10 ms·
FireHOL – Linux firewalling and traffic shaping for humans
- orastor 8y agoRead this as a firewall for humans. Am disappointed
- zupa-hu 8y agoYeah I expected some kind of a big plastic bag to wear :)
- krackers 8y agoI hear they have one of those in China.
- basementcat 8y agoThere has been some discussion about building one for the USA.
- chewz 8y agoThey have had something similar in Berlin till 1989.
- tapland 8y agoBeing on chemo I was THRILLED
- unethical_ban 8y agoI'm mobile, but has this been updated? I used this in college back in 08 and it was much better than iptables but I don't know if it's kept up with the times.
- idle_zealot 8y agoThere was a release this August, but there seems to be a huge gap between 2014 and then.
- veeti 8y agoDon't fix what ain't broke.
- qwerty456127 8y agoCool! Add application-level rules (like LittleSnitch) and I'm buying (literally, I don't mind paying for such a feature).
- dsl 8y agoYou might want to look at OpenSnitch [1]. It requires nfqueue and directly accessing /proc to get info in real time, which is why you'll likely never see it as part of a structured firewall builder like this. https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch
- bepvte 8y agoive used fireQOS and it was a lovely tool i highly recommend it.
- 64738 8y agoNice to see it posted here, I've been a happy user of FireHOL for a decade, if not more. For a while I was worried it was going to be abandoned, I'm really glad it wasn't. I'm not a network guy but I was tasked with setting up some servers at a co-lo, including a box to act as the router. FireHOL was a godsend for helping me to setup the rules. I haven't tried FireQOS yet, but I really want to play with it.
- Bucephalus355 8y agoWe have a couple of servers we can’t move to the cloud for a variety of reasons. In addition, they are running some super legacy applications. Because of this, we’ve really had to focus on OS level security to protect the application (OS is surprisingly Ubuntu 16). Good Linux Security Software: - ModSecurity V3...tough to figure out but so worth it. An incredible L7 Firewall. Immediately provides benefits - UFW...utterly saves you from IPTABLES. Also has some neat brute force protection (ufw limit ssh). - ModEvasive...Apache Module which is great for preventing automated vuln scanners like Burp Suite - ClamAV...antivirus, who knows how effective but is popular - RKHunter...rootkit hunter, hard to tune but can be worth it Biggest benefit we got though was from setting all HTTPS Headers on the web server (there are 7 of them now I think you can set). The latest headers like “Feature-Policy” which can disable Javascript’s access to webcam, microphone, and more have been very useful.
- h1d 8y agoI wonder though, is root kit even detectable? Perhaps most are.
- ratiolat 8y agoWhich headers are you talking about?
- tombrossman 8y agoNot OP but I have to assume they are referring to Content Security Policy headers: https://content-security-policy.com/ https://content-security-policy.com/
- Karunamon 8y agoI find that UFW is more of a pain than its worth when it comes to simple rules everybody needs like "block everything, allow this handful of ports", mostly because the syntax is too english-like and so it's easier to get confused how you're supposed to write the rule. It also spews a bunch of chains all over iptables, making it harder to understand when you actually need to use it directly for something more advanced like mangling.
- iammeow 8y agoI use their iplists in pfblocker-ng since 3 years. It's incredibly useful, like "let's block all traffic from tor exit nodes appeared online in the last 30 days".
- joelthelion 8y agoFirehole? Weird name...