3

I want to set up a firewall for a small office. I have a server on which I can install an OS of my choice. I was thinking of trying pfSense but ran into some testing problems and tried IPFIre (Linux based). Hence I will only be referring to the last one here.

IPFIre is easy and fast to setup via the web interface. However, when it comes to configuring certain tools (such as rsyslog forwarding, a Suricata IDS, any other tools I could think of later), I would prefer using the usual CLI and terminal rather than a web interface that I don't fully control/understand. Also, setting things directly from a terminal in IPFire so far seemed to me complicated (at least, different from the Linux I know and not so documented).

These consideration might be wrong as I haven't been studying the case much.

My question is: would it be bad idea to build my own firewall from a Debian 8 (using iptables and other relevant tools, such as Squid proxy/filter, Suricata within the office, etc.)?

EDIT 1: I can take the time necessary to build such firewall and have some knowledge (I would guess enough) in iptables. The requirements for the firewall are quite basic. Concerning traffic, an OpenVPN bridge and HTTP(S).

I am just wondering whether these Firewall distributions (IPFire, pfSense, etc.) had specific protections that would be very hard/impossible to implement in a "normal" Linux OS such as Debian.

closed as primarily opinion-based by Steffen Ullrich, LvB, Iszi, Purefan, Xander Jun 8 '16 at 14:54

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • The answer would depend on your knowledge, your requirements and probably other information. While it would be possible to build your own firewall this way it is neither guaranteed that you will succeed with your (unknown) knowledge nor that it will provide all your (unknown) security requirements. – Steffen Ullrich Jun 7 '16 at 8:13
  • Your comment makes sense and I was expecting it but I still have a question. Hopefully my edit makes it clearer. – Bamse Jun 7 '16 at 8:25
  • 1
    There is no secret sauce in these firewall distributions, only lots of knowledge and experience and time spend. Thus with enough efforts one should be able to replicate this. – Steffen Ullrich Jun 7 '16 at 9:23
  • 1
    "on which I can install an OS of my choice" In that case I'd also suggest taking a look at OpenBSD (or FreeBSD). I, personally, really like pf (Howto & examples here). – RobIII Jun 7 '16 at 12:02
  • I am well used to Debian which is a good reason to chose it for an office but less for a home firewall. I will definitely try OpenBSD or FreeBSD. – Bamse Jun 7 '16 at 12:12
1

All the systems I have seen (either dedicated, appliance-like ones, or "helpers" in normal distributions) boil down to building an iptables configuration.

The advantage of going though them is that you do not absolutely have, right away, to understand all the details when you use a default, well documented example configuration.

What you look for instance at a basic shorewall installation, the configuration built is HUGE compared to what you would have thought by yourself (when you are not experienced). An appliance OS will package things for you and make them maybe more straightforward. They do not add anything more, technically speaking (i.e. no special firewall functionality you would not have with a correctly configure OS and iptables).

My personal opinion is to go for the OS + iptables helper solution, you will learn a lot in the process. You may need to adjust your kernel but again, this is part of the learning.

As a side note, I reviewed recently several GUIs to manage iptables. I found that there are no modern ones (the ones which exist are either old or abandoned) while the CLI ones are solid (shorewall and firehol are two which I found interesting).

  • Thanks for the reply. Since I do have a bit of time, I would really enjoy using the Debian + Iptables method as I would get to learn more. – Bamse Jun 7 '16 at 11:55
  • This is what I use for years with a setup like yours, probably a bit more complicated with several OpenVPN connections (inbound and outbound) and now LDX containers. I would recommend to try shorewall for the iptables management -- after several rounds around other solutions (notably firehol) I am back to it. – WoJ Jun 7 '16 at 11:56
1

Speaking from experience, I have both a couple of PfSense fws and a Debian 8 with IPsec VPN+iptables.

Putting all together, you would take more or less the same time.

The advantage of PfSense is that you setup it once, and it is pretty much set and forget, aside the updates.

The Debian box takes much more time refining the setup and maintaining.

As for my Debian box, it actually is an open source router, a Lamobo R1

It does:

  • Internet routing
  • VPN
  • DNS cache + dnscrypt
  • DHCP
  • VoIP
  • tor

I prefer an IPsec VPN to OpenVPN as I set it up as downright compatible with OS/X and iOS, and thus use their native functionalities instead of installing extra software.

You might even consider a mixed solution of a Debian 8 firewall, and pfsense for the VPNs. The VPNs are more difficult to get it right, and with the right tutorials and a little network skill, you can easily put together VPNs that are compatible with the native VPNs of OS/X, iPhone Android 4.x, and Windows 7-10.

  • Thanks for the reply, I had to accept one answer and yours came last, therefore the choice. However, both helped just as well. As for the VPN, it is simply a "routed mode" connection to a OpenVPN gate for accessing another private net. The OpenVPN client will be lying in the Firewall and the end users would not see anything. – Bamse Jun 7 '16 at 11:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.