course the cmdline needs to be:
'firefox "malwareserver/?mydata=i+got+him+&username=foo&loggedpassword=bar&;sleep" '
stupid slashdot
Re: (Score:2)
argh, stop messing my posts ...
firefox "malwareserver/?mydata=i+got+him+&username=foo&loggedpassword=bar"& sleep 2 && kill %1
Poster asking about GUI frontend software (Score:4, Interesting)
Many of the posts so far direct the original poster to dedicated firewall appliances or distributions. If I read the summary correctly, the OP is simply looking for a good GUI to manipulate the firewall rules built into the kernel of all modern Linux distributions.
I can't vouch for any of them, but GUI frontends include guardog, lokkit, firestarter, and probably others. They are all in various states of development and maintenance.
Part of what the user wants to do (firewall per app) wasn't possible in the past with iptables (per-gid blocking was easy), but I believe it's now possible. A primitive daemon, called Leopard Flower, seems to offer this functionality: http://leopardflower.sourcefor... [sourceforge.net]
From what I can see, the most promising, integrated, easy-to-use firewalling GUI software going forward is Fedora's firewalld and it's accompanying GUI. I know firewalld is available on Ubuntu (and its command-line interface). I'm not sure about the GUI part. Perhaps someone familiar wit Ubuntu can comment. Here's an article on installing it in Mint, so I assume it's similar in Ubuntu: http://www.linuxbsdos.com/2013... [linuxbsdos.com]
From what I can see, firewalld and firewall-config hit the sweet spot for most desktop users. I'd never use it on my router, but for a desktop, it works pretty well and is under active development. I imagine it will sport per-application feature soon, if it doesn't already.
Re: (Score:2)
LeopardFlower looks good, but... (Score:2)
"As of 2014-01-12, this project is no longer under active development." text. :(
I like GuardDog, but it is no longer updated and doesn't work with the latest Debian/Linux's Kernels when I tried it a couple years ago. :(
Looks like official Unbuntu gui is gufw (Score:2)
Doing a bit of research, the official Ubuntu firewalling utility is ufw, and there is a default GUI for it called gufw. Probably the OP should direct his attention here first.
ufw, ipfire, ddwrt (Score:2)
Lots of options:
http://www.ipfire.org/ [ipfire.org]
ufw can be installed from apt-get (no gui)
ddwrt runs on many routers and has lots of features... don't need a full PC.
pfsense (Score:3)
I just jumped into playing with pfsense. It's based on FreeBSD, but it was very easy for me to get in and mess around with. :)
Re: (Score:2)
This doesn't help him. He wants windows firewall or norton internet security level of firewall (but for linux) for his own computer.
I'm a huge fan of pfSense, but it's not a desktop OS.
Honestly, I think the OP needs to realize that even today, Linux requires a little command line foo. Look at the official ubuntu documentation and turn on the firewall. Blocking incoming traffic is sufficient on Linux most of the time. There's much less malware that will connect out and cause harm.
See https://help.ubuntu.co [ubuntu.com]
fwbuilder (Score:2)
i have a bit of a problem comprehending firewall rules (and deploying them). i asked around (just as you did) and got the advice "use fwbuilder". i liked it so much that i ended up writing a python script that parsed its xml files and generated HTML output so that i could clearly see what it was doing.
but, despite admitting that i am not a firewall rules expert, i do have to say that nothing substitutes for actually studying what firewall rules are and understanding them properly. i say that from the pos
pfSense (Score:2)
You're a "brand new Linux user" (Score:2)
Why not take this opportunity to learn how iptables works and how to edit the text-based configuration? The basics are pretty easy - you can figure out how to allow ssh, for example, and get up and running without knowing something like how to set up vpn traffic forwarding.
Isn't part of the point to learn how Linux works? It's not just like Windows, but that can be a plus. Once you get past the "AAH, I DONT HAVE ANYTHING TO CLICK ON" stage, you may just find it's actually easier! Personally, having done bot
Re: (Score:2)
Because, like he said, iptables is easy to screw up without realising it and you don't really want to take that approach on a machine you care about and are using day to day, you ideally want kind of abstraction layer to break you in gently where there's less chance of fucking it up and you can learn how it works at a sensible pace.
Re: (Score:2)
You could also set up some kind of DMZ where you use a router with firewalling capabilities between broadband and your home network. This gives you some security now while you are still experimenting. Also it is a good idea to not trust your router and set up your own firewall in addition to it. Beyond that you may also protect us from your experiments that way.
You can also try to scan/hack your internal firewall with tools like nmap to see how it is holding up. Here is a list of a few links:
http://www.ietf [ietf.org]
IPTables (Score:2)
IPTables is by far the best firewall for linux, and its built-in to boot.
If you're iffy on command-line parameters, install Webmin on your system. It gives you a web interface, and the IPTables page makes configuring your firewall relatively newbie-proof.
I, for one, hate IPTables on the command-line, and much prefer the Webmin method. Its what I use on my home server.
firehol (Score:3, Interesting)
On the same machine, or standalone? (Score:2)
If standalone, as in replacing your existing router, I've used IPcop, Smoothwall (a little more flexible) and full-blown ClearOS with mail server, antivirus, even the kitchen sink (well, almost).
If on the same machine, I honestly don't know, since I'm currently only running Windows and OSX
IPTables FTW (Score:2)
Most distros will have the rules in a single script, they are really easy to read, modify and understand. I don't understand what good a GUI would do for something as simple and important as a rule-based firewall, GUIs only hides things.
Of the top of my head:
iptables -A INPUT -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p 22 -j ACCEPT
iptables -P INPUT -j DROP
iptables -P OUTPUT -j ACCEPT
iptables -P FORWARD -j DROP
To get a detailed overview of the rules:
iptables -nLv
If you need any simpler, ju
IPFilter/PackerFilter on NetBSD (Score:2)
IPFilter or PacketFilter on NetBSD. I am a bit redundant since it was already proposed for OpenBSD and FreeBSD, but NetBSD was missing :-)
I must add that BSD are good systems to learn. They take no initiatives and most of the time stick to common Unix tools instead of reinventing the wheel. That means for instance that knowledge acquired on NetBSD can be useful on Linux
pfSense (Score:2)
You can do Firewalling with packet filter instead of iptables (better session tracking). BSD is generally better as a network appliance than linux for a number of reasons, and for firewalling especially. Better session tracking, better dynamic protocol handling, better error and flow control, and generally more robust. Iptables is powerful, but it has its downsides that can be felt these days with
Don't block anything (Score:2)
Security by blocking bad things is a very bad idea, a completely false sense of security.
Couple these together instead:
default-deny (got that much correct);
incoming, open stateful continuations of established connections;
incoming, open ports for services you run (e.g. web- and dns-servers, etc), with rate-limiting per source.
iptables will allow this, no problem.
There is no point in "automatic" firewalls that detect bad things and block sources; all they do is clutter-up your firewall rules for the sake of a
Why? (Score:2)
You say you're a new Linux user, and it looks like you're carrying over you windows-way-of-thinking.
Most Linux distros don't have services running with lots of security holes. You don't generally need this.
Most malware out there is actually stuff like "click here for free money.exe". Even if you come across Ubuntu-targeted stuff, it does look like you're the kind of person who wouldn't click that.
Several people here have pointed out possible solutions, but think for a moment if you really need them.
Re: (Score:2)
Same here. If you're used to checkpoint firewall, it's an easy transition. Worked perfectly when I had to duplicate a firewall config for a firewall-on-a-floppy firewall (albeit it was done manually and not automatically).
Re: (Score:2)
I do handcraft firewall rules for my home Slackware install though. It just seems the right thing to do :)
Not so much since I moved to a Tomato based internet router though. It was probably never a good idea to have the email, web server etc on the same system as the router.
Re: (Score:2)
Though the leading edge of development of end-user level UI for firewalls is on embedded projects like OpenWRT, firewall builder definitely deserves a look. It's close to many of the tools targeted at small-network administrators, like Cisco's ASDM for their ASA product. It may take a short time to learn about service objects and network objects, but that time will be payed back many times over.
The biggest issue an end-user will face with it is setting up the backends as it is less than totally flexible i
Re: (Score:2)
Well, there are lists of ranges known to be used by malware, etc. such as this: http://www.spamhaus.org/drop/ [spamhaus.org] - it's not that it's a list of *all* ranges used for those things, just that these ranges are known *only* to be used for those things and so can safely be blocked outright.
Most of the rest of it comes from random compromised residential machines or hosted boxes and so is hard to block other than when you find a really shitty host like Nobis/Ubiquity who just don't care about shutting down compromis
Re: (Score:2)
What that guy is asking for isn't a simple firewall. Windows firewall can't do that, as far as I recall.
Re: (Score:3)
You want someone two days into a simple desktop linux system to get a consumer appliance?
Surely there should be some simple point-and-click app he can install from the desktop that will prevent basic misbehaviours. The very act of asking here shows that he does indeed have pride enough to want not to be a menace.
Re: (Score:2)
With all due respect, not good advice if the person is new to Linux.
A basic firewall is better than none at all (yes, even on Linux). If he knew Linux so much, he wouldn't ask the question. A firewall at default config will offer protection and he can play with it later on to open ports if needed.
"So - you don't need firewall. Just knowledge how to close unneeded services/programs."
That's my point, if he comes here asking that question, he probably doesn't have the knowledge (yet) to do so.
Re: (Score:2)
The biggest issue with android is all the malware that was thought to be innocent software. Most of your core software for Linux is made be reputable organizations. That said, the software that make up the services people use Linux for is large and complex and requires much more work than say a phone app. Sadly, the openness of Linux can give it a bad name when ignorant fucks like yourself can't tell the difference between them.
Re: (Score:2)
No, google designed the userland for that.. It's setup basically to ensure that app developers get real data from the phone. the owner of the phone wasn't meant to be secure. A real secure solution would be to ensure the apps have no idea if they're getting real info or not Right now the user just gets a choice to 'accept access or don't run'.
The fact this runs on a linux kernel is irrelevant.
Don't be a idiot! (Score:2)
Unless you known exactly what you are doing, what ports you have open and what are the risks of each, you SHOULD USE a firewall... ALWAYS!! no matter if you are using windows, macosx or linux.
IIRC, Ubuntu brings no open port for default, so that is why it don't have a default firewall, but if you start installing programs, specially server programs, you should
configure a firewall in a correct way.
I use a old script called gShield on older machined and fwbuilder on newer ones. I also use custom iptables scri
Re: (Score:2)
As I mentioned in a previous /. story regarding nftables, iptables isn't "going away." You neglected to mention that nftables provides backward compatibility with iptables, while allowing significant new functionality. A huge amount of infrastructure utilizes iptables rules, and nftables isn't intended to break that.
There is no confusion of tons of admins here.
Re: (Score:2)