Free Linux/BSD-based Firewall Distros

[Dice]

This is a list of the free (like beer) firewall distros I have used, and some details about them.
Hopefully someone will find this information useful.


Smoothwall Express
Homepage

The SmoothWall Open Source Project was set up to develop and maintain SmoothWall Express - a Free firewall
that includes its own security-hardened GNU/Linux operating system and an easy-to-use web interface.

Features
http://www.smoothwall.net/products/comparison.gpl.php

Installation details
This distro overwrites all data on the HDD and is designed to be the
only thing on that computer.

User Interface
Any web browser.
SSH
Menu

Screenshots
http://www.smoothwall.org/about/screenshots.php

Downloads available
-32 bit 69MB | ISO CD Image
-64 bit 71MB | ISO CD Image
-VMware image 59MB | BZip2 - VMWare Image

Pros:
Smoothwall has been around since July of 2000 and has a rich, helpful community forum.
This leads me to believe that they will not be going away any time soon.
Also, this company offers corporate editions (Non-Free).
This tells me that they are making money and can better fund the free edition
and those who are working on it. Lots of community-produced Add-ons. (Home Brew)
Audible tones on shutdown, and when ready after reboot. Very good update feature in Web Interface.
Port-Forwarding is very easy to implement. It 'JUST WORKS'.


Cons:
This Distro has no USB Keyboard support in the installation portion. Snort is not working well. No powerful native Web Content Filtering.


IPCop
Homepage

The bad packets stop here.

Features
http://ipcop.org/index.php?module=pnWikka&tag=IPCop14xFeatures

Installation details
boot from floppy / usb floppy ( usb floppy allow only install from cdrom).
boot / installation from IDE / SCSI cdrom.
boot / installation from usb key.
boot from PXE enabled network card (need avdhcp and tftp server).
installation from http/ftp server.

User Interface
Any Web Browser
SSH
Menu

Screenshots
http://ipcop.org/index.php?module=pnWikka&tag=IPCopScreenshots

Downloads available
ipcop-1.4.18-install-cd.alpha.iso Alpha 48.7MB
ipcop-1.4.18-install-cd.i386.iso i386 47.2MB
ipcop-1.4.18-install-pxe.i386.tgz i386 3.85MB
ipcop-1.4.18-install-usb-fdd.i386.img.gz i386 45.1MB
ipcop-1.4.18-install-usb-hdd.i386.img.gz i386 45.1MB
ipcop-1.4.18-install-usb-zip.i386.img.gz i386 45.1MB
ipcop-1.4.18-othersrc.tar.bz2 Platform-Independent 277MB
ipcop-1.4.18-sources.tgz Platform-Independent 1.82MB

Pros:
Fully opensource, Well documented, Ease to Setup and use. Plenty of add-on modules. See the list here.
Audible tones when shutting down and when ready after booting up.

Cons:
Does not include powerful web content filtering natively.


m0n0wall
Homepage

m0n0wall is a project aimed at creating a complete, embedded firewall software package that, when used together with an embedded PC, provides all the important features of commercial firewall boxes (including ease of use) at a fraction of the price (free software).

Features
http://m0n0.ch/wall/features.php

Installation Details
Runs on a live CD-ROM or from CompactFlash with a floppy disk or USB Drive for saving settings.
Also targeted towards the net45xx/net48xx range from Soekris Engineering (www.soekris.com)
and the WRAP platform from PC Engines (www.pcengines.ch)

User Interface
Any Web browser
SSH
Menu

Screenshots
http://m0n0.ch/wall/screenshots.php

Downloads available
net45xx-1.232.img
net48xx-1.232.img
generic-pc-1.232.img
cdrom-1.232.iso
wrap-1.232.img
rootfs-1.232.tar.gz

Pros:
LiveCD, 'nuff said.
Very, very small at around 6MB.

Cons:
Not as feature rich as the others.


Endian Firewall Community
Homepage

Endian Firewall Community is a "turn-key" Linux security distribution that turns every system into a full featured security appliance. The software has been designed with "usability in mind" and is very easy to install, use and manage, without losing its flexibility.

Features
http://www.endian.com/en/community/about/features/

Installation Details
Installs from CD-ROM ISO onto HDD

User Interface
Any Web browser
SSH

Screenshots
http://www.endian.com/en/community/about/screenshots/

Downloads Available
Endian Firewall 2.2 Beta 1 ISO i386104MB
Endian Firewall 2.1.2 Stable ISO i386 112MB
Endian Firewall 2.1.2 Stable VMWare Image 32bit 84.2 MB

Pros:
Each section in the Web interface has a help page link and are VERY helpful!
The most feature-rich distro in this list. Audible tones when shutting down, ready after booting up,
when Red side interface goes down and when it comes up. Again, they have non-free
editions also.

Cons:
There is so much you can do with this distro, it can be overwhelming.
Spotty USB Keyboard support in installation.


PFSense
Homepage

pfSense is an open source firewall derived from the m0n0wall operating system platform with radically different goals such as using OpenBSD's ported Packet Filter, FreeBSD 6.1 ALTQ (HFSC) for excellent packet queuing and finally an integrated package management system for extending the environment with new features.

Features
http://www.pfsense.com/index.php?id=26

Installation Details
LiveCD/Installation CD ISO i386
Embedded
List of tested, known good, hardware

User Interface
Any Web browser* (See Cons section)
SSH
Menu

Screenshots
http://www.pfsense.com/index.php?id=27

Downloads available
pfSense-1.0.1-Embedded Image 21MB
pfSense-1.0.1-LiveCD Installer ISO.gz 26MB
pfSense-1.2-RC3-Embedded Image 24MB
pfSense-1.2-RC3-LiveCD Installer ISO.gz 50MB

Pros:
Very vice, well organized, web interface with 3 'skins'. Easy to add/remove
packages from within web interface. When using Intrusion Detection/Prevention,
you have full control over each of the rules used, in the web interface.
Overall, 2nd best looking Distro, IMO. Built-in wifi support with
fully featured web config page. Can set as AP.

Cons:
The beta version 'Nerve Center' skin web interface drop-down menus don't work well using Internet
Explorer version 7.0.5730.11. Firefox version 2.0.0.11 had no issues.


ClarkConnect Community
Homepage

ClarkConnect is a complete Internet server and gateway solution. The software provides all the necessary software for an organization's server needs. The Community Edition is designed for those with small budgets. The Community Edition is limited to 10 mailboxes, but includes all the groupware features for all your collaboration needs. The edition is best suited for home networks, home offices and small organizations.

Features
http://www.clarkconnect.com/info/features.php

Installation Details
CD-ROM installation ISO designed to install ClarkConnect as the only thing on the HDD.

User Interface
Any Web browser
SSH
Menu

Screenshots
http://www.clarkconnect.com/info/screenshots.php (These are the paid editions screenies,
not the free edition. No free edition screenshots available at this time.)

Downloads Available
Community Edition 4.2 CD-ROM ISO 475MB

Pros:
Overall nice web interface. LAN backup and recovery server. Groupware.
Active forums. Another company which offers non-free solutions.

Cons:
No native Dynamic DNS functionality (howto correct this). No alert tones. Relatively steep H/W requirements.
(Your old 486 wont cut it with ClarkConnect).


Astaro Security Gateway
Homepage

Astaro Security Gateway provides immediate protection for your network, web access and email traffic. The Astaro solution integrates more security applications than any competitor in one award-winning management device. A complete range of hardware appliances scale to the performance level which you demand.

Features
http://www.astaro.com/our_products/astaro_security_gateway/asg_overview
Installation Details
CD-Rom ISO overwrites the HDD contents. During installation, it recommends at least 256mb ram. Heed that. First install attempt failed.
Didn't meet hardware requirements. Astaro has tested hardware, and their results can be found here:
http://www.astaro.com/lists/HCL-ASG-V7.txt

Failed installation was on a Celeron 700 W/128mb pc100
Successful install was on a Celeron 1Ghz W/256mb pc133 (This is still too slow.)

User Interface
Web Browser
SSH

Screenshot
Screenshot

Downloads Available
Astaro strays from the others in how they deliver their software. First you register with their site,
then request a copy and free home license by email. Then you follow the link they send you to
get your ISO and license. After installing, you access the Web Interface and upload the license.
You only get one license.

Pros:
This is a very professional looking piece of software. We are talking Enterprise quality.
Automatic updates. Email reporting with charts and graphs. Feature rich. Would make good use of
powerful machines. Advanced features for advanced users.

Cons:
A pain to acquire. Steep hardware requirements. Not as user-friendly as some others in this list.


If you know of anything which needs to be added/edited please do not hesitate to let me know!

I hope with this information you can make one of these to actively secure your home network!

 

[Ben333]

Very nice I'd vote sticky

 

[smokie mcpott]

nice list, i have used all of these, and have found pfsense to suit me best at the moment

 

[MRD]

For ipcop you list:

"Cons:
Does not include powerful web filtering."

This is not really true, as all you do is add in copfilter which gives you very powerful filtering abilities. It's just that it's not included by default, as they believe their base distro should be as minimal as possible, as the more code you add, the more potential bugs/exploits you add.

 

[Dice]

Thanks for the kind words, guys. I am counting on enough comments/corrections from other members to keep this bumped for a while as it gets polished up.

@MRD I added to the IpCop section. Thank you for the input. I think IpCop is a great one also.
** And my G/f and I both love your avatar**


Keep them coming!

 

[asusradeon]

** STICKY **

 

[hkgonra]

Very nice.

 

[z0n3]

Excellent and accurate information. I appreciate it if you would included a small section at the end stating which one you prefer and why.

 

[Dice]

Excellent and accurate information.

Thanks. I appreciate the feedback.

I appreciate it if you would included a small section at the end stating which one you prefer and why.

I like them all. Some more than others, for varying reasons. (Read: This info is for the community, not about my preferences. Also, I subscribe to the Security by Obfuscation idea. Thusly, I choose to not advertise my firewall.)

In other news, I have added a bit on Astaro Security Gateway. It is an ongoing process.

 

[MRD]

Security by Obfuscation

If you really want wireless security, there is a program out there that floods the airwaves with literally thousands of fake SSID's, making it impossible to even figure out which networks to try to hack. =P

 

[Dice]

If you really want wireless security, there is a program out there that floods the airwaves with literally thousands of fake SSID's, making it impossible to even figure out which networks to try to hack. =P

Like disappearing into a crowd. Nice.

I suppose one could also set the subnet mask of the wireless gateway and the node to which it associates to 255.255.255.254, leaving only one host in the subnet.

Thanks for the correction, =Acid Rain=

 

[=ACID RAIN=]

I vote sticky as well, very good info here!

I suppose one could also set the subnet mask of the wireless gateway and the node to which it associates to 255.255.255.254, leaving only one host in the subnet.

Not so sure about that one, though

255.255.255.252 leaves you 4 addresses, 2 of which are taken by 1) subnet address (first one) and 2) broadcast address (last one) which leaves 2 valid host addresses. 255.255.255.254 would use the subnet address and the broadcast address and leave you with nothing available for host.

Also, even if it would work, you can get bumped off by brute force and have the hacker take over your identity by mac and IP.

 

[Froggy]

bump

 

[Adragontattoo]

I remember reading the smoothwall has taken a beating for a few different reasons in the last two years, a lack of updates, and a lead developer that is a rather large jerk.

I would have to pull up the links to reverify the above but I switched to IPCop a few months ago without an issue.


2u
Athlon 1k
512mb of generic basic RAM.
excluding power outages and moves 3 years running.

 

[Jolly-Swagman]

SmoothWall Express 3 sp1

Cons:
This Distro has no USB Keyboard support in the installation portion. Snort is not working well. No powerful native Web Content Filtering.

Dont think this is true as have used USB keyboard OK, and there are Web content filtering if you so desire it, and parental controls for IM Monitoring , Timed Access control ect

Adragontattoo

I remember reading the smoothwall has taken a beating for a few different reasons in the last two years, a lack of updates, and a lead developer that is a rather large jerk.

There have been several Major Updates to SmoothWall Express 3 in the past year alone,
as for the Highlighted bit , would not know about that part,,,

Been quite Happy with SmoothWall for the last couple of years I have had it in service

 

[hkgonra]

Untangle is another nice one you might look at.
http://www.untangle.com/

 

[SuperMiguel]

pfsense vs smoothwall?

 

[Dice]

pfsense vs smoothwall?

I don't understand your question.

 

[Jimbob7]

pfsense vs smoothwall?

Depends on what you are after, check the sites and forums and take your pick.

 

[Adhoc]

I don't really understand what smoothwall is. Can it be used in place of a router?