How About setting up a linux router as a firewall

[LiNetTech]

Would be something ?
I am personaly interested in doing so , i have played around with it and got it to work , So if hackers are running windows based boxes , Would the possiblities of hackin a Linux bos as well as run scripts and hack trojan connections be Killed Just Curious !
Just looking for some input
I might Create A Lab for this
Any good suggestions would be appreciated
Thanks Anthony Cabanas (MCSE Win 2K)
Network admin / Infrastructure designer / Security consultant
Long Island Networking Technologies Inc acabanas@linettech.com

 

[ottahs]

Yes this is possible. For example, oler versions of the SSH Daemon have a vulnerability for such actions. This is a concern when running a Layor 7 type firewall. But, if you do a good job in blocking access to such ports with iptables (which I love). Then this woule negate any potentional. Make little as possible available to the world. This will make it less likly for a hack. Like the old saying, the best way to avoid and intrusion, is to leave the box off when not in use. But, this is not very realistic.

I have been a firm believer in a one box solution, like the CISCO PIX. The PIX obviously is designed to do a basic operation, statefull inspection of packets. Plus it will do DCHP, port forwarding, etc.. for your internal network.

For Example, if you have a Cisco Pix setup, then you can put your Linux / Windows boxes in the DMZ. Then do port forwarding to specific tasks such as

http://WWW server,

Mail server etc...

The bottom line is that firewalls that run at layer 7 have application based vulernabilities. Keep it simple. The less hanging out there the less likly for a hack.

A+ RHCE MCP
daryl_Shatto@adp.com

 

[VestanPance]

Hi

You might find these links of interest:

http://smoothwall.org

- the GPL Linux Firewall

http://smoothwall.co.uk

- the commercial Linux Firewall

also

http://ipcop.org

which is a fork of Smoothwall GPL.

Kind Regards
Vestan

 

[LiNetTech]

Hey guy's thanks for the input !
Take Care Anthony Cabanas
Long Island Networking Technologies Inc acabanas@linettech.com