Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Gentoo Firewall appliance "kit"?
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
eccerr0r
Watchman
Watchman


Joined: 01 Jul 2004
Posts: 7241
Location: almost Mile High in the USA

PostPosted: Mon Feb 09, 2015 8:30 am    Post subject: Gentoo Firewall appliance "kit"? Reply with quote

Is there a "firewall ebuild kit" for Gentoo, perhaps something that could be

emerge firewall-solution

and you get a web based firewall solution? :D

Just dreaming I guess, but basically the problem:

I have these Montavista based routers that I absolutely despise because the licensee of the software didn't make the code available to hack (which may very well be a GPL violation by Qwest/CenturyLink). Well theoretically I don't even need to use their router software, I could run the firewall/router on something else. I first looked at DD-WRT and Tomato solutions, which do work, alas I wanted something more: pfSense. Now that has everything I need. However trying to port the Montavista config to pfSense has not been very successful. Porting iptables behavior to PF ... It's like porting Linux to BSD... well it IS exactly that!

Well then it would be nice to have a Linux router and hopefully the behavior can easily be ported Linux to Linux, and be able to run arbitrary Linux apps on the router. And if it were also Gentoo, it could also share upgrade paths...

So does such exist? Or perhaps there's a cheat sheet somewhere to translate iptables behavior to PF commands...
_________________
Intel Core i7 2700K@ 4.1GHz/HD3000 graphics/8GB DDR3/180GB SSD
What am I supposed watching?
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6228
Location: Room 101

PostPosted: Mon Feb 09, 2015 1:13 pm    Post subject: Re: Gentoo Firewall appliance "kit"? Reply with quote

eccerr0r wrote:
Well then it would be nice to have a Linux router and hopefully the behavior can easily be ported Linux to Linux, and be able to run arbitrary Linux apps on the router. And if it were also Gentoo, it could also share upgrade paths...

eccerr0r ... there is the gentoo-router-overlay which though more targeted toward an AP (openwrt kernel) might be a starting point (considering that most of the components for such a firewall/router are in ::gentoo). That, in combination with a *-uclibc-* or *-musl-* stage3 (under 'experimental') might provide a base for such a router. While probably not what you have in mind I'd suggest you also look at Aboriginal Linux (as a build and/or bootstraping system for the "smallest/simplest linux system capable of rebuilding itself") and Alpine Linux.

eccerr0r wrote:
So does such exist? Or perhaps there's a cheat sheet somewhere to translate iptables behavior to PF commands...

I seem to remember that net-firewall/fwbuilder offers some such feature ...

best ... khay
Back to top
View user's profile Send private message
eccerr0r
Watchman
Watchman


Joined: 01 Jul 2004
Posts: 7241
Location: almost Mile High in the USA

PostPosted: Mon Feb 09, 2015 4:21 pm    Post subject: Reply with quote

That Gentoo firewall overlay looks interesting but I think things can be even easier than that: the target hardware is actually a full x86 firewall appliance that can run Gentoo, glibc, etc., directly (maybe a slight bit lacking on memory, 256MB, but that can be bumped to 512MB) - I just was hoping for an in-portage web GUI oriented firewall configuration like pfSense (mostly for firewall hole punching and no, do not want to use upnpd for that), and at worst case I can transfer the iptables config via command line for esoteric configuration - which is why pfSense has been very annoying to get it to work right on my network configuration.

Then again maybe it's best to just go with sticking with FreeBSD (nanobsd) just to make sure of having software diversity in the network hardware...

(Off topic but interesting: the previous version of pfsense, 2.1.5, and the new one 2.2, ... they fixed one really annoying thing: FreeBSD 8.4 takes _forever_ to boot compared to FreeBSD 10.1...it's not even funny how bad 8.4 was... both running off the same CF card.)
_________________
Intel Core i7 2700K@ 4.1GHz/HD3000 graphics/8GB DDR3/180GB SSD
What am I supposed watching?
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6228
Location: Room 101

PostPosted: Mon Feb 09, 2015 8:31 pm    Post subject: Reply with quote

eccerr0r wrote:
That Gentoo firewall overlay looks interesting but I think things can be even easier than that: the target hardware is actually a full x86 firewall appliance that can run Gentoo, glibc, etc., directly (maybe a slight bit lacking on memory, 256MB, but that can be bumped to 512MB) - I just was hoping for an in-portage web GUI oriented firewall configuration like pfSense (mostly for firewall hole punching and no, do not want to use upnpd for that), and at worst case I can transfer the iptables config via command line for esoteric configuration - which is why pfSense has been very annoying to get it to work right on my network configuration.

eccerr0r ... oh, I see, I've never used such a thing but they exist, ankiwall for instance. Nothing else comes to mind ... not sure how developed ankiwall is, or how well supported, but I imagine not the the level of pfSense.

best ... khay
Back to top
View user's profile Send private message
F_
Tux's lil' helper
Tux's lil' helper


Joined: 31 Dec 2006
Posts: 136

PostPosted: Tue Feb 10, 2015 2:42 am    Post subject: Reply with quote

Very interesting idea of "eBuild kits" that I haven't thought of before.

I don't have a solution to your problem, but I would imagine it would be something built on top of Gentoo Hardened.

1. https://wiki.gentoo.org/wiki/Project:Hardened
2. https://wiki.gentoo.org/wiki/Hardened_Gentoo
Back to top
View user's profile Send private message
desultory
Administrator
Administrator


Joined: 04 Nov 2005
Posts: 9276

PostPosted: Wed Feb 11, 2015 4:59 am    Post subject: Reply with quote

eccerr0r wrote:
Is there a "firewall ebuild kit" for Gentoo, perhaps something that could be

emerge firewall-solution

and you get a web based firewall solution? :D
Have you tried app-admin/bastille? If you are investigating it beforehand, try http://sourceforge.net/projects/bastille-linux/?source=directory, instead of the site listed as the homepage in the ebuilds at the moment as it is no longer affiliated with Bastille Linux.
Back to top
View user's profile Send private message
overkll
Veteran
Veteran


Joined: 21 Sep 2004
Posts: 1249
Location: Austin, Texas

PostPosted: Wed Feb 11, 2015 5:35 am    Post subject: Reply with quote

You might want to look at Mikrotik routers and their RouterOS. RouterOS is Linux based and has the best graphical iptables interface I've ever seen - both via their winbox app and via a web browser

www.mikrotik.com & http://routerboard.com

You can download a free trial of their x86 version and install it on a virtual machine

Better off just buying one of their routers since RouterOS is included.
Back to top
View user's profile Send private message
1clue
Advocate
Advocate


Joined: 05 Feb 2006
Posts: 2562

PostPosted: Wed Feb 11, 2015 5:43 am    Post subject: Reply with quote

I'm not so sure about Mikrotik or Tilera. I was fascinated by the cloud core processors but neither company has a response time that ccould make a customer happy. The Mikrotik forum has a lag time of days or more. The specs they give are suspiciously lacking real vpn numbers. The tilera response in email literally took months.

On top of that you can't get prices for tilera hardware without signing a non-disclosure agreement.
Back to top
View user's profile Send private message
1clue
Advocate
Advocate


Joined: 05 Feb 2006
Posts: 2562

PostPosted: Wed Feb 11, 2015 5:47 am    Post subject: Reply with quote

Oh yeah.

If the tilera performance claims are anywhere near correct then the Mikrotik products with cloud core processors are hugely underutilized.
Back to top
View user's profile Send private message
overkll
Veteran
Veteran


Joined: 21 Sep 2004
Posts: 1249
Location: Austin, Texas

PostPosted: Wed Feb 11, 2015 6:02 am    Post subject: Reply with quote

I can't vouch for the tilera processor models. That's their top of the line, and the prices reflect that. For personal use, they are overkill. I'd recommend something more like a RB750GL or the powerpc based dual core RB850.

Personally, I have a CRS125-24G-1S-2HnD-IN that I picked up new for $169 USD.
Back to top
View user's profile Send private message
overkll
Veteran
Veteran


Joined: 21 Sep 2004
Posts: 1249
Location: Austin, Texas

PostPosted: Wed Feb 11, 2015 6:20 am    Post subject: Reply with quote

1clue wrote:
...

On top of that you can't get prices for tilera hardware without signing a non-disclosure agreement.


Did you actually look at the routerboard link I posted? Look at the bottom of the router section. All the CCR* routers are tilera processor based and the Suggested Retail Prices are posted.
Back to top
View user's profile Send private message
1clue
Advocate
Advocate


Joined: 05 Feb 2006
Posts: 2562

PostPosted: Wed Feb 11, 2015 12:23 pm    Post subject: Reply with quote

Sorry i worded that poorly. I'm interested in 10gbps hardware mostly. The routerboard hardware is 1gbps stuff. I tried to contact tilera.com for prices. Their web site isn't even up to date with their latest hardware announcements.

Who does that?
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum