Re: ipf, Sunscreen or ?

On Tue, Oct 21, 2003 at 04:49:51PM -0700, Chris Pelton wrote:

   I would really like to get a software firewall running on some of
   my sun boxes but was burned awhile back by ipf (could have been a
   misconfiguration on my part but I never got the chance to
   research). I don't need to do anything fancy, just block certain
   ports by subnet and leave others open. I started reading the
   documentation on Sunscreen from sun docs and wasn't horribly
   excited about it - I most definitely wouldn't run apache just to
   get a GUI.
   
   Any thoughts? experiences?
   
I'm using Sunscreen in a stealth/bridged configuration on a Gigabit
link.  Although it is a gateway firewall, we do provide LAN services
to other buildings on campus, so I needed a stateful firewall that
could process DNS, RPC, NFS, portmapper traffic outside of just simple
TCP connections.  Sunscreen is free (great for those of us in EDU with
little or no security budget) and provides these features; however, we
have a couple of problems:

- Minor problem with portmapper/NFS traffic being illegitimately
  blocked.  We are working with Sun to resolve this within the
  appropriate state engines and in the meantime have a work-around.
  (Guess I can't complain give it is free)

- The firewall locks up (100% CPU utilization on a dual 900 MHz
  system) processing high rates of protocols that have no flow control
  (UDP/ICMP attacks) Throttling them using a router or layer-3 switch
  on each side should solve this.  Take a way Gigabit and the
  number of things we have to allow on the user LAN factors and I
  don't think this would exist.

Default installs of the Sunscreen packages didn't setup skip properly,
so communication between my admin system and firewall were broken.
After digging through documentation, command line installs on both
systems of selected packages fixed it.  As for the GUI/web interface,
don't bother... it is painfully slow and useless in my book, but I've
always been a CLI person anyway.  Using ssadm remotely does the trick,
allowing common tasks to be scripted.  Other benefits include:

- Ability to manage multiple firewalls using the same objects

- Using objects to define and group addresses and services for
  clarity/ease-of-management.  We have numerous non-continuous IP
  ranges, and servers that provide a "class" of services that can be
  allowed using one rule.

- Ability to copy, backup, and revert policies easily

Hope this helps.  Also, feel free to email me off-list if you are
interested in further install and ruleset info.

dpk