# Firewall software question

## fxsti01

Post install live cd 2006, P4, dell 5100 laptop, KDE, gentoo sources kernel, about 12 hours to get to the desktop.

Which software firewall would you recommend to lock down a home desktop/laptop with Gentoo?

Firestarter

kMyfirewall

Shorewall

Kerio

other

Not really new to linux, and no where near an expert, would like some kind of gui firewall that is not too encryptic to use.  Was not sure where to post this, since it is post install, probably an FAQ, but deals mainly with security.  Would rather not hack at iptables directly.

Laptop only for typical personal home use, internet, office, email, etc, no ssh or anything like that, left out cups too, did not really need it.

thank you,

fxsti01   :Cool: 

----------

## sternklang

For my own system I just write iptables rules directly, but I've configured Firestarter on other systems and it's very simple to set up and use. 

Shorewall is not simple to use or GUI based (their web site recommends Firestarter if you want an easy-to-use firewall) so it probably doesn't meet your needs. 

I have no experience with kMyfirewall. And I thought Kerio was a Windows-based product.

----------

## fxsti01

firestarter it is then!  oops kerio is windoze based.

thanks alot!

----------

## sternklang

No problem. Good luck!

----------

## thehailo

 *fxsti01 wrote:*   

> Post install live cd 2006, P4, dell 5100 laptop, KDE, gentoo sources kernel, about 12 hours to get to the desktop.
> 
> Which software firewall would you recommend to lock down a home desktop/laptop with Gentoo?
> 
> Firestarter
> ...

 

I actually recommend firestarter for more advanced setups. Guarddog is incredibly easy and a great solution for simple desktop setups. If you're setting up something serious like a server or feel comfortable with a command line (although it does have a front-end), the Bastille hardening script also configures IPTables, but you've got to know what you're doing.

----------

## fxsti01

emerge guarddog, said ip tables was not installed, emerge ip_tables, now getting error,

Using iptables.

Resetting firewall rules.

FATAL: Module ip_tables not found.

iptables v1.3.4: can't initialize iptables table `filter': iptables who? (do you need to insmod?)

Finished.

Perhaps iptables or your kernel needs to be upgraded.

How do I correct this?

thanks.

----------

## thehailo

 *fxsti01 wrote:*   

> emerge guarddog, said ip tables was not installed, emerge ip_tables, now getting error,
> 
> Using iptables.
> 
> Resetting firewall rules.
> ...

 

Go into your kernel and enable iptables there, then enable every suboption as a module.

----------

## fxsti01

so i will have to recompile?

----------

## Keiko

Hia,

When you've modifed your kernel yes, but i think i'm correct in saying you dont have to reboot.

I think the following is all you have to do:

 1. cd /usr/src/linux

 2. make menuconfig

 3. Modfy settings, add iptables support and exit, saving new config file

 4. Make && Modules_Install

 5. cp arch/i386/boot/BzImage /boot<kernel name>

Keiko.

----------

## DaveArb

 *Keiko wrote:*   

> When you've modifed your kernel yes, but i think i'm correct in saying you dont have to reboot.

 

No, once the kernel is rebuilt and installed, you need to reboot to actually use that kernel.

Dave

----------

## Keiko

Thanks for the correction.

Keiko.

----------

## fxsti01

Well, I dorked up my kernel pretty bad.  Went ahead and reinstalled whole system.  Going to try Guarddog again.

Same error's again, errrrrr.

Any good walk thru's for installing new compiled kernel?  Used Live 2006 cd, genkernel, etc.

Got all thru recompiling the kernel, getting hung up at copying it back into boot folder, then symlink, etc.

Most of the walk thru's from the doc's link on main site breeze over this part.

thanks

----------

## fxsti01

Ok, recompiled, finally got it all working fine now, Guarddog works no problem.  On to getting my wireless going now.

 :Very Happy: 

----------

## Keiko

Great news and good luck with the wireless card, when i've tired linux in the past, the distro's would never recognise my network card, gentoo is the first to pick it up and have it work...

Keiko

----------

## minskpower

 *sternklang wrote:*   

> 
> 
> Shorewall is not simple to use or GUI based (their web site recommends Firestarter if you want an easy-to-use firewall) so it probably doesn't meet your needs. 
> 
> 

 

I kind of disagree. It is simple to use, once you read the documentation, and it's pretty well documented.

----------

## fxsti01

So why is iptables not included in the default kernel?  Also why is it that sound is also so difficult to include in the default kernel too?  Even after recompiling about 3 times to get it to boot to the new kernel, still got errors about hotplug not working, and some unknown module popped up?!  Ok, sorry for the ranting, and I am not trying to start a flame war, but these two things could really up the ante for gentoo in general.

Other than my patience being at it's end, I needed the laptop for work and slapped xp back on it.  Trying now to reinstall gentoo on an extra desktop pc.

----------

## minskpower

Here is probably what you are doing wrong: you are probably enabling iptables and sub-options as modules.

After the machine reboots, those modules are not yet loaded. To load them, either insmod them, or if you did make modules_install modprobe them. After that, to have them loaded automatically at boot time, add them to modules.autoload.

Generally I don't enable iptables and most options as modules, just to avoid having to list them all in modules.autoload.

Instead I compile most used options as part of the kernel, keeping only advanced options like ip_gre, vlan support and such as modules because I don't use them often and I modprobe them by hand when I need them.

The most efficient way to compile the kernel is to make a list of all your current hardware, hardware you might add later, features you will use day by day and features you will use rarely. Then with this list go ahead and compile the first category as part of the kernel, and the second as modules. Keep track of module names so you can load them quickly, I do that by keeping a file with module name and what it does because I can't be bothered to remember their names.

Also if you compile third party modules, I suggest keeping them in a separate location and using insmod, just to remember that it's third party, for debug purposes.

I've never used genkernel, I don't rely on automagic. Manually compiling the kernel will take some time, and it requires attention, but will save you headaches later.

----------

## Johnyp

This is what you need my friend. 

I'm using shorewall and it's great. Easy to setup and manage and the tutorila is easy to follow too.

https://forums.gentoo.org/viewtopic-p-2187309.html

----------

## fxsti01

thanks for all the good info!  When I get some time maybe I will try manually installing gentoo on the desktop pc.

----------

