I'm intersted in building a bastion firewall for the following sistuation. Have a closed network (police dept). There are no crosses to the internet. However, we'd like VERY LIMITED access by the Windows DC server for the following: Windows update (via SUS), Symantec AV updates, VNC/or remote desktop connection to 1 or 2 workstations on our WAN.
Thus, I want to limit all traffic except various protocols/ports between specific IP's/URL's.
Certianly FC and iptables can do this, does anyone recommend a configuration utility, start off scripts, etc? Should I be looking more into LRP (now defunct), etc? My iptables knowledge is not great (did it years ago), so some configuration utility would be great, and my co-workers isn't experienced in this area at all.
I like fwbuilder. It's not the easiest to install as it does have a few dependencies, but it's worth it.
It can handle bridging firewalls which is useful if you want to insert a firewall in an existing network to firewall two segments of the same subnet, or you want a totally transparent firewall, with no network presence.
Also, it can handle multiple firewalls, so I have fwbuilder setup to handle the rules for our boundary firewall, the firewalls on the 'Net facing servers such as mail and web servers, all from one configuration on my desktop. It compiles the rules and then installs them on the relevent machine.
-- Nigel Wade, System Administrator, Space Plasma Physics Group, University of Leicester, Leicester, LE1 7RH, UK E-mail : nmw@xxxxxxxxxxxx Phone : +44 (0)116 2523548, Fax : +44 (0)116 2523555
