Any alternative firewall solutions for debian that aren't based on netfilter / iptables?

Question

I have a virtual server running Debian. It's host OS is using Linux Vserver and due to its lack of support for network namespaces, using iptables to secure the box is not an option. I did many searches looking for alternatives but so far I'm only finding different front ends to manage iptables itself.

Is there anything else out there? I was hoping to tie it in into my OSSEC active response scripts to enable real time blocking when malicious activity is detected.

score 7 · Answer 1 · answered May 18 '11 at 21:38

7

As far as I know, iptables is the linux firewall. Never in all my years working with linux have I ever heard nor seen of any alternatives.

Do you have the option of just running the firewall layer on the host OS?

answered May 18 '11 at 21:38

EEAA

108,414
18
172
242

5

iptables is not a firewall. It's a user-space tool to manipulate the firewall, netfilter. – petrus May 18 '11 at 22:16
4

@petrus - True, but probably not worth the pedantry. – EEAA May 18 '11 at 22:18
@petrus - also, feel free to edit my answer (or any others) to correct/clarify. – EEAA May 18 '11 at 22:18
And thank god for it -- beat the heck out of ipchains. – nedm May 18 '11 at 22:29
No unfortunately I do not have access to the host OS, and since this is on a shared server I doubt they would be willing to yield to my needs. – BajaBob May 18 '11 at 23:47

score 1 · Answer 2 · answered May 18 '11 at 22:44

There's always Debian GNU/kFreeBSD which ports the FreeBSD kernel the Debian/GNU userland. This would allow you to use pf as your firewall. Unfortunately, as of current (Debian 6/Squeeze) GNU/kFreeBSD is considered a "techninical preview", which means not ready for production.

score 0 · Answer 3 · answered May 18 '11 at 22:01

0

The Linux kernel has only one built-in firewall, iptables.

There are side projects like dummynet, a Linux port of the BSD firewall, but these are for testing purposes and not to be used in production.

Dummynet: http://info.iet.unipi.it/~luigi/dummynet/

answered May 18 '11 at 22:01

Lars Wiegman

211
1
5

dummynet is not firewall, it is a simple traffic shaper. – AlexD May 19 '11 at 17:28

score 0 · Answer 4 · answered May 18 '11 at 22:17

0

ip filter claims to support Linux. (I have only used it on Solaris.) http://coombs.anu.edu.au/~avalon/

answered May 18 '11 at 22:17

Mark Wagner

17,764
2
30
47

score 0 · Answer 5 · answered Dec 13 '18 at 07:18

0

Checkout the nftables. It is gaining momentum and AFAIK it is going to replace iptables.

answered Dec 13 '18 at 07:18

Adam Ryczkowski

690
1
9
29

The "nf" in "nftables" stands for "netfilter". Thus it is fairly likely based on netfilter. – womble Dec 14 '18 at 03:32

score -3 · Answer 6 · answered Feb 11 '14 at 21:27

-3

What about Bastille Linux? It can be used as firewall.

http://www.bastille-linux.org/

answered Feb 11 '14 at 21:27

Infragile

153
1
6

1

What makes you think that that is not netfilter-based? – MadHatter Feb 12 '14 at 09:05

Any alternative firewall solutions for debian that aren't based on netfilter / iptables?

6 Answers6