Endian Firewall is an Opensource Linux Firewall based on the IPCop Linux Firewall, a very popular Opensource firewall. Endian Firewall is almost an opensource Universal threat Management (UTM) device with a Stateful firewall, VPN, Webproxy, SIP proxy for VoIP, Web Security, Content Filtering, Mail gateway and Antivirus, Anti-spyware and Anti-phishing capabilities.

The features of Endian Firewall include,

• Easy to configure and administer using web interface
• Stateful Firewall
• Routing and NAT support
• Port Forwarding
• Multiple IP Address support with IP Alias
• NTP Client and NTP Server support
• Reporting with system,network and traffic logging
• Remote Syslog server support
• IPSec VPN for site to site VPN and remote users support with Endian VPN client (Windows,MacOSX,Linux)using OpenVPN
• Webproxy supporting HTTP,FTP and DNS bypass
• Mail security for SMTP and POP3 with Antivirus,Anti-Phishing, Anti-spyware
• SPAM protection using pyzor Spam filter
• DNS bypass and Dynamic DNS support
• SIP proxy for VoIP
• Antivirus support provided by ClamAV
• Intrusion Detection using Snort
• Traffic Shapping on the Internet facing interface for QoS
• Traffic Monitoring using nTop
• DNS and DHCP server using dnsmasq
• Zone based Firewalling
• User Management with Windows Domain, LDAP, RADIUS and Samba support

Endian Firewall has a Enterprise edition and a community supported opensource edition. The Enterprise edition comes in both Appliance as well as a software edition which allows the enterprise admins to install Endian on their own hardware.

Endian Opensource free edition on the other hand is available as a ISO download and can be installed on even an old PC. Ofcourse, with multiple modules running needs may vary on the hardware. For instance, if you need to run the proxy module then the disk needs to have enough space for caching.

Installation is very straight forward, burn the ISO image on to a CD and boot with the CD-ROM and follow the onscreen instructions to complete the installation. Once installed, browse to the http://x.x.x.x where x.x.x.x is the IP address of the trust (green) interface. Once there, a wizard starts configuring the admin passwords, network interfaces for various zones (Orange for Wireless, Blue for DMZ, RED for Untrust or Internet facing interface like ISDN, ADSL).

Endian website has a great documentation and a good FAQ to support a good opensource firewall. For more information, documentations and download, click here for Endian Homepage.

Smoothwall is another Firewall based on IPCop.

Did you like it? please leave us your comments or feedbacks…

Firewall Builder is an Opensource multi-vendor Firewall Configuration and Management GUI tool. It uses a set of policy compilers for the different firewalls supported. If you are a Network administrator supporting multiple sites and multiple firewall devices then you would know what difference a central Firewall Manager can make to the day to day task. A Netscreen Security Manager for Junipers or the admin tool for checkpoints is an example, despite these being expensive commercial options from the very own vendors. Firewall Builder on the other hand a hetrogenous, vendor neutral configuration and management tool with support to more than one single platform and an easy design allowing expanding support more platforms.

Firewall Builder uses object-oriented approach, it helps administrator maintain a database of network objects and allows policy editing using simple drag-and-drop operations. Firewall Builder can generate configuration file for any supported target firewall platform from the same policy created in its GUI. This provides for both consistent policy management solution for heterogeneous environments and possible migration path.

Firewall Builder uses the same Object database (hosts,networks,services etc) for all the different vendor firewalls in an xml format and any change to any of the object will automatically update the rules on the policy sets and they only need to recompile the policies  and apply to the firewall devices. Maintaing the Object Database in XML format and keeping the GUI and policy compilers completely independent makes it easy to expand support new firewall platforms.

In Firewall Builder, administrator works with an abstraction of firewall policy and NAT rules; software effectively "hides" specifics of particular target firewall platform and helps administrator focus on implementation of security policy. Backend software components, or policy compilers, can deduct many parameters of policy rules using information available through network and service objects and therefore generate fairly complex code for the target firewall, thus relieving administrator from having to remember all its details and limitations. Policy compilers can also run sanity checks on firewall rules and make sure typical errors are caught before generated policy is deployed.

Firewall Builder supports

• iptables on Linux (Kernel 2.4 & Kernel 2.6)
• ipfilter on Sun Solaris, FreeBSD and OpenBSD
• ipfw on FreeBSD and MacOS X
• pf on OpenBSD
• CiscoPIX (commercial license)
• Cisco IOS  Access Control Lists (commercial license)
• Linksys Firewall running sveasoft and OpenWrt firmware

Firewall Builder can run on

• Redhat Linux, Mandrake Linux 10, Suse 9.1
• FreeBSD 5.3
• MacOS X
• Windows XP SP1 and later

Firewall Builder licensing is a dual-license model where all the opensource modules are available under GPL while the commercial modules are licensed under its own Netcitaadel End User licensing model.

The Firewall Builder software has great documentation and lots of How Tos, installation guides and a good FAQ to support this very good piece of software.

For more information and download, click here to visit the homepage of Firewall Builder.

Vuurmuur is an Opensource Firewall Manager based on iptables in Linux. Vuurmuur works with both Linux Kernel 2.4 and Linux Kernel 2.6

Vuurmuur has a simple and easy interface with a nice GUI support for simple to complex configurations. Vuurmuur allows remote administration through SSH or through the system console.

The features of Vuurmuur Firewall Manager are

• iptables knowledge not required
• Human readable rules syntax
• Ncurses GUI so no X required.
• Easy portforwarding support
• Easy NAT setup
• Secure default policy
• Remote Management through SSH and through console
• Scriptable for integration with other tools
• Produce bash firewall script
• Anti-spoofing features
• Kill unwanted connections
• Support Snort_inline using QUEUE or NFQUEUE
• Real-Time log and connection viewing with filtering support
• Traffic Volume Accounting
• Old Log search
• Audit log
• New connections and Bad packets logging

The future version in deelopment is to support Traffic Shaping  with GUI which allows a Firewall Administrator to

• Limit bandwidth usage on a per rule basis
• Guaranteed minimum bandwidth on a per rule basis
• Rule prioritisation

and can be controlled on an interface basis.

The latest stable version is 0.5.73 and is available for download here

A good set of documentation is available here with generic installation procedure using install scripts and for SuSe, Fedora, Debian, Ubuntu and Slackware specific procedures.

For more information and configuration info, click here

ClarkConnect is an all-in-one Opensource networking suite from Point Clark Networks. It is a full blown security suite on one front with Stateful firewall protection, Intrusion Detection and prevention, Maile Gateway with Antivirus, Anti-spam and Anti-phishing support, proxy & web content filtering, peer to peer connection filtering for web protection while is also a networking suite with IPSec and PPTP support, bandwdith and system monitoring and a server with web-server, Database server support, file & print sharing, mail server, system and mail backup. All built on a cut down redhat linux with a good web interface.

ClarkConnect is an opensource winner with all the features are directly enabled by opensource packages.

The top features of ClarkConnect are

• Statefule Firewall with DMZ interface enabled, NAT and port forwarding support
• Intrusion Detection (Snort) and Preention (snortsam)
• Peer to Peer connection prevention
• MultiWAN support with bandwidth monitoring
• VPN support with IPSec and PPTP support
• Webproxy, Content Filtering, Popup/banner adblocker
• Email Server support (POP, IMAP and SMTP) and webmail support
• Dns, DynDNS, DHCP Support
• Mail Gateway with antispam (spamassasin,Dspam,greylisting), Antivirus (ClamA), phishing filter,  Mail Disclaimer support
• Groupware and Flexshare
• Webserver (LAMP)
• File and Print Sharing, FTP server
• Network Backup

For more detailed listing of features, click here

ClarkConnect comes in three different editions as Enterprise, Office and Community editions. The Community edition is a free edition with no support for the serices and hence is good for Home and Small Office. The Office edition has all of the network and security features enabled with the exception of the Grouware support and the all enabled version is the Enterprise edition. While the Office and Enterprise editions are commercial, the cost is not very pricey.

For a comparision on the versions, click here

A detailed hardware requirement can be found on ClarkConnect website with downloads available here.

A Reader's Toolbox

For 640-802, it is important to qualify both 350-001 as well as 70-291. Still a number of individuals settle for 70-649 too.

redWall Firewall is a free opensource firewall based on Gentoo linux distribution with Linux Kernel 2.6. redWall firewall runs from a bootable CD-ROM while the configs are saved on a USB Memory stick, Floppy drive or on the Hard Drive. Newer version has support to install the firewall on the Hard Disk. The redWall firewall has a good web interface.

Reporting on the firewall is based on a MySQL database (except for squid) and so presents the advantage of using the firewall also as a Management console or a logging console so multiple firewalls in the network can report back to the management station or do the logging onto the redWall firewall for better presentation and broader visibility of the whole network security.

Features include

• Stateful Firewall (iptables)
• Proxy using Squid
• Intrusion Detection System (IDS) using Snort
• Mail gateway functionality with Virus scanning and Antivirus support
• Support for Bridging, NAT
• DNS support using dnsmasq
• Traffic shaping
• Network Analyzer using nTop and DarkStat
• Network monitoring and Bandwidth monitoring using Zabbix and Jffnms
• SNMP reporting using Cacti
• Webmin support
• Log analysis using BASE
• Good reporting for Squid and rest of the logs using Sarg Report
• Management/Logging console for multiple firewalls on the network

There is not much documentation available on the website for redWall but given that the firewall can run off the CD-ROM (installable to Hard Disk) and that the configs can be saved onto a USB Memory Stick, Floppy or a Hard Disk, an old PC can certainly be enough to run a fully functional Firewall. Ofcourse, give some good hard disk space for Squid and/or for central logging (if used as a logging console)

The CD ISO image can be downloaded here.

To install the Firewall onto the Hard Disk, run "redwall-setup" from the console and select "INSTALLATION" and follow the onscreen instructions.

A Reader's Toolbox

Normally after 220-602 a number of individuals go for 1Y0-259 or the more advanced 640-822. People seldom try for 220-601 as that only leads to 70-293.

pfSense is yet another opensource firewall which can turn your old PC into a fully functional Firewall. pfSense opensource firewall is based on the m0n0wall opensource embedded firewall with all the good features of m0n0wall and advanced addition features.

pfSense uses OpenBSD's ported packet filter, FreeBSD 6.1 ALTQ (HSFC) for excellent packet queueing and integrated package managegement system for extending with new features.

pfSense can be downloaded a Live CD which is also an installation CD or as an installation ISO for developer edition or an Embedded edition. For more info on the download packages, click here.

The software itself can be downloaded from here

A good set of install instructions are available here

More information on Hardware, minimum requirements and recommended vendor products, visit pfSense here

In additional to the existing features on m0n0wall firewall, pfSense has the special additional features. The following are some of the key additional features:

• Wireless a/b/g using wpa_supplicant with turbo, WEP, WPA-E/PSK and WPA2 (TKIP) support. Advanced support for wireless devices including HostAP-mode, hardware-encryption if supported by driver, mac-filtering, non-broadcasting SSID with FreeBSD6 supported wireless devices (atheros recommended for full functionality)
• Incoming/outgoing load balancing pools
• Multiple WAN Support
• PPPoE Server
• Setup wizard and package using xml -> web gui toolkit
• Realtime settings change to avoid reboots
• pf for openbsd's packet filter
• CARP – for failover and clustersyncing (rules, trafficshaper, nat, IPSEC SAs…)
• failovercapable DHCP-Server with advanced settings (specify gateway, DNS, WINS)
• Systemstatus with realtimegraphs including SWAP usage monitor
• ALTQ traffic shaping with integrated magic shaper wizard with Queuegraphs for Trafficshaper
• FTP-Proxy using Squid Transparent proxy
• proxy/masquerading for SIP-protocol using siproxd
• Anti-Spam-Proxy using assp
• Fake SMTP-Server as Spam-Tarpit using spamd
• Networkscanner for security auditing using nmap
• Enhanced traceroute using mtr
• enhanced configuration-system featuring a configuration history and partial config down-/uploads
• converting PF-status-massages to Cisco NetFlow-Datagrams using pfflowd
• PFStat Graphing
• Enhanced network history data using NTOP
• STunnel to wrap standard ports with SSL
• arpwatch to watch ethernet/ip-adress-pairings
• freeradius to Radiusserver
• iperf/netio for bandwidth-measuring

A Reader's Toolbox

After SY0-101, a small number of individuals are content with their N10-003 where as the rest go on to study 70-620. This group later covers 350-030 as well.

m0n0wall is a free opensource embedded firewall that runs on embedded PCs (recommended) and other generic standard PC workstations that can run FreeBSD or rather supported by FreeBSD. m0n0wall firewall provides most of the features provided by a commercial firewall.

Click here for a list of supported FreeBSD/i386 hardware.

For more information on the hardware details m0n0wall click here

M0n0wall is based on a bare-bones version of FreeBSD with mini-httpd webserver for web GUI and PHP (with CGI support) for boot time configuration. The complete configuration is stored in XML format. This is likely the only softwar where PHP does the boot time configuration instead of Shell scripts.

The image file for installation is of 6MB in size including the core freebsd and the required components and utilities that offers most if not all the features of a commercial firewall appliance. There are seperate image files for each of the different hardware platforms supported. For more information on downloads, click here

The whole software package can be run on a compact flash card (atleast 8M in size) or on a IDE hard disk. The recommended memory is atleast 64MB. The installation procedures are well documented.

For details on installation procedures click here

The Main features of m0n0wall firewall are,

• Stateful Packet Filtering
• Web Interface (SSL) and Serial Console for administration (mini-httpd)
• Wireless Support
• Captive Portal
• 802.1Q VLAN  support
• Stateful Packet Filtering using ipfilter
• NAT/PAT, Static Router, Host Aliases support
• DHCP client, PPPoE, PPTP and Telstra BigPond Cable support on the WAN interface
• IPsec IKE VPN using Racoon with support for hardware crypto cards, mobile clients and certificates
• PPTP VPN (with RADIUS server support)
• DHCP server and DHCP-Relay (ISC DHCP)
• Caching DNS forwarder using dnsmasq
• DynDNS client and RFC 2136 DNS updater using ez-ipupdate
• Traffic shaping
• SVG-based traffic grapher
• firmware upgrade through the web browser
• Wake on LAN
• Configuration backup/restore

For more detailed feature list, click here

For more information on this FreeBSD based open source firewall, please click here

A Reader's Toobox

After 70-290, a small number of professionals who wants to study 70-296 move on to the next level i.e. 70-270, where as the rest go with the 642-901.

IPCop Firewall – Bad Packets Stop here!!! 

IPCop Firewall is a well known Opensource Linux distribution built to protect Home and SOHO networks from hackers and potential intruders on the Internet. IPCop can run a old PC and can be installed and be operational within minutes.

Please click here for more information on the Hardware compatibility list. Installation is fairly straight forward. Involves downloading the ISO image and burn it to a CD and start the hardware with the installation media and follow the onscreen instructions. A detailed installation instruction is here.

The IPCop firewall runs on Linux Kernel 2.4 and is a stateful firewall (1.3 and later) based on Linux IPTables. The IPCop firewall has a nice web interface from where almost all the configurations can be done.

While IPCop firewall is primarily a router and Stateful firewall, it has most of the common features found on commercial hardware firewall appliances. Some of the key features are

• Stateful Firewall using IPTables
• Intrusion Detection System using Snort
• IP, Web and FTP proxy using Squid Proxy
• Dynamic DNS Support
• DNS Forwarding and DHCP using dnsmasq
• IPSec VPN supporting both roadwarrior and Site to Site using OpenSwan
• Wireless supported a DMZ on the firewall using the Wireless_Tools (opensource Wireless tools sponsored and supported by HP)
• Traffic Shaping on the External Internet facing interface (RED)
• SSH using OpenSSH
• Local and remote logging support
• NTP Server/Client support
• NAT Helper and port forwarding support

The IPCop Firewall has a very good documentation and FAQ on its website actively supported by the Opensource community. Smoothwall Express is a opensource firewall based on th IPCop firewall

For more information and download, please click here

Untangle is the free & open source alternative to Sonicwall. In addition to the basics (Firewall, VPN, IPS & routing), Untangle makes it easier to block spam, spyware, viruses, phishing, porn, gambling, MySpace, Facebook, IM, peer-2-peer & much, much more. Untangle has been named the "Best Security Solution" – LinuxWorld 2007

Untangle runs at the gateway… and requires no client to install as the complete protection is provided at the perimiter of the network.

The Intuitive GUI, logging, reporting & automatic signature updates makes Untangle very easy to use and administer.

The basic requires an Intel/AMD based system with reasonable processor speed and memory. More details here.

Installation is fairly straight forward. The software can be downloaded as an ISO image and burnt to CD or ordered for free. Boot with the CD and the Installation is wizard based. There is a nice installation documentation here.

There are also preinstalled appliance for out of the box experience.

The Untangle Network Gateway is free and has 12 applications that comes alone. There are also commercial addons to the software which basically has support for Active Directory integration, Advanced Policy Management, Config Backup, Remote Acces portal and Live support for the solution.

In addition to the basic Firewall, VPN, Intrusion Prevention and Routing functionalities, the following additional applications can run on the same device:

• Spam Blocker
• Web Filter
• Protocol Control like P2P and Online Games
• Virus Blocker with Dual Virus Blocker options
• Spyware Blocker
• Phishing Blocker
• Intrusion Prevention
• Attack Blocker

The pricing options for the commercial addons are very cheap to be honest for any basic levels.

For more information, please click here

On October 29 2007, Vyatta announced the latest release of its open-source networking software. The Vyatta Community Edition (VC3) software combines router, firewall, and VPN capabilities into an integrated solution that delivers twice the performance of proprietary network solutions at half the price.

The latest release, Vyatta Community Edition 3 (VC3) provides substantial enhancements and feature additions from the previous VC2 release, including IPSec VPN, multi-link PPP, and BGP scaling and security.

IPSec VPN
Vyatta now supports dedicated site-to-site (branch-to-branch or branch-to-HQ) virtual private networking and supports the most widely used cryptographic algorithms, including 3DES, AES (128 and 256-bit), MD5, and SHA1. In addition, IPsec VPN can now be configured in a cluster of multiple Vyatta units with failover mechanisms providing high availability for mission-critical services.

Multi-link PPP (MLPPP)
MLPPP allows customers to increase WAN bandwidth by using multiple low-speed circuits, in parallel, enabling a Bandwidth optimization by using multiple connections to increase bandwidth.
 
BGP scaling and security enhancements
Improved BGP scaling provides faster routing convergence with many peers. MD5-based neighbor authentication delivers improved routing security. Per-BGP peer policy support makes it easier than ever to control route propagation. New monitoring and troubleshooting commands make Vyatta easier to use.

Vyatta Community Edition (VC3) is now available for download from here. Vyatta is planning to release a new version of its software every 6 months.