PfSense
Это решение для обеспечения безопасности с открытым исходным кодом на основе ядра FreeBSD.
– это один из ведущих сетевых файрволов с коммерческим уровнем функционала.
pfSense доступно как оборудование, виртуальное устройство и загружаемый исходник (общая версия).
Бесплатно вы получаете общую версию.
Мне нравится их исчерпывающая документация, хорошо понятная и простая в использовании. Вот некоторые из значимых упоминаемых особенностей pfSense:
Больше функций, чем предоставляют некоторые коммерческие файрволы, вы получаете БЕСПЛАТНО.
Поразительно, не так ли?
Кроме того, у вас также есть возможность устанавливать пакеты всего одним щелчком мыши.
Например:
- безопасность — stunner, snort, tinc, nmap, arpwatch;
- мониторинг – iftop, ntopng, softflowd, urlsnarf, darkstat, mailreport;
- создание сети — netio, nut, Avahi;
- маршрутизация — frr, olsrd, routed, OpenBGPD;
- обслуживание — iperf, widentd, syslog-ng, bind, acme, imspector, git, dns-server.
pfSense выглядит многообещающе и его стоит попробовать.
IPFire
основан на Netfilter и ему доверяют тысячи компаний по всему миру.
IPFire можно использовать как файрвол, прокси-сервер или VPN-шлюз — все зависит от того, как вы настроите его. Он обладает большой гибкостью в настройках.
IDS (система обнаружения вторжений) является встроенной, поэтому атаки обнаруживаются и предотвращаются с самого начала, а с помощью дополнения Guardian вы можете осуществлять автоматическую профилактику.
Вы сможете понять как работать с IPFire менее чем за 30 минут. Прочитать больше о его возможностях можно здесь.
OPNSense
является ответвлением pfSense и m0n0wall. Графический интерфейс доступен на нескольких языках, таких как французский, китайский, японский, итальянский, русский и др.
OPNSense обладает многими серьезными уровнями безопасности и функциями файрвола, такими как IPSec, VPN, 2FA, QoS, IDPS, Netflow, Proxy, Webfilter и т.д.
Он совместим с 32-битной или 64-битной системной архитектурой и доступен для загрузки как ISO-образ и USB-установщик.
NG Firewall
от Untangle — это единая платформа, где вы можете получить все необходимое для защиты сети своей организации.
Он обладает красивой панелью инструментов, попробовать демо-версию можно здесь. Он работает как магазин приложений, где вы можете запускать или отключать отдельные приложения (модули) в соответствии со своими потребностями.
В бесплатной версии вы получаете доступ к самой платформе NG Firewall, бесплатные приложения и 14-дневную пробную версию платных функций.
Smoothwall
— это бесплатное решение с простым веб-интерфейсом для настройки и управления файрволом.
Smoothwall express поддерживает LAN (локальную сеть), DMZ (демилитаризованную зону), внутренний и внешний сетевой файрвол, веб-прокси для ускорения, статистику трафика и др. Выключение или перезагрузка возможны непосредственно через веб-интерфейс.
Примечание: Следующие две программы предназначены только для серверов Linux.
Ufw
(несложный файрвол) работает с Ubuntu. Для управления системой фильтрации пакетов ядра Linux (Netfilter) он использует интерфейс командной строки.
Csf
csf (ConfigServer security) протестирован и поддерживается на следующих ОS и виртуальных серверах:
— это файрвол с контролем состояния соединений, обнаружением входа в систему и обеспечением безопасности для серверов Linux.
Я надеюсь, что вышеперечисленные бесплатные решения для файрвола помогут вам сэкономить деньги и защитить вашу инфраструктуру от взлома.
LOOKING.HOUSE — на проекте собрано более 150 точек looking glass в 40 странах. Можно быстро выполнить команды host, ping, traceroute и mtr.
The firewall menu — endian utm 3.0 reference manual
This section allows to set up rules that specify if and how the
network traffic flows through the Endian UTM Appliance. The firewall on
the Endian UTM Appliance is divided in different modules, each monitoring
and allowing or blocking one specific type of traffic. The modules
available are the following:
Within each of the sub-menus, in which all the corresponding existing
rules are listed, any customised rules can be added, for any type of
service or every port/protocol. The various parts of which the
firewall is composed refer to different types of traffic (e.g.,
OpenVPN governs the traffic from/to the VPN users, inter-zone traffic
the one flowing from zone to zone) and are designed to avoid any
overlapping or even contrasting rules. In other words, there is no way
to write two rules in two different firewall modules whose combined
effect causes an unwanted block or access of packets.
The choice to separate the networks controlled by the Endian UTM Appliance
allows also for an easier management of the firewall, whose
configuration may become very complex. Indeed, each of the modules can
be considered as an independent firewall, and their combined effect
covers all possible packet flows through the Endian UTM Appliance.
Additionally, for any of the modules listed above, one or more rule
may exist, that can neither be disabled nor removed. These are the
so-called Rules of system services (or System rules) whose purpose
is to allow the correct interoperability of the services running on
the Endian UTM Appliance with the Endian Network infrastructure.
The rules that are defined here will be transformed into
iptables commands, the standard Linux firewall tool since
the 2.4 kernel, and therefore organised into tables, chains, and
rules. For a more in-depth description of the various elements that
compose a firewall rule, or even to learn how to fine-tune and to
manage a complex firewall, it is suggested to read either the
iptables(8) manual page on any Linux box, or some of the
countless online resources or tutorials available on the Internet.
When adding a rule, most of the values to configure in the various
modules are of the same type (e.g., the source or destination
interfaces), since in the end they are all setup with
iptables. Therefore, in order to keep this section short
and readable, all the configuration items that are common to all
modules of the firewall are grouped here and defined only once. There
will be some more explanation only in case of significant differences
with the descriptions given here.
Source or Incoming IP. Usually in the form of a drop-down menu,
this setting is the type of the source or incoming connection that
should be matched. Depending on the type chosen, the selection of
different connections from the small box underneath the menu will be
possible: Zone/VPN/Uplink is either the source zone, VPN client,
or uplink to which this rule should be applied, Network/IP/Range
the IP address or range or the network addresses, OpenVPN User and
L2TP User the OpenVPN or 2TP users, respectively.Destination or Target. Also this setting comes in the form of a
drop-down menu and allows the choice among three types of
destination that should be matched, which are the same as in the
Source drop-down menu: A Zone/VPN/Uplink, Network/IP, OpenVPN
User or L2TP user, except for some small change (e.g., for some
type of rules, the target can not be an OpenVPN or L2TP user).Service, Port, and Protocol. A service is usually defined as a
combination of a port and a protocol. For example, the SSH service
runs by default on port 22 and uses the TCP protocol. These three
options control the port and protocol to which to apply the rule and
consist of two drop-down menus, from which to choose either a
pre-defined Service, that will also set the protocol and the port
range in the text area, or one Protocol and optionally a port or a
port range. Available protocols are: TCP and UDP – the most
used, GRE – used by tunnels, ESP – used by IPsec, and ICMP –
used by the ping and traceroute commands.‘Access from’ sub-rule. Almost every rule can be further detailed
by adding several Access from rules to it, for example to limit
access to a client depending on the zone from which it connects to
the Endian UTM Appliance. Access from rules can be configured when
the advanced mode is selected (see below). As a consequence, a rule
can appear split on two or more lines, depending on the number of
access policies defined. Each access from sub-rule can be deleted
individually, without changing the main rule. Each of the sub-rules
can even have a different filter policy.Policy, Filter Policy. The action to carry out on the packets
that match the current rule. The drop-down menu allows to select
among four options: Allow with IPS -let the packet pass but
analyse it with the Intrusion Prevention System,
Allow – let the packets pass without any check, Drop – discard
the packet, and Reject – discard the packet and send an error
packet in response.Enabled. Every rule created is by default enabled, but it can be
saved and not activated by unticking the checkbox, i.e., it
will not be taken into account for packet filtering. Disabling a
rule may prove useful for troubleshooting connections’ problems.Log, Log all accepted packets. By default, no log entries is
written when traffic is filtered. To enable logging for a rule, tick
the box.Remark. A description or a remark about the rule, to remember the
purpose of the rule.Position. Recall that the iptables rules are processed
in the order they appear on the list and that some is a
“terminating” rule, i.e., it may drop or reject a packet and stop
the processing of the subsequent rules. This drop-down menu allows
to choose in which position this rule should be saved.Actions. On all rules several actions can be carried out:
Finally, after every change has been saved in the firewall rules, the
firewall should be restarted to reload the configuration. A callout
with a clickable Apply button will appear to recall this
necessity.
The Port forwarding / NAT module is composed by three tabs: Port
forwarding / DNAT, Source NAT, and Incoming
routed traffic. Its purpose is to manage all the traffic that flows
through the uplink, from the RED zone to the Endian UTM Appliance and the
NAT-ed traffic, both incoming and outgoing.
Destination NAT is usually employed to limit network accesses from
an untrusted network or to redirect the traffic coming from the
untrusted network and directed to a given port or address-port
combination. It is possible to define which port on which interface
should be forwarded to which host and port.
The list of the configured rules shows several information: The ID
(#) showing the order in which the rules are matched against the
traffic, the Incoming IP address, the service (i.e., port and
protocol) to which the traffic is directed, the Policy applied to
the traffic, the Translate to address (i.e., the host and port where
to redirect the traffic), a custom Remark, and the available
Actions.
When editing a rule, the same form open as when adding a new rule, by
clicking on the Add a new Port forwarding / Destination NAT
rule. A link on the top right of the form allows to chose between a
Simple mode or an Advanced mode. The latter
mode allows also to fine-tune the Access from, the policy, and the
type of Translate to.
Besides the common options, these other settings can
be configured:
- Translate to
This part of the form changes depending on the current active
editing mode, simple or advanced. If the mode is set to
advanced, besides adding Access from sub-rules, there is an
additional Type drop-down menu that allows to chose among
different types of translations.The first one is IP and corresponds to the only one available
in simple mode. Here should be written the destination IP
address (besides port and NAT), the port or port range to forward
to and if to apply NAT or not to the incoming packets.OpenVPN User: choose one OpenVPN user as the destination target
for the traffic.Load Balancing: specify a range of IP addresses to which
traffic will be split, to avoid bottlenecks or the overloading of
a single IP.Map the network. Insert a sub-network to which translate the
incoming traffic.L2TP User: choose one L2TP user as the destination target for
the traffic.Except when selecting the Map the network option, it is always
possible to define the port or port range to which the traffic
should be sent to, and if to apply NAT on the traffic or not. If
Do not NAT is chosen, it is not allowed to define a Filter
policy under the Access From (advanced mode).
In this page can be defined rules that apply SNAT to outgoing
connections. The list of already defined rules is also displayed, for
each of which the source and destination IP addresses, the service,
the NAT status, a custom description of the rule, and the available
actions are shown.
Source NAT can be useful if a server behind the Endian UTM Appliance has an own
external IP and the outgoing packets should therefore not use the RED
IP address of the firewall, but the one of the server. To add a new
rule, click on Add a new source NAT rule and proceed like
in the case of adding a port forwarding rule. Besides the common
options, only one other setting can be configured:
- NAT
Select to either apply NAT, No NAT, or Map Network. The
choice to use SNAT allows the selection of the IP address that
should be used among those presented in the drop-down
menu. The Auto entries will automatically choose the IP
address corresponding to the outgoing interface.
New in version 3.0: Application Firewall (Application Control)
The Endian UTM Appliance comes with a pre-configured set of rules for outgoing
traffic, i.e., to allow traffic flow of specific services, ports, and
applications from the various zones to the RED interface and therefore
the Internet. These rules are needed to ensure that the most common
services always be able to access the Internet and work correctly. Two
boxes are present on this page, one that shows the current rules and
allows to add new ones, and one that allows to set the outgoing
firewall options.
Endian UTM Appliance and Application Firewall (Application Control).
Application firewalls are a recent development and improvement to
stateful firewalls, that combine the ability of the latter to keep
track of the connection’s origin and path with those of Intrusion
Prevention Systems to inspect packets’ content, with the purpose to
provide higher security from worm, viruses, malware, and all types
of threats. The final result from the user experience point-of-view
is that firewalls can block not only traffic between ports and IP
addresses, but also traffic generated by single applications. This
requires however, more efforts from the firewall: While traffic
between IP addresses only needs that the first packet be inspected
to block or allow the whole flow, to correctly recognise traffic
generated by application, it is sometimes necessary the analysis of
a few packets -usually not more than 3- of the flow.
Starting with version 3.0, every Endian UTM Appliance is equipped with
nDPI, an open source
library implementing Deep Packet Inspection, thus allowing the
deployment of rules for application firewalling. nDPI is deployed
as a kernel module and interacts with iptables for the packet
analysis.
Hence, there are now two different types of rules that can be
defined on the outgoing firewall:
When no application rules have been defined, the behaviour of the
firewall is exactly the same as in previous version. Whenever an
application rule has been defined, however, the steteful rules
preceding it behave normally, while all the rules after undergo
nDPI.
It is worth noting that the use of nDPI might present some
subtleties, illustrated by the following example, and therefore
might produce some unwanted side effect.
Suppose that a company wants to allow all HTTP traffic, except for
youtube and gmail. The first default rule defined in Endian UTM Appliance is
to allow all HTTP traffic, with no restriction. This rule must
therefore be disabled as first step. Then, two rules must be
defined:
an application rule blocking the gmail and youtube protocols
a stateful rule allowing all http traffic.
If rule 2. were an application rule with protocol HTTP, then only
traffic recognised as HTTP by nDPI would be allowed, but other
protocols using HTTP, like e.g., Yahoo and FaceBook would pass,
since nDPI does not consider them as being HTTP, but indipendent
protocols.
In detail, these are the services and protocols allowed by default to
access the REDIP from the zones and shown in the top box:
GREEN:HTTP,HTTPS,FTP,SMTP,POP,IMAP,POP3s,IMAPs,DNS,ICMPBLUE:HTTP,HTTPS,DNS,ICMPORANGE:DNS,ICMPEverything else is forbidden by default except for the System rules
which allow access to the services in the Endian Network. The system rules
are defined even if the corresponding zones are not enabled.
Possible actions on each rule are to enable or disable it, to edit it
or delete it. Additional rules can be added by clicking on the
Add a new firewall rule link at the top of the
page. Please remember that the order of rules is important: the first
matching rule decides whether a packet is allowed or denied,
regardless of how many matching rules follow. The order of the rules
can be changed by using the up and down arrow icons next to each rule.
The following settings differ from the default common options.
- Source
It can be one or more Zone/Interfaces, Network/IP, or MAC addresses.
- Destination
Can be the RED zone, one or more uplinks, or one or more
network/host addresses accessible outside the RED interface.- Application
This search widget allows to select the applications that should be
part of the rule. Applications are dividend into categories (e.g.,
Database, filesharing, and so on).
It is possible to disable or enable the whole outgoing firewall by
clicking on the Enable Outgoing firewall switch. When disabled, all
outgoing traffic is allowed and no packet is filtered: This setting is
however strongly discouraged and the recommendation is to keep the
outgoing firewall enabled.
- Log accepted outgoing connections
Ticking this checkbox causes all the accepted connections to the
RED interface to be logged.
Proxy and outgoing firewall.
Whenever the proxy is activated for a given service (e.g., HTTP,
POP, SMTP, DNS), the firewall rules in the outgoing firewall will
take no effect, because of the nature of the proxy.
With the proxy activated, whenever a connection starts from a
client to the Internet, it will either be intercepted by the proxy
on the Endian UTM Appliance (in transparent mode) or go directly to
the firewall, but never go through the firewall. The proxy then
starts a new connection to the real destination, gets the data and
sends it to the client. Those connections to the Internet always
start from the Endian UTM Appliance, which hides the clients internal
IP address. Therefore, such connections never go through the
outgoing firewall, since in fact they are local connections.
This module permits to set up rules that determine how traffic can
flow between the local network zones, excluding therefore the RED zone
(traffic through the RED zone can be filtered in Outgoing traffic and
Port forwarding / NAT). To activate the inter-zone firewall, click on the grey
switch 
. Two boxes are present on this page, one that shows the
current rules and allow to add new ones, and one that allows to set
the inter-zone firewall options.
Register your endian firewall community efw | open source firewall
GermanyAmerican SamoaCameroonCanadaCape VerdeKazakhstanQatarKenyaKyrgyzstanKiribatiCocos (keeling) IslandsColombiaVirgin Islands, U.s.ComorosCongo, The Democratic Republic Of TheCongoKorea, Democratic People’s Republic OfKorea, Republic OfCroatiaCubaKuwaitLao People’s Democratic RepublicLesothoAndorraLatviaLebanonLiberiaLibyan Arab JamahiriyaLiechtensteinLithuaniaLuxembourgMacaoMadagascarMalawiAngolaMalaysiaMaldivesMaliMaltaMoroccoMarshall IslandsMartiniqueMauritaniaMauritiusMayotteAnguillaMacedonia, The Former Yugoslav Republic OfMexicoMicronesia, Federated States OfMoldovaMonacoMongoliaMontserratMozambiqueMyanmarNamibiaAntarcticaNauruNepalNew CaledoniaNew ZealandNicaraguaNetherlandsNetherlands AntillesNigerNigeriaNiueAntigua And BarbudaNorthern Mariana IslandsNorfolk IslandNorwayOmanPakistanPalestinian Territory, OccupiedPalauPanamaPapua New GuineaParaguayEquatorial GuineaPeruPhilippinesPitcairnPolandPortugalPuerto RicoRÉunionRwandaRomaniaRussian FederationArgentinaSolomon IslandsZambiaSamoaSan MarinoSao Tome And PrincipeSaudi ArabiaSwedenSenegalSeychellesSierra LeoneArmeniaZimbabweSingaporeSlovakiaSloveniaSomaliaSpainSri LankaSaint Kitts And NevisSaint LuciaSaint Pierre And MiquelonItalyArubaSaint Vincent And The GrenadinesSouth AfricaSudanSouth Georgia And The South Sandwich IslandsSurinameSvalbard And Jan MayenSwazilandSyrian Arab RepublicTajikistanTaiwanAzerbaijanTanzania, United Republic OfThailandTimor-lesteTogoTokelauTongaTrinidad And TobagoChadCzech RepublicTunisiaEthiopiaTurkeyTurkmenistanTurks And Caicos IslandsTuvaluUgandaUkraineUruguayUzbekistanVanuatuHoly See (vatican City State)AustraliaVenezuelaUnited Arab EmiratesUnited StatesUnited KingdomViet NamWallis And FutunaChristmas IslandBelarusWestern SaharaCentral 3n RepublicBahamasCyprusHungaryMontenegroBahrainBangladeshBarbadosBelgiumBelizeAustriaBeninBermudaBhutanBoliviaBosnia And HerzegovinaBotswanaBouvet IslandBrazilVirgin Islands, BritishBritish Indian Ocean TerritorySwitzerlandBrunei DarussalamBulgariaBurkina FasoBurundiChileChinaCook IslandsCosta RicaCÔte D’ivoireDenmarkAfghanistanSaint HelenaDominicaDominican RepublicDjiboutiEcuadorEl SalvadorEritreaEstoniaFalkland Islands (malvinas)Faroe IslandsEgyptFijiFinlandFranceFrench GuianaFrench PolynesiaFrench Southern TerritoriesGabonGambiaGeorgiaGhanaÅland IslandsGibraltarGrenadaGreeceGreenlandGuadeloupeGuamGuatemalaGuernseyGuineaGuinea-bissauAlbaniaGuyanaHaitiHeard Island And Mcdonald IslandsHondurasHong KongIndiaIndonesiaIsle Of ManIraqIran, Islamic Republic OfAlgeriaIrelandIcelandIsraelJamaicaJapanYemenJerseyJordanCayman IslandsCambodia
HomeOfficeEducationEntertainment & MediaFinancial ServicesGovernmentHealthcareHospitalityIOT – IndustrialManufacturingNon-ProfitRetailSecurityTelecommunicationsTransportationOther