Firewall+VPN Appliance

Joined
Mar 25, 2004
Messages
127
#1
I've been doing a lot of research lately about Firewall+VPN Appliances. My god do these companies make a lot of money off of their customers. You have to buy the hardware, buy the support contract, and last... if you don't like it, you can't return it!

So, the question has been raised. A Firewall+VPN Appliance is nothing but a hardened linux kernel running iptables + some vpn server. It has a minimum of 3 network cards... blah blah blah.

Has anyone here built a solid home brew replacement for the likes of a Watchguard Firebox or Cisco Pix (two compleatly different levels of firewalls)?

If so:

  • what distro did you start with?
  • how did you harden the kernel?
  • are you administering the machine through command line, or is a remote adminsitration tool availible?
  • in the end, was it worth it to build your own?
 

X-Istence

*
Political User
Joined
Dec 5, 2001
Messages
6,498
#2
At school they started with gentoo linux, hardened with SElinux from the NSA. Hell, there are boxen out there with root passwords given out, with SElinux, and they have yet to be hacked.

It is hard to manage though, but they got it done, and have something like a Cisco PIX.

To build their own, they had inhouse linux tech, and an old server, it cost them next to nothing. And it has been up for 8 months now.
 
Joined
Mar 25, 2004
Messages
127
#3
Whats up X? Why aren't you in #osnn? Anyway, the SElinux is a step in the right direction for me. Thanks.

Do you happen to know what vpn server they used, and if all administration was done through CLI? Lastly, do you know of an open-sourced VPN Server that can do MS-CHAP to take advantage of an Active Directory install?

Oh, by the way... the Qmail thing is looking good. Dev box has NetQmail+Vpopmail+Squirellmail. I like the ease of administration on it. Thanks for the tips with that.
 

Reg

eXperienced!
Joined
Mar 2, 2002
Messages
639
#4
I'm not sure about those, but I use Clarkconnect on my network. Been pretty good for me and my needs.
 

X-Istence

*
Political User
Joined
Dec 5, 2001
Messages
6,498
#6
I am not on #osnn cause i gave up on IRC. Has made me more productive, and lets me get important stuff in my life done (Homework, life, social life).

Also, i have no clue, but it is all CLI managed.
 

Members online

No members online now.

Latest profile posts

Perris Calderon wrote on Electronic Punk's profile.
Hey ep!

All good with me, applying for microsoft mvp right now, should have done this a while ago.

Notifications don't work, I only found your response by comming back to hunt up some threads, if you want, give me your email address so we can keep in touch easier, mine is perriscalderon at gmail
Perris Calderon wrote on Electronic Punk's profile.
Ep, glad to see you come back and tidy up...did want to ask a one day favor, I want to enhance my resume , was hoping you could make me administrator for a day, if so, take me right off since I won't be here to do anything, and don't know the slightest about the board, but it would be nice putting "served administrator osnn", if can do, THANKS

Been running around Quora lately, luv it there https://tinyurl.com/ycpxl
Electronic Punk wrote on Perris Calderon's profile.
All good still mate?
Hello, is there anybody in there? Just nod if you can hear me ...

Forum statistics

Threads
62,035
Messages
673,561
Members
89,037
Latest member
Samhicks