Firewalling a small office network

R

rloc

Hi all. I intend to use FreeBsd as a platform for a firewall \ router \ gateway for a small office network but I need some guidance about the basic setup.

At present, all boxes connect to www via an ADSL router.

What I want to do is set up a Snort or IpSense BSD box to act as a Firewall \ IDS between www and my network.

I assume I need to configure the BSD box with 2 NICs, but I don't know how to do this, nor do I understand the setup of passing traffic from one NIC to the other within the BSD box.

Is there a HOWTO for this presumably common requirement, or can someone here point me in the right direction?

thanks

Rloc
 
Have you consulted pfsense.org ?
(see "common deployments" there?)
Will it *replace* the router?
*Some* threads on the freebsd-questions list might
answer, however they would take a while to find.
I've not checked the howto"s section in this forum...
I'm sure there are guides online. But you may want
to post a network diagram for answers here too.
 
rloc said:
can someone here point me in the right direction?
Click to expand...

http://www.openbsd.org/faq/pf/index.html

Bare in mind that FreeBSD implementation of PF is at least 2-3 release cycles behind the official OpenBSD version. Also bare in mind that not all features of the PF are implemented in FreeBSD due to the deficiencies of FreeBSD network stuck.That is also the reason OpenBGPD was never ported (nor it can be ported) to FreeBSD.
 
If your google suggestion was for me, I don't need it.

My response was for Oko who constantly states that line about PF on FreeBSD and the network stack. I won't use OpenBSD because it lacks jails and I don't want to chroot everything.
 
gpatrick said:
OpenBSD doesn't have jails which I want to isolate services.
Click to expand...
It has chroot and systrace. It also supports hardware jails (on SUN hardware) but I guess you already know what to do. I apologize for my original post. I was under impression that you need help with firewall for small office. My intent was not to get into the fan boys flame war.

Sorry,
OKO
 
Thanks all, you have given me several suggestions to read up on so let me do just that before I ask any more questions in this forums.

cheers

Robert
 
Oko, I like OpenBSD but for what I'm currently doing FreeBSD suits my needs because of jails. As mentioned, I don't want to chroot everything and not sure about using systrace. I wish OpenBSD would adopt jails but it would probably require a rewrite. There was a project called sysjail that used systrace but it has since been abandoned.
 
I love PF and FreeBSD jails

2 weeks ago, I run my home servers (apache, sendmail, postgresql in 3 FreeBSD jails)behind my router. I configure port forward for outside to my servers in jails.
I run PF at FreeBSD host in font of FreeBSD jails. Since my servers machine only have 1 NIC, it is hard to configure ftp function well in PF

Now, I install OpenBSD 4.6 in Soekris net5501 embedded board with 4 NIC as PF router. I assign 1 WAN to internet, 1 private LAN, 1 isolated zone for WiFi connection and 1 DMZ for FreeBSD Services Jails.

I can enjoy up-to-dated PF version as well as power of FreeBSD jails
 
You must log in or register to reply here.
Back
Top