Phoenix Network Forums

Hello folks,

I have been considering a hardware firewall for my computer and have been doing some research online. The one everyone is mentioning is the Linksys model# BEFSX41. Does anyone here use this firewall? If not what are you using? What can you recommend?

I have only one computer hooked up to the net by dsl. I use a software firewall that seems to do a good job. I have a copy nmap that I have used to test the firewall. It does a good job of blocking the ports, but I am still able to determine that my computer exists.

Ideally, you don't want your computer to respond to any request that you didn't initiate, correct?

I have used some online testing sites that evaluate the security of your computer, and as far as open ports go, mine are all stealth. The only test that I fail is ICMP. I realize that this is a ping response and most discussions I have read say it is harmless. What are some opinions on this?

You don't need a hardware firewall for that purpose. Hardware firewalls are very expensive; at least for what they provide. You can do everything with a desktop firewall as well. You can also block ICMP, but that can lead to problems, because some important meta-data is transported via ICMP. Don't worry, it's absolutely harmless. If you're paranoid, block ICMP Echo (so-called PING-packages), but let everything else through.

In fact, everything is absolutely harmless, but many PC magazines and TV shows (and also those security testing sites) try to scare you, so you go buy a commercial firewall. In normal case, you don't even need a firewall at all. It is intended to control traffic, not to secure your host, this is an implicit feature resulting by design. Firewalls just drop you into a false sense of security. You need to secure your software, not your host.

Anyway, if you still insist on doing it, get version 3.22 of AtGuard. It's free (in terms of: it doesn't cost anything) and has enough features to suit your needs. There is no official download page though. Google for it.

Edit: I'm assuming you have Windows, because you're talking about desktop firewalls. Tell me, if I've assumed wrong.

Thanks for the quick response and good advice! I was hoping you would answer since you are security guru. I'm using Mac OS X with brickhouse firewall. I have added a few custom rules to the conf file. Does any of your advice change knowing that?

No, it remains the same, since I don't know if OS X has a kernel firewall like the one Linux has. Even then, the results are usually the same. There are three kinds of firewalls: kernel firewalls, desktop firewalls and hardware firewalls. Most easy on CPU usage and most flexible are the kernel firewalls. Right after then one layer above is the desktop firewall, which still provides (depending on the software you use) a high degree of flexibility. They use slightly more CPU power than kernel firewalls.

Hardware firewalls are the worst-case scenario. You need them if you have so much traffic and so many rules (thousands of them) that an ordinary CPU couldn't handle all the rules in real-time. This means, they are useful for large-scale complicated networks (300+ hosts, 200+ rules) and for nothing else. Also with such a firewall you are bound to what the firmware provides. Sometimes you can buy additional features, but that's bad. They are not as flexible.

if you have a extra pc around, turn it into a firewall
buy a extra ethernet card, install openbsd w/pf (packet filter)
you could do the same with linux ip chains.

krod wrote:you could do the same with linux ip chains.

Whatever you use, it's not Linux. =)

IP chains is so obsolete, it isn't even included in the kernel anymore. Since 2.4 (only taking stable branches into account) it's the Netfilter, where the command line tool is named iptables.

Apple uses ipfw as a firewall filter. I have found some good tutorials on this, plus brickhouse is a GUI that has list of commonly exploitable ports that it makes rules for with a few clicks.

Netfilter seems to be similar to ipfw, but without any experience I can't be sure. What is your take on this?

It appears that ipfw can be installed with the kernel but I am not sure if that is default on OS X. Apple site only focuses on server configurations for firewalls.

I hope this topic isn't beating a dead horse.

mm_freak, do you test your firewall? If so, what methods do you use? Do you use online tests or something similar to nmap?

The only packet filtering software I have experience with is openbsd pf

safety wrote:Apple uses ipfw as a firewall filter. I have found some good tutorials on this, plus brickhouse is a GUI that has list of commonly exploitable ports that it makes rules for with a few clicks.

As you don't use Windows, you won't need Brickhouse. Vulnerable ports are most commonly found on Windows hosts. I assume you don't run any service like a HTTP server or similar. Thus, you don't need it.

Brickhouse claims to be useful for security, but actually it isn't.

safety wrote:Netfilter seems to be similar to ipfw, but without any experience I can't be sure. What is your take on this?

I control my filter via commandline with the iptables command. The Netfilter is very flexible and supports creation of very complex rules, which I make use of.

safety wrote:mm_freak, do you test your firewall? If so, what methods do you use? Do you use online tests or something similar to nmap?

I'm running many services and most of them are open for the internet. My hostname is kill.mine.nu. I'm testing its open ports locally via netstat --inet --inet6 -np. It shows me all listening sockets on all network interfaces, which are accessible though the internet or my local network.

I close any ports to which remote users don't need access to, like my database daemon, which I use only locally. Theoretically it doesn't add any security, but I do it, so an attacker can't make use of any potential security flaws in that software.

I test my host two times with nmap -vvvA. The first time I test my loopback device localhost, because all loopback connections are permitted. This would be the worst case scenario for an attack. If I find any flaws here, I correct them. Then I test my ethernet device, for which all Netfilter rules apply. In normal case only connections explicitly allowed to pass are shown there. If this is true, then I'm finished.

Edit: online testing tools are useless. They show to a WinXP/2k user that port 1025 is open, even though it is in no way a security hole. They even tell you that your host is replying to ICMP Echo (ping). What's so bad about this? Correct: nothing!

run a remote nmap scan of your network if you are wanting to test your port filtering.
Don't macs come with apache running by default? (my friend had a mac and he had apache running without him knowing it)

krod wrote:Don't macs come with apache running by default? (my friend had a mac and he had apache running without him knowing it)

They shouldn't. If they do, then that's bad.

heh, agreed

No, apache isn't running by default. In fact, all services are deactivated by default. You can uncomment lines in xinetd.conf to allow services. There is also a sharing option in the preference pane to turn on certain services if you want to use a GUI to enable web sharing, ftp or ssh.

Once personal web sharing is enabled, I have to chmod my home directory to 755 before apache can access the sites folder. I use filevault to encrypt my home directory and it sets the permissions to 700 automatically.

mm_freak, do you use any type of NIDS, such as Firestorm or Snort?

I have a hardware firewall in my router.
Actualy its just sitting their, loging trafic.
I can watch most of the ip's that were visited or that connected to me in the past 24 hours.

Thats all mine actualy does for the moment.

what type of router is it?