Xubuntu Firewall

[Ham Blowfist]

I'm playing with Xubuntu 6.06 (Xfce 4.3.90.2) on an old 750 MHz AMD machine,

and it doesn't seem to come with any simple way to configure a firewall

for my dial-up Internet.

My solution (for now) was to add these lines to /etc/rc.local

(copied/pasted from a help file included with the distro.)

Putting them there was just a shot-in-the-dark on my part.

## Insert connection-tracking modules (not needed if built into kernel).# insmod ip_conntrack# insmod ip_conntrack_ftp
## Create chain which blocks new connections, except if coming from inside.iptables -N blockiptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPTiptables -A block -m state --state NEW -i ! ppp0 -j ACCEPTiptables -A block -j DROP
## Jump to that chain from INPUT and FORWARD chains.iptables -A INPUT -j blockiptables -A FORWARD -j block

It seems to work. I get good results from those on-line port scanning sites.

But I would like some opinions/advice please:

1. Is there a better place to put this other than /etc/rc.local?

(for example, if I added an ethernet card in the future, could the script start

filtering too late, after the card was initialized and accepting traffic.)

2. Do you think this is adequate in a home/desktop/dial-up setting?

(Is there anything inherently wrong with these commands?)

3. I've used Guarddog in the past (on RedHat 9) and really liked it.

But there's no version available for "Dapper Drake". I guess it hasn't been updated in a while.

What other Guarddog-like program could I be using?

I'm trying to figure out iptables - but it seems pretty complicated.

(not that there's anything wrong with that.)

Thanks for any help you can give.

[naraku9333]

I've used Firestarter in the past.

[hitest]

I'm running Lokkit on my Ubuntu 6.06 box. It is very simple to set-up with apt-get:

Lokkit set-up

[shanenin]

I am really surprised guarddog is not available with apt. None the less, you could easily build it using the tar file. Until i got my router, I always used guarddog, it was very simple to use.

Edited July 3, 2006 by shanenin

[hitest]

I am really surprised guarddog is not available with apt. None the less, you could easily build it using the tar file. Until i got my router, I always used guarddog, it was very simple to use.

[Ham Blowfist]

Well, I enabled some repositories in Synaptic (installed by default, but not enabled)

now there's Lokkit, Guarddog, Firestarter, and several other firewall tools available.

Also found out the proper method to install my own iptables script,

and ensure it loads before any network adapters are initialized.

So I have many choices. (too many)

Still, I think they could have included at least one of these tools with Xubuntu.