pfSense v1.2.3 Available!

pfSense, the open source firewall distribution that is based on FreeBSD has seen a new release. This new version brings with it a number of updates and fixes to security advisories.

This release of pfSense contains an update to the FreeBSD base system from the previous version of FreeBSD to version 7.0 to 7.2. This, in turn, implements a number of security advisory fixes that the FreeBSD team have taken care of between the two releases.

(more...)

m0n0wall 1.3 final released

Manuel Kasper has announced that m0n0wall 1.3 is "now good enough for production" after three years in beta. m0n0wall 1.3 is now based on a "bare-bones version" of FreeBSD 6.4 and incorporates a web server and PHP to provide web access to the firewall functionality, keeping it's entire system configuration in a single XML text file for transparency. m0n0wall 1.3 includes support for IPv6, IPsec traffic support in the firewall, IPsec NAT-T, DPD and dynamic tunnels and "countless bug fixes and other improvements".

(more...)

pfSense book now available for purchase!

Authored by pfSense co-founder Chris Buechler and pfSense developer Jim Pingle, The Definitive Guide to pfSense covers installation and basic configuration through advanced networking and firewalling of the popular open source firewall and router distribution.
This book is designed to be a friendly step-by-step guide to common networking and security tasks, plus a thorough reference of pfSense’s capabilities.

Stopping SSH & FTP brute force attacks with IPFW

Brute force attacks are becoming more and more common in todays security landscape; if you receive security cron logs from your FreeBSD server you will know exactly what I mean. These attacks usually use automated software to try thousands of username and password combinations on SSH and FTP, continually aiming to find a weak account on your system and exploit it.

If an attacker can get access to one system account, that is the first step to doing some very bad things on your system, a nightmare for users and administrators. Luckily, there is a way to stop these attacks, and they’re freely available in the ports collection.

IPTables on Linux has the ability to dynamically add rules to block brute force attacks, however IPFW, a widely used firewall and packet filter, does not have an ability. We are forced to turn to look for 3rd party apps, lucky for us there are some very good ones out there, and we will look at 2 here.

pfsense and Smoothwall

So heres my dilemna for a project I'm working on.
I need a rather broad solution covering DNS, proxying, firewalling, VPN (both site to site and LDAP integrated user access), DHCP, supporting multiple DMZ servers along with routing support. This will act as the centre point for a 40 person network. Clearly hardware wise this will have to be quite a strong system, with load balancing being a possibility, at minimum hardware failover.

For the network security class we got asked to take a look at two firewall solutions, so whilst comparing them I also tried to see how well they would fit into the above requirements.

The firewalls looked at were pfsense and Smoothwall Express 3.0.

(more...)

Building a Router With pfSense (Video)

Do you have extra computers lying around the house? In this episode, Matt shows us how to convert an old computer into a home network router.

Configure a professional firewall using pfSense

The guide will take you through the setup of the pfSense firewall with one WAN interface, one LAN interface and one Opt1-WiFi Interface.

This guide was written for Linksys, Netgear, and D-link users with no firewall or router experience. No experience is needed with FreeBSD or GNU/Linux to install and run pfSense. When you are finished, management of pfSense will be from a web interface just like any of the SOHO firewall/router appliances.

How to ban an ip address from every port on linux

All webmasters have trolls and people that try to hurt them in some way. So, here is an oldie but a goodie! How to ban an ip address from ever port on your linux server! You need IPTABLES installed...

Testing firewall rules

Sometimes it is handy to check firewall rules without coordinating a test with the end user. For these tests, use the hping2 utility to "spoof" traffic coming from the source IP address(es) used in the firewall rules.

(more...)

1.2 Release is now available

The pfSense development team is proud to bring you the 1.2 release! This brings the features and bug fixes from more than 16 months of development since the 1.0 release. Already widely tested and deployed throughout the Release Candidate phase, this release provides the finishing touches on releases already proven in a wide range of network environments.

(more...)

Home Gateway Firewall With DHCP Server For Connection Sharing

If you're trying to set up a home network, you probably want to set up a permiter facing computer connected to your DSL/Cable modem, and then put all of your computers behind that firewall box to keep them safe. This tutorial will show you how to use a single external connection on the gateway computer (using Iptables firewall), and a second internal connection on the same box so you can connect the computers on the inside of your home/office to it, and automatically give them IP's when you hook them up (using DHCP server). Iptables can be very complicated, we will only configure a basic firewall, you can add more security later without breaking things. In Linux there are many ways to do this, this one is hopefully simple enough and will teach you the basics. I did this on a CentOS 5 box, though it would work on Debian variants with only slight modifications. During this tutorial I'm logged in as root, which you should generally NOT do, but it makes the tutorial simpler, but if you prefer to do it more securely, add "sudo" before each command and it will work.

(more...)

pfSense 1.2 RC 4 Development Release

pfSense firewall 1.2 is a FreeBSD Based operating system designed to be a secure and easy to setup firewall server appliance. Now on its fourth release candidate, pfSense 1.2 promises a slew of great futures designed to make setting up a firewall easier and faster.

(more...)

Iptables 1.4.0 Released

The netfilter core team has released iptables-1.4.0. This is the first final release of the new iptables branch 1.4.

Seven Different Linux/BSD Firewalls Reviewed

Did you know more than 500 million computers in the United States have been disposed of in the last 10 years?

That’s approximately 2 computers per person! One of the best ways to re-purpose an old computer is to install a Linux or FreeBSD firewall distribution, and use it to run your personal, home office, or small office network is one way to keep “obsolete” technology from ever reaching a landfill.

(more...)

Smoothwall vs M0n0wall: A comparison

When it comes to a firewall, most people are fine with a consumer grade solution like a Linksys, Netgear or D-Link “router,” but I find these devices lacking in features that I want and speed that I need. Instead, I use a retired server that my boss gave me. With a Pentium II 200MHz processor and 1GB of RAM, this machine is way more powerful than the standard cable/dsl router you might pick up from Circuit City or Best Buy, and thanks to Free software, has features those other devices can only dream about. Here, I’ll look at two prominent solutions, Smoothwall Express 3.0 and M0n0wall 1.231.

ComixWall ISG 4.1b released

The first public release of ComixWall ISG 4.1b is ready for download.

ComixWall is developed on OpenBSD using ports/packages and other software, and uses only free/open source software licensed under either BSD or GPL. ComixWall is freely available for all. The project goal is to have all the advanced features of many commercial and closed-source (some half open source) ISGs. This is a very serious undertaking, because most of the free and open source firewalls available on the Internet fail to support many of the features available on those commercial and closed-source ISGs.

(more...)

Firewall Builder 2.1.13 Released

The main focus is better support for new features available in PF in OpenBSD 4.1, and improvements in the built-in policy installer for Cisco PIX and IOS access lists.

(more...)

RELENG_6 patch [Re: pf 4.1 Update available for testing]

now available at: http://people.freebsd.org/~mlaier/PF41/ with instructions how to build.

Please test if possible and provide me with feedback.

(more...)

PfSense: 1.2 Release Candidate 1 released!

1.2-RC1-2 has been released! Here are just a few of the new improvements and features that have made their way into this new version...

Monitoring PF firewalls for health and performance

The PF (packet filter) firewall package was introduced in OpenBSD 3.0, and has since been ported to the FreeBSD and NetBSD Operating Systems. PF contains a stateful packet inspection engine, the ability to replicate state information to a backup firewall, a flexible self optimizing rule engine, QOS support, and the ability to collect performance metrics. These metrics can be useful for gauging the performance of a firewall platform, and provide a way to trend firewall performance over time. This article will describe several utilities that can be used to monitor the health and performance of a PF firewall.