transparent firewall vs. um... not-transparent

I

iroc409

[H]ard|Gawd
Joined
Jun 17, 2006
Messages
1,387
i'm looking to play around a bit with networking, security and all that, and have been considering the merits of the transparent vs. standard router/firewall configuration.

i have a fairly new linksys wireless router (that i don't use the wireless at all), and it seems to work ok. but, being slightly paranoid and desire for new experience, i want to get into custom firewalls.

i've been debating the merits of the transparent firewall vs. say a smoothwall setup. what really are the pros and cons of the transparent firewall? it seems like a great setup... one cannot attack that which one cannot find. it does seem to add to complexity... one also cannot manage what one cannot find.

is there really any improved security in practice? and what about the smoothwall vs. wrt54g? does a smoothwall box add more security to a network, or simply more features (many of which i'd probably never use)?

i don't use wireless now, but it someday may be a feature. what is the most common way of implementing wireless with a smoothwall box?

and, what about providing a third network interface into the transparent box that's looped back into the internal network for ease of maintenance, or perhaps to use the server for additional things (i've had interest in radius, for example)? what kind of security risks does this impose?

part of this is for the sheer joy of learning, something i may use down the road in a career, or whatever. i've done a good bit of googling and even searches on here, and the discussion of transparent firewalls vs standard routers are pretty minimal. the idea would be to run the transparent box in front of the linksys.

thanks, lots of questions i've yet to find the answers on.

:confused:
 
Are you thinking of "transparent proxy?"

IMO, the basic linux routers don't provide any additional protection over a consumer grade router. They're still just basically running NAT. Granted you can get better performance..depending on what you built it on, and some other features above the regular consumer grade routers.

But some of these linux firewall distros have optional transparent proxy packages you can add...such as the add-on for IPCop...called "Copfilter". And Endian comes with it built right in. What these transparent proxies do...is add security features...the router will scan the traffic on the application level. You don't have to change any settings for your software. They add antivirus scanning (HAVP with ClamAV), spam removal (SpamAssasin and others), some Dans Guardian features, a few other things. They scan at web traffic level, they scan at POP3 and SMTP level, FTP level. Providing additional protection for clients, mail servers, etc. These are the features that caught my interest...some of the linux router distro's are becoming UTM devices (Unified Threat Management)...they add some layers of protection. The plain linux routers really don't add anything that my business grade router can't do...but these UTM features that some have.. :cool: those are neat.

With a regular proxy server, you'd often have to reconfigure your software to use it..like to go internet connection settings..use proxy..type in 192.168.1.1:8080 or something like that. Or forced down with some config file through a script. That way the application forces traffic to go through the proxy..and get..proxied. But..you can get past them in many cases..if you know how. Since a proxy server is often a separate server you have running on your LAN..you redirect traffic to go through it..then out the router. With some of these linux routers..it's transparent..it's running on your router....on which the NAT exists. There's no other way out. You have to pass through it.

For wireless...several ways to introduce it. I use my old wrt54gv1..running DD-WRT..running in AP mode. You can also slap a PCI wireless NIC in your linux box...it would be a "blue zone"..and have several options of having that setup..for security.

They're definitely a lot of fun to tinker with..I tried IPCop at first..wicked easy. Then I tried PFSense..just as easy. Then went back to my RV082 router for a while..then I stumbled across Copfilter...the add-on for IPCop. It caught my fancy..I put my IPCop rig back..installed Copfilter on it..was neat. Then I came across Endian...I've been running that since.
 
ok, that all makes sense.

actually, antivirus was one of the first things that caught my attention on a box like this.

how much overhead does it add to the system when you start to add this extra stuff, like AV and other filtering mechanisms? i assume it would be negligible. the spam would be a GREAT feature, lol :)

what about running a device like this transparently? i suppose i would be better off just running the machine as the whole router. i don't have a business-class router, so i might benefit from one of these packages.

have you tried, or are there any benefits to running gigabit nics in a routing box? i've read that a time or two, but have a box full of 3c905-tx's :)

thanks for your help... it's the most discussion i've found so far on the subject.
 
When I first tried IPCop..I installed it on a small form factor Compaq Deskpro ENx..it has a Pentium 3 833 or 866...with 256 megs of RAM. It had an onboard Intel Pro 10/100 NIC, and I stuck in trusty 3COM 905 (out of my box full of them. :D ). It ran fine...as you often hear these linux routers require little horsepower to run.

When I tried the Copfilter add-on..yes I did notice a performance drop..my web surfing lost its "snap". Online games were fine..but web surfing and forum stuff...a little delay.

I then came across a newer version of that line of PC I had used...a Compaq Evo d510...pretty much the same PC..just newer...Pentium 4, had 512 megs of RAM. Same onboard Intel 10/100 and same PCI riser board so I stuck the 3COM in it..transferred my hard drive from the older P3 box...and BAM....she ran great. Much snappier. The web admin was much faster responding also.

IMO gigabit NICs are a waste in these. Honestly most people would probably not lose performance if they used an old ISA 10 meg NIC. You're using these are routers for your broadband..if you have a 6 or 8 meg cable connection...doesn't matter if you use a 10 or a 100 or a 1000 NIC in your router...it's not the bottleneck.

You're wanting to use these as your router...not "in addition" to it. So yes you're going to run this as one and only router.

The antivirus is self updating..just like on your PC. Same with the spam filter I believe...dunno...I didn't use that..do all my mail web based from the office.
 
The gigabit ethernet is for internal file transfers. If you have a file server at home and use it as such, or if your router distro is setup to use samba so it can act as a file server, then the gigabit ethernet will help speeds when you are retreiving or uploading files to your file server on your own internal network.
 
I can see if your Linux distro has Samba built in.....but what if you're just running a pure router linux distro....where you have 2x NICs..a red, and a green...with the green NIC uplinked to your switch. Any traffic to your local server (whatever that may be)..shouldn't leave you switch and even get near the router.
 
I am interested in Spam filtering for IPCOP but can't find anything that really seems to be popular or regularly tested.

Have any links?
 
thanks for the info all, really appreciate it.

so, i have a pair of intel 815 boards with a 600 and 667 chip & 256mb ram.. sounds like it would be fine for a basic router, but might leave some to be desired if i start adding AV and filtering software? damn you modern filtering software!

on the gbE, i realize there's no way a standard broadband connection can currently saturate a 100bT, but i read an article at some point that suggested it. not because you use the bandwidth, but that the hardware was better able to handle a lot of traffic. i guess in the age of software nics, just using a hardware nic is leaps ahead. :)

i'm going to be building a dedicated fileserver during these project(s) as well... but it will be dedicated and completely internal. maybe i can use one of the 600's, but i'd probably rather have something more modern.

i was originally thinking of smoothwall for the router, but i might try some of the others you mentioned. i'm pretty much planning on running freebsd for the file server, unless i go software raid. but, i've used freebsd the most, and am more confident with its reliability/security (maybe i just drank the kool-aid?).
 
iroc409 said:
thanks for the info all, really appreciate it.

so, i have a pair of intel 815 boards with a 600 and 667 chip & 256mb ram.. sounds like it would be fine for a basic router, but might leave some to be desired if i start adding AV and filtering software? damn you modern filtering software!.
Click to expand...

Well..try it. Take the 256 out of out of the boards...stick it in the other for 512. I didn't bother with adding RAM to mine..cuz I came across the faster rig. I know I was using it all...so probably was hitting swapfile which caused it so slow down.

That was with the ad-blocking feature too..you can always turn that off..you can fine tune your services to find your comfort zone.
 
YeOldeStonecat said:
Well..try it. Take the 256 out of out of the boards...stick it in the other for 512. I didn't bother with adding RAM to mine..cuz I came across the faster rig. I know I was using it all...so probably was hitting swapfile which caused it so slow down.

That was with the ad-blocking feature too..you can always turn that off..you can fine tune your services to find your comfort zone.
Click to expand...


thanks, i'll try it. i think all i have is 128's, but i can put 3 in there. maybe i can scrounge up some 256's though. i know when i ran cs 1.6 off a 450, it ran a lot better when i upgraded the ram to 384 (from 196 or something).
 
YeOldeStonecat said:
I can see if your Linux distro has Samba built in.....but what if you're just running a pure router linux distro....where you have 2x NICs..a red, and a green...with the green NIC uplinked to your switch. Any traffic to your local server (whatever that may be)..shouldn't leave you switch and even get near the router.
Click to expand...

Theres is a good thread.

I would probably use a GigaBit switch for the main lan with the uplink connected to Smoothwall.
You can use 10MBit cards in the Smoothwall PC then.
 
iroc409 said:
thanks, i'll try it. i think all i have is 128's, but i can put 3 in there. maybe i can scrounge up some 256's though. i know when i ran cs 1.6 off a 450, it ran a lot better when i upgraded the ram to 384 (from 196 or something).
Click to expand...

3x 128s would probably be good. I don't remember my RAM going much past 300-320 megs...so triple 128s = 384..should be a comfy size.
 
awesome, hopefully i will have time this week to get this project set up.

and just to clarify, i meant a cs _server_... lol.
 
You must log in or register to reply here.
Back
Top