Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : shorewall vs. apf

[te2586]

I'm currently using shorewall as my firewall of choice. However, I am curious as to whether APF is better or if there are any other firewalls that did more than shorewall does. I've been please with shorewall and its relatively easy configuration and maintenance.

thanks!

[RobTheGolfer]

I am not familiar with shorewall, but APF is excellent. I recemmend you try it out!

[Steven]

shorewall is ok, i recommend APF over it although, alot more features.

[bidhata]

I really like bastile Firewall. In my opinion it is the best more than any other firewall. It is very stable really. Can give a try.

[sander815]

or kiss firewall

[RobTheGolfer]

Kiss and Bastille lack the features that APF offers.

[te2586]

Well, I'm gonna give APF a try and see how it goes. From what I've seen...it seems APF is the way to go So i'll go that way...for now. :p

[visiondream3]

One of the things I noticed in apf is the rigidity in the following lines for denying hosts on a range of ports:

# Syntax:
# proto:flow:[s/d]=port:[s/d]=ip(/mask)
# s - source , d - destination , flow - packet flow in/out

This makes it difficult to specify a range of ports and hence we have to use external rules explicitly on top of apf after it is run. This makes it difficult to get the rules saved unless it is saved to the iptables ruleset. If anybody has suggestions, please let me know.

[visiondream3]

Editing tcp.rules file is an option, but I think deny_hosts.rules should have had it if they mean to automate that.

[xerophyte]

Originally posted by thelinuxguy
shorewall is ok, i recommend APF over it although, alot more features.

Last time i checked shorewall has lots more features then apf, apf lacks many stuff, and which shorewall has organized way

for example
ip forwarding
seperate zones
nice policy arrangement
and more


both interface to iptables, but shorewall really organized iptables frontend firewall, but apf does not even get close.

but apf cover the simple dedicated hosting server needs, but when you come to secure the network shorewall makes your life easy with iptables

[te2586]

I know that APF is highly recommended and I'm still on the fence as to whether to switch to APF from my current install of shorewall.

However, I really want a good BFD solution. I've found one for shorewall, but it seems really incomplete and required some custom scripting on my part (not that I mind).

Does anyone know of a good all around BFD tool set? Or even one that prefers one firewall to another (to give me a reason to switch if it isn't shorewall).

Thanks in advance!

Tommy

[Sheps]

The Developer of APF also makes BFD, which is a brute force detection system.

As you can guess, they are ment to integrate.

[error404]

I prefer Shorewall. The configuration files seem much more organized to me, and by their nature seem to allow more flexibility. But I actually use it as a firewall, not just as protection on a server box. It's also got much nicer, more comprehensive documentation & website.