Networking -Firewall

Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev |  | Next

# Chapter 10. Networking -Firewall

Can someone tell me why I might want something like a commercial firewall product rather than simply using `Ipchains` and restricting certain packets? What am I losing by using `Ipchains`? Now, there is undoubtedly room for debate on this-

`Ipchains` is as good, and most of the time better, than commercial firewall packages from a functionality and support standpoint. You will probably have more insight into what's going on in your network using `Ipchains` than a commercial solution. That said, a lot of corporate types want to tell their shareholders, CEO,CTO etc. that they have the backing of reputable security Software Company. The firewall could be doing nothing more than passing through all traffic, and still the corporate type would be more comfortable than having to rely on the geeky guy in the corner cube who gets grumpy if you turn the light on before noon.

In the end, a lot of companies want to be able to turn around and demand some sort of restitution from a vendor if the network is breached, whether or not they'd actually get anything or even try. All they can typically do with an open source solution is fire the guy that implemented it. At least some of the commercial firewalls are based on Linux or something similar.

It's quite probable that `Ipchains` is secure enough for you but not those engaging in serious amounts of high stakes bond trading. Doing a cost/benefit analysis and asking a lot of pertinent questions is recommended before spending serious money on a commercial firewall---otherwise you may end up with something inferior to your `Ipchains` tool. Quite a few of the NT firewalls are likely to be no better than `Ipchains` and the general consensus on bugtraq and NT bugtraq are that NT is far too insecure to run a serious firewall.

Prev | Home | Next
Config TCP/IP Networking manually -command line | Up | Policy, Guidelines etc.