Building a Linux Firewall Part 1: Why?

There’s no doubt that the internet today is more powerful than ever… and great power demands great responsibility.  There are threats everywhere that you need to protect yourself, your family, and your hardware from.  Not only do you have to worry about hackers, viruses, and spammers, but you need to worry about sexual predators and inappropriate content for your children (or spouses)

Kids today have more adult freedoms and privileges than any prior generation.  Add to that all of the unwarranted privacy they receive, and you’ll see that any parent should be concerned about what their kids are doing online.  It’s in the news every week: some teenager who has committed suicide over Internet Bullying, kids being listed as sex offenders for broadcasting naked photos of themselves.  And don’t even get me started on how anonymity emboldens angry teens to behave in aggressive, rude, and socially reprehensible ways… especially when many families today only have one parent in the house.  Do you think kids would act this way if they knew someone was watching?

It may be better if they DON’T know someone’s watching.  That way you can watch how your teen or tween is naturally behaving on the Internet.  Some may see this as “spying”, but remember that parents are responsible for their children until they are 18.   If you take your kid to the zoo, you don’t let them put their hands in the lion cage just because they want to “pet the kitty”.   You know what’s best for your children, and they are blissfully unaware of real-life dangers.

There are some software programs that offer some protection, but honestly they can be circumvented in many ways, and don’t you think that the technology-savvy youth of today know about these programs.

Consumer-level Internet Routers don’t do the job, either.  At best, they offer network translation, which keeps passers-by from looking in the shop window, but nearly any mischievious person can take a deeper jab.  Many users don’t even bother to change the default passwords on their devices, or enable the advanced security features.

On the next page I’ll tell you all of the advantages of a custom-build firewall…

Building your own Firewall has many advantages over the off-the-shelf Internet Router, and it can literally cost you nothing to set one up.  Today’s free firewall distributions are actually very easy to install, and offer professional protection out-of-the-box, especially when compared to consumer devices.

You can install a professional firewall using spare hardware that has gone unused for many years.  As a matter of fact, the old 486 computer from 15 years ago could even do the trick.  I would be more worried about the hardware lasting than it being able to perform, however.  Most people have a spare computer laying around that is less than 5 years old… and this is more than enough to enable all of the advanced features you’ll want on your network.

	advantage linux firewall typical Internet Router NAT yes yes flexible configuration yes no proxy server yes no URL and content filtering yes no Drop bad traffic yes no VPN yes maybe Advanced logs yes no Intrusion Detection yes no Web-based GUI configuration yes yes Professional traffic and system graphs yes no Real-time Traffic Information yes no Modem support yes no Bind multiple IP addresses yes no DMZ support yes no DHCP yes yes Dynamic DNS support yes maybe Traffic shaping yes no Can handle high traffic yes* God, NO Traffic Analysis and action yes no Port Forwarding yes no VPN yes maybe Wireless support yes maybe*** Segmented network support yes no * assuming you actually have something faster than a first-generation Pentium-133. ** you need more horsepower to run traffic analysis services on your firewall *** wireless is on the same subnet

Out of the box, many firewalls offer butt-loads of protection against hackers and other intruders. The advanced protection and traffic analysis services will require more horsepower, but as mentioned above, and nearly any computer from the past decade is up to the task.

There are a few free Linux distributions that can handle all of these features.  There are literally dozens of them, but the most popular are IPcop and Smoothwall Express.  Smoothwall even makes a corporate and enterprise-level Firewall (with a corporate-level price), which supports many features that only advanced networks require: like reverse-proxy (intelligent forwarding based on packet content), IP Tunneling, VPN nodes, advanced bandwidth management, and more.  Trust me, unless you are supporting hundreds of users and a geographically-dispersed network, then you don’t need these features.

For this project, I chose IPcop because of its extensive support from the OpenSource community.  There are many third-party addons developed that add features for IPcop that extend the features to 90% of what a corporate firewall can do, like Content Filtering, IP Ban (a front-end GUI for IPTABLES), intrusion detection, and much more.  Smoothwall Express is a good choice, too. It has a more polished interface, but doesn’t come with as many out-of-the-box features… meaning that they want you to upgrade to their Corporate version.

In the next segment, we’ll discuss hardware considerations, and the basic network setup based on your needs.