firewall

Mabrys Firewall/X OCX & COM objects make it easy to write custom firewall/proxy servers. FirewallX provides direct support for the standard proxy/firewall types: telnet, FTP, finger/whois, Socks, pipe, and HTTP. Additionally Firewall/X makes it easy to define your own firewall types.

With Firewall/X you can implement client access filters, redirect clients requests, log all traffic and relay requests to hidden hosts. Additionally you can provide for remote administration by implementing custom commands. If youve ever been frustrated by the configuration problems and limitations of the various firewall/proxy servers on the market then youll want to use Firewall/X to create exactly what you need. Like all of Mabrys Internet controls, FirewallX comes in both ActiveX Control and COM Object forms to make it convenient for you to integrate it into nearly any Windows programming environment.

Mabrys Firewall/X and other components will use Streams for storing and retrieving data from any storage media that you specify. Once Firewall/X needs to write some raw data it receives, it asks for IMStream Interface pointer. Depending on your needs, you can make one in memory, in a file on disk, or even make your own IMStream implementation that writes directly to database.

Firewall/X uses streams only in HttpFetchResource event, either for writing or reading data. Depending on Reason parameter, you should provide IMStream pointer to Firewall/X. Typical code fragment will look like this: (for VB):

Private Sub FirewallX1_HttpFetchResource(ByVal User As FirewallXCtlLibCtl.IFirewallXUser, ByVal Reason As FirewallXCtlLibCtl.FetchTypes, Headers As String, OutHeaders As String, StreamObj As Object)
If Reason = ReadResource Then
Set StreamObj = New FileStream
StreamObj.Name = "C:MyFile.HTM"
Else
Set StreamObj = New MemStream
End If
End Sub
The above sample will create new IMStream Objects as FileStream. Since Firewall/X does not care what kind of stream is created, the component just opens it and reads from it. Your code does not have to worry about any storage related issues because Firewall/X does it automatically. Once Firewall/X finishes, you can access the IMStream Object you created for your own needs (copy data to database, move file to some other place, or just discard it).

This MULTI-PLATFORM Firewall is the easy, multi-purpose security application you have been looking for. It utilizes next-generation IDS technology to deliver enterprise-class Deep Packet Inspection, Application Layer vulnerability protection, and intelligent Intrusion Prevention.

Forget about run-of-the-mill commercial firewalls and expensive hardware devices. InJoy Firewall is what the name implies; a powerful "feel-good" product - easy for the average user, and a MUST-HAVE for advanced users. Install it and become an INSTANT SECURITY PROFESSIONAL with complete authority over your Internet connection and real-time transparent insight into almost any network activity.

InJoy Firewall is the ONLY Firewall in the security market that offers a total end-to-end multi-platform software solution. It solves the overwhelming problems related to managing multi-vendor security devices, now making it easier than ever to build enterprise-wide IPSec VPNs and set up identical cross-platform end-point security.
The intuitive user interface is highly customizable, allowing you to efficiently control and manage Firewall Servers - locally or remotely, and even across OS Platforms. In addition, A HOT NEW TOOLBAR application enables you to casually keep an eye on the "intrusion score", while preserving desktop space for other work.

InJoy Firewall is the ultimate firewall solution for organizations of all sizes. Put an end to the cost, confusion and complexity of managing multiple security devices. Use the power and simplicity of InJoy Firewall Pro to take control of your network security today.

Basic features include: 10+ Pre-configured Security Levels, Internet Gateway support, IPSec VPN tunnels, Bandwidth Management, Web Filtering, E-mail SMTP Server Protection, Remote Management, comprehensive rule-based Packet Filtering, PPPoE, and much more...

BullDog is a powerful but lightweight firewall for heavy use systems. With many features, this firewall can be used by anyone who wants to protect his/her systems. This system allow dynamic and static rules sets for maximum protection and has several advance features.

This firewall will work for the hobbyist or a military base. Generation 7 is a complete rewrite of its predecesors and is redesigned from scratch and still evolving.

Be prepared to spend some time setting this up. If you are looking for a "quick fix", then you are on the wrong site. BullDog is NOT a quick fix, but rather one step in a complete security policy.

Its is covered by the GPL and is FREE and always will be. I encourage and welcome anyone who wants to port and/or provide ideas/code to better this software.

I would like to see this software developed into a new breed of firewall that provides the best of security with ease of use.

This software was developed on Linux v2.2.16-17 and v2.4 with 64 megs to 1 Gig of RAM and supports iptables via the ip_queue kernel module. Bulldog will NOT run on Windows systems.

Firewall is a set of scripts (firewall, fwup and fwdown) that implement an ipchains firewall and various forms of network address and port translation. All you have to do is read the policy file and edit it to reflect your topology and filtering policy.

The policy file is composed of sections in which you need to specify: this hosts trusted and untrusted network interfaces; this hosts role and function within the network topology; the incoming and outgoing services to allow and the internal and external hosts that may take part in them. It has been designed to make this as painless and flexible as possible.

Each section contains detailed explanations and advice on things such as when to start the firewall and the security implications of various well known internet services and advice on how to allow them safely. It is intended to introduce administrators to some subtleties of packet filtering quickly so that they can make better informed security decisions and achieve and maintain effective network security (at least the packet filtering part) in a very short time. Of course, it will not prevent you from making bad network security, but you will have been warned.

Here are some key features of "firewall":

· Single Host (no forwarding, no address/port translation)
· Forwarding (no address/port translation)
· Masquerading (outgoing M:1 NAPT)
· Port Forwarding (Masquerading + incoming 1:M NAPT)
· Alias Port Forwarding (Masquerading + incoming N:M NAPT)
· Static NAT (incoming and outgoing 1:1 NAT)

CheckIt Firewall Sensor is used to determine whether you are behind a firewall or NAT (Network Address Translator). This application is useful when encountering problems attempting to make an Internet video call.

NATting SOHO firewall is a firewall script for iptables.

# Model NATting SOHO firewall for SP article
# by Jay Beale (jay@bastille-linux.org)
#
# Warning: youre going to have to hack this for your own purposes.
#

# Assumptions:
# your internal network is 192.168.1.0/24 on eth1
# your internet IP is 10.0.0.1 on eth0
# your internal network IP on eth1 is 192.168.1.1
#
# Additonally:
# you have another internal network, a DMZ: 192.168.2.0/24 on eth2

$INTERNAL_IP = 192.168.1.1
$INTERNAL_NET = 192.168.1.0/24

$INTERNET = 10.0.0.1

$DMZ = 192.168.2.0/24

# Insert the required kernel modules
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp

# Set default policies for packets going through this firewall box

iptables -t nat -P PREROUTING DROP
iptables -t nat -P POSTROUTING DROP
iptables -P FORWARD DROP

# Set default policies for packet entering this box

iptables -P OUTPUT ALLOW
iptables -P INPUT ALLOW

# Kill spoofed packets

for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 1 > $f
done

# Anything coming from our internal network should have only our addresses!
iptables -A FORWARD -i eth1 -s ! $INTERNAL_NET -j DROP

# Anything coming from the Internet should have a real Internet address
iptables -A FORWARD -i eth0 -s 192.168.0.0/16 -j DROP
iptables -A FORWARD -i eth0 -s 172.16.0.0/12 -j DROP
iptables -A FORWARD -i eth0 -s 10.0.0.0/8 -j DROP

# Note:There are more "reserved" networks, but these are the classical ones.

# Block outgoing network filesharing protocols that arent designed
# to leave the LAN

# SMB / Windows filesharing
iptables -A FORWARD -p tcp --sport 137:139 -j DROP
iptables -A FORWARD -p udp --sport 137:139 -j DROP
# NFS Mount Service (TCP/UDP 635)
iptables -A FORWARD -p tcp --sport 635 -j DROP
iptables -A FORWARD -p udp --sport 635 -j DROP
# NFS (TCP/UDP 2049)
iptables -A FORWARD -p tcp --sport 2049 -j DROP
iptables -A FORWARD -p udp --sport 2049 -j DROP
# Portmapper (TCP/UDP 111)
iptables -A FORWARD -p tcp --sport 111 -j DROP
iptables -A FORWARD -p udp --sport 111 -j DROP

# Block incoming syslog, lpr, rsh, rexec...
iptables -A FORWARD -i eth0 -p udp --dport syslog -j DROP
iptables -A FORWARD -i eth0 -p tcp --dport 515 -j DROP
iptables -A FORWARD -i eth0 -p tcp --dport 514 -j DROP
iptables -A FORWARD -i eth0 -p tcp --dport 512 -j DROP

###
# Transparently proxy all web-surfing through Squid box

$SQUID = 192.168.1.2:8080
$SQUIDSSL = 192.168.1.2:443
iptables -t nat -A PREROUTING -i eth1 -tcp --dport 80 -j DNAT --to $SQUID
iptables -t nat -A PREROUTING -i eth1 -tcp --dport 443 -j DNAT --to $SQUIDSSL

# Transparently forward all outgoing mail to a relay host

$SMTP = 192.168.1.3
iptables -t nat -A PREROUTING -i eth1 -tcp --dport 25 -j DNAT --to $SMTP

# Transparently redirect web connections from outside to the DMZ web
# server

$DMZ_WEB = 192.168.2.2
iptables -t nat -A PREROUTING -i eth0 -d 192.168.1.1 -dport 80 -j DNAT --to $DMZ_WEB

# Source NAT to get Internet traffic through
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to $INTERNET


# Activate the forwarding!
echo 1 >/proc/sys/net/ipv4/ip_forward

VisNetic Firewall is a packet-filtering software firewall built to protect Windows-based Servers, telecommuters / mobile users, and LAN workstations not currently protected by a firewall. VisNetic Firewall is more secure than application-based personal firewalls, yet less expensive than high-end software firewalls.

Organizations running software and/or hardware Internet sharing solutions are as concerned about internal threats as they are about external threats. There is currently not a hardware firewall solution that protects companies against these threats and existing software firewall solutions are priced outside of the small to medium business market.

This product was designed by security experts to test and monitor the performance of FireWall-1. Firewall HealthCHECK gives you the power to test your own firewall security in the privacy of your office. Get the answers to your vulnerabilities before hackers find them for you.

Linux Firewall is a robust, well-designed firewall for Linux 2.4 based on netfilter/iptables. The Projectfiles.com Linux Firewall is the swiss army knife of Linux firewall software. Based on the netfilter-iptables tools, the firewall is a single shell executable written in bash with configuration options and basic documentation included in the same file. It is designed for use with all types of systems: workstations, routers, and servers, and includes advanced features for expert users and Internet Service Providers.

Here are some installation tips:

1. Download the latest rc.firewall [wget http://projectfiles.com/firewall/rc.firewall]
2. Edit the options at the beginning of the file with your favorite text editor. The script comes pre-configured to deny all incoming connections. This is suitable for a typical workstation installation. Refer to the configuration page for in depth explanation of available options.
3. Make the script executable [chmod +x ./rc.firewall]
4. Become root [su]
5. Run the script [./rc.firewall]
6. After you verify that the firewall runs without errors, you may want it to be run automatically on boot. To accomplish this, move the script to the appropriate startup script directory for your distribution [/etc/rc.d/ for Slackware, /etc/init.d/ for Gentoo] and add the following lines in your startup scripts at some point after your ethernet interfaces are configured [for example /etc/rc.d/rc.local for Slackware, and /etc/conf.d/local.start for Gentoo].

Slackware
if [ -x /etc/rc.d/rc.firewall ]; then
/etc/rc.d/rc.firewall
fi
Gentoo
if [ -x /etc/init.d/rc.firewall ]; then
/etc/init.d/rc.firewall
fi

See forum for alternate installation methods.
7. If you are using this firewall on a machine to which you do not have physical access, but can reboot remotely (for example a collocated server or a Linux router at a computer illiterate friends house), you might want to think about putting in a short delay between the time the machine boots and the initialization of the firewall. This would give you a chance to log in and disable the firewall [chmod -x] if something goes wrong. A good example might be if you have the script configured to allow you to connect from a specific remote IP address and your address changes. If you choose to implement this idea, it can be done with the following code in rc.local:

if [ -x /etc/rc.d/rc.firewall ]; then
sleep 30 && /etc/rc.d/rc.firewall | logger -t rc.firewall &
echo "Firewall init in 30 seconds. Check syslog for results."
fi

Antispy Firewall is a simple-to-use anti-spyware and privacy enhancement tool. simply click and start. Antispy Firewall finds spy programs such as Spector designed specifically to record your screen, email, passwords and much more! Antispy Firewall will tell you when it was installed, and disable it! Unlike the typical antivirus approach, it does not rely on pattern-matching, so it may work on new or unknown types of monitoring programs, many cool than any other spy software scanner!

InJoy Firewall is a flexible firewall security solution for businesses of any size. It offers preconfigured policy templates, including full customization options, IPSec VPN integration, gateway capabilities, intuitive management, access control, many documented deployment examples, and comprehensive documentation.

Without question, the Linux Operating System provides a proven and cost-effective platform, as well as a wealth of high-quality open source software. For business use, however, it often proves difficult to find supported linux firewall solutions that provide the required level of confidence, reliability and trust. With the InJoy Firewall , businesses can benefit from Linux without having to give up the safety of a responsible vendor and a traditional business relationship.

Security as never before the InJoy Firewall for Linux provides customers with next generation intrusion and anomaly detection. These technologies provides network administrators with the ultimate tools to keep track of network activity and eliminate Internet threats of any type.

As a busy and responsible network administrator, you will find great relief in the InJoy Firewall . As the only Linux firewall, it is designed from the ground up to be self-contained, thus ensuring optimal performance and minimum impact from third-party problems. This means you dont have to worry about dependencies with Linux connectivity software, software libraries or kernel compilation.


Manage your remote Linux-based Firewall Server from your Windows-based desktop (or any other supported Operating Systems), using the intuitive InJoy firewall GUI. Linux users that prefer plain-text configuration can opt for that with the InJoy firewall as well.

The InJoy firewall works the same under all the supported operating systems, meaning you can deploy a complete and unified protection strategy throughout the business and effortlessly set up fully capable VPNs without having to worry about interoperability issues.

The InJoy firewall installs in minutes and can be prepared for distributed, company-wide deployment, using the same simple installation scripts everywhere.

PCX Firewall is an IPTables firewalling solution that uses Perl to generate static shell scripts based upon the users configuration settings.

This allows the firewall to startup quickly, as it does not have to parse config files every time it starts.

Whats New in This Release:

· All known bugs have been fixed. Support has been added for Debian Sarge and Red Hat FC[1-3] as "official" distributions to work with when generating init scripts. The ability has been added to just install the generated firewall script into /etc/init.d or /etc/pcx-firewall without starting it.

VisNetic Firewall delivers protection to security-conscious professionals.

More secure than the average personal firewall or application-level firewall, yet more cost effective than high-end firewalls, VisNetic Firewall provides peace-of-mind through comprehensive intrusion protection.

VisNetic Firewall examines each packet being sent, inside and outside of the network to verify whether the packet is allowed or denied access through the firewall.

VisNetic Firewall guards the computers of Telecommuters/Mobile Users, Windows-based Workstations, Windows-based Servers, and Business Networks.

Here are some key features of "VisNetic Firewall":

Stateful Packet Inspection

VisNetic Firewall falls into a class of firewalls called Stateful Inspection Firewalls. Stateful inspection firewalls determine whether packets can get through the firewall based on the protocol, port, and source and destination addresses. For every request that is allowed by this strategy, stateful inspection firewalls open up a limited time window to allow response packets, but ONLY from the same host.



Port Scan Detection

VisNetic Firewall detects the seven most common forms of port scans, alerting you with a log entry and optionally automatically banning the IP address of the scanner, ensuring that they are "cut off" before they can discover any useful information about your system.



SYN Flood Detection

A SYN Flood is a common type of denial of service (DoS) attack used against servers. When launching a SYN Flood, an attacker bombards you with so many connection requests that your computer is unable to accept legitimate connections, effectively shutting down your web, email, FTP or VPN server. VisNetic Firewall employs SYN cookies to protect you from SYN Flood attacks.



Remote Administration

Using the remote administration component of the Server version of VisNetic Firewall, you can now remotely administer any VisNetic Firewall using an encrypted communications link. You can also reboot or shut down the remote system using the remote admin controls. In addition to remotely administering other Server or Workstation firewalls, you can use the stand-alone Remote Administration Tool to remotely connect to your own Server firewall.



IP Address Ban List

VisNetic Firewall lets you block IP addresses or ranges of addresses to prevent unwanted connection attempts. This can be particularly effective in stopping repeated requests from a hacker who is trying a large number of hacks, looking for one that works.



HTTP Filtering

Using VisNetic Firewall s HTTP Filtering, you can prevent intrusion attempts targeted at your web server by screening requests and automatically banning the offender s IP address, preventing further access.



MAC Address Filtering

VisNetic Firewall now has the ability to filter traffic based on MAC addresses. Because a MAC address is specific to one individual network interface, this feature is particularly useful if you want to allow or block traffic from a particular computer whose IP address may change.