I'm mobile, but has this been updated? I used this in college back in 08 and it was much better than iptables but I don't know if it's kept up with the times.
There was a release this August, but there seems to be a huge gap between 2014 and then.
FireHOL – Linux firewalling and traffic shaping for humans
11–20 of 24 posts
Re: FireHOL – Linux firewalling and traffic shaping for humans
#12Nice to see it posted here, I've been a happy user of FireHOL for a decade, if not more. For a while I was worried it was going to be abandoned, I'm really glad it wasn't.
I'm not a network guy but I was tasked with setting up some servers at a co-lo, including a box to act as the router. FireHOL was a godsend for helping me to setup the rules.
I haven't tried FireQOS yet, but I really want to play with it.
Re: FireHOL – Linux firewalling and traffic shaping for humans
#13Cool! Add application-level rules (like LittleSnitch) and I'm buying (literally, I don't mind paying for such a feature).
You might want to look at OpenSnitch [1]. It requires nfqueue and directly accessing /proc to get info in real time, which is why you'll likely never see it as part of a structured firewall builder like this.
Re: FireHOL – Linux firewalling and traffic shaping for humans
#14We have a couple of servers we can’t move to the cloud for a variety of reasons. In addition, they are running some super legacy applications.
Because of this, we’ve really had to focus on OS level security to protect the application (OS is surprisingly Ubuntu 16).
Good Linux Security Software:
- ModSecurity V3...tough to figure out but so worth it. An incredible L7 Firewall. Immediately provides benefits
- UFW...utterly saves you from IPTABLES. Also has some neat brute force protection (ufw limit ssh).
- ModEvasive...Apache Module which is great for preventing automated vuln scanners like Burp Suite
- ClamAV...antivirus, who knows how effective but is popular
- RKHunter...rootkit hunter, hard to tune but can be worth it
Biggest benefit we got though was from setting all HTTPS Headers on the web server (there are 7 of them now I think you can set). The latest headers like “Feature-Policy” which can disable Javascript’s access to webcam, microphone, and more have been very useful.
Re: FireHOL – Linux firewalling and traffic shaping for humans
#15I use their iplists in pfblocker-ng since 3 years. It's incredibly useful, like "let's block all traffic from tor exit nodes appeared online in the last 30 days".
Re: FireHOL – Linux firewalling and traffic shaping for humans
#16We have a couple of servers we can’t move to the cloud for a variety of reasons. In addition, they are running some super legacy applications. Because of this, we’ve really had to focus on OS level security to protect the application (OS is surprisingly Ubuntu 16). Good Linux Security Software: - ModSecurity V3...tough to figure out but so worth it. An incredible L7 Firewall. Immediately provides benefits - UFW...utt…
I wonder though, is root kit even detectable? Perhaps most are.
Re: FireHOL – Linux firewalling and traffic shaping for humans
#17I use their iplists in pfblocker-ng since 3 years. It's incredibly useful, like "let's block all traffic from tor exit nodes appeared online in the last 30 days".
Useful, unless your customers are trying to reach you via Tor.
Re: FireHOL – Linux firewalling and traffic shaping for humans
#18I use their iplists in pfblocker-ng since 3 years. It's incredibly useful, like "let's block all traffic from tor exit nodes appeared online in the last 30 days".
Useful, unless your customers are trying to reach you via Tor.
Yeah, funny. The ones you really need to worry about won't be stopped by that ;)
Re: FireHOL – Linux firewalling and traffic shaping for humans
#19Firehole? Weird name...
Re: FireHOL – Linux firewalling and traffic shaping for humans
#20We have a couple of servers we can’t move to the cloud for a variety of reasons. In addition, they are running some super legacy applications. Because of this, we’ve really had to focus on OS level security to protect the application (OS is surprisingly Ubuntu 16). Good Linux Security Software: - ModSecurity V3...tough to figure out but so worth it. An incredible L7 Firewall. Immediately provides benefits - UFW...utt…
Which headers are you talking about?