1

I'm corrently using Windows for my machines with Outpost firewall(Agnitum), but want to switch for linux(not sure what disto yet) and would love to know from you what are my options with linux's firewall software.

Can linux's firewalls(iptables, iptable's GUI alternatives such as UFW, or perhaps 3rd party - including paid - software) can do similar as what Outpost do for me:

  1. I basically have all my connections blocked, except the ones I opened, but I can switch policy(mode) so the firewall will intercept any new attempts to establish new connections(that are not allowed yet) and notify me about each of them - and actually let me manage it on the fly(e.g. block, allow, temp allow etc).

  2. Can I manage my connection not only by ports (open port 123; block port 321;), but actually per application? So the port 123 will be open for application ABC, but will be blocked for everything else.

  • In general a firewall running on the same system you want to protect is not a good idea. (Although several companies sell software of this type.) Instead of requiring a solution similar to a Windows firewall product you should think about against which types of attacks you want to protect your system. Whats the purpose of requesting a filtering "per application". How do you recognize "application ABC"? Because "ABC" is the file name? Because it displays "ABC" in its GUI window? What if someone renames "SomeMaliciosSoftware" to "ABC"? – Bodo Feb 15 at 12:42
  • @Bodo I agree and disagree. This bit I disagree with is Don't run a fire-wall, on the system you are trying to protect. I agree that it is better to have an external one, but my laptop can move around a lot, so it needs its own firewall. I block all incoming traffic (expect ssh), and ssh is configured to be secure (key only etc). – ctrl-alt-delor Feb 15 at 13:05
  • @ctrl-alt-delor If you don't run a service that accepts specific connections, all connection attempts for this service will be rejected anyway. What would be the improvement when you use a firewall that blocks incoming connection attempts? I can only imagine a scenario when you run a malicious program that tries to accept connections on a non-priviledged port. If you don't allow incoming connections the malicious software would have to use an outgoing connection or maybe some firewall hole punching technique instead. Are there other threats where a local firewall may help? – Bodo Feb 15 at 13:27
  • @Bodo It allows you, in one place, to state your intentions, and stops accidental commissioning of a service. You can also set the response to ignore, the default is reject. This will make you more invisible, and slow down an attacker. – ctrl-alt-delor Feb 15 at 15:17
  • @Bodo Consider a laptop, for example. I don't know any(below 300$) external firewalls that will be able to used by laptop on usb drive. except that, this kind of firewalls don't have application level of access - if you don't understand how this works, you should ask this questions on stackexchange :) – fopo Feb 16 at 7:02
0

Note MS-Windows conflates many ideas: e.g. it conflates disk-formatting and creation of a file-system, it calls this disk-formatting. It this case it conflates file-walls with proxies, filters, and probably some other things.

gufw can be used to set up a good fire-wall. As far as I know it does not have application level controls. In general a Linux fire-wall can filter based on outgoing user (so you can set a user/group per application).

It get application level filtering, you will need se-linux/app-armor or similar. (or use the per user/group filters.

To filter web-traffic, you need a web proxy, and to set fire-wall to only let the proxy access the internet.

While I have set these up before, they are not to difficult, all of the software is freely available as part of Debian. But I stopped using it, as I have no interest, as I have realised that this is not the best way to go, to protect my users. It all depends what level of control you want. I am not a very controlling person, so I just stopped using it.

  • So, basically what you're saying is there no such software for linux. And what even worse - it's pain in ass to make something similar to it, using variouse of other tools. This sucks, as I always thought Linux is the better option for security and is much more convinient to the user. – fopo Feb 16 at 6:55
  • @fopo No that is not what I said. I said first made an attempt of defining the word fire-wall. I then gave some solutions (someone else noted that application level filewalling in MS-Windows is inherently flawed (as is a lot of MS-Windows security: I usually just walk around most locked doors that I come across.)). I then stated that I am not an expert, as I have very little interest (so may be some one else can do better). – ctrl-alt-delor Feb 16 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.