Firewall questions

[Ean Kingston]

> I have been looking for a great firewall, something
> not too technical, since I have only been using
> FreeBSD for two months now.
>
> I have FreeBSD-4.8 installed, Apache-1.3, and
> Netqmail-1.05. I am also planning on running an NTP
> time server and possibly a forum in the future. The
> web site is expected to become a well-recognized site,
> so that complicates matters. More attention to the
> site means more attacks.

If it's a firewall you might want to upgrade to the latest in the series
you are using (4.11). There may be security holes in 4.8 by now.

> Also, I am looking for antiviral protection for both
> the FreeBSD server, and any Windows or Macintosh
> systems that may be using the POP mail. I know qmail
> has one solution, which was contributed by a qmail
> user, but what are the alternatives?

There are very few anti-virus packages for FreeBSD. AFAIK there are no
viruses that target FreeBSD. There are a few that target x86 hardware but
these don't propagate over the 'net.

Have a look at amavis (it's in the ports collection). I've never used it
but it's been mentioned a number of times on various lists.

Also, F-Prot (www.f-prot.com) provides an AV product for FreeBSD (NetBSD,
and OpenBSD too). They even have a mail scanner product. I used the file
scanner for a while but stopped the last time I upgraded the OS.

>
> Any suggestions as to what firewall would provide me
> with the best protection, while not being overly too
> complicated?

For simplicity, get one of the Firewall Router devices and stick your
FreeBSD system behind it. Most have a web interface to manage them. Just
make sure you get the Firewall model and not the Router with NAT model.
Unless you get lucky, the guy a Best Buy (or whereever) won't have a clue
about the differences and will not be able to help even if he thinks he is
helping. You need to do your research on this.

On FreeBSD you have a choice of IPFW, IPF, and PF. IPFW is FreeBSD only,
IPF runs on many OSes (but not Linux), and PF is a port of the OpenBSD
firewall. All are included with the FreeBSD distribution but require a
kernel recomple (it's explained in the handbook and isn't nearly as scary
as it sounds). All are about a complicated to configure/manage.

-- 
Ean Kingston
    E-Mail: ean_AT_hedron_DOT_org
 PGP KeyID: 1024D/CBC5D6BB
       URL: http://www.hedron.org/