Building a firewall from scratch

[kaidranzer]

Hi guys! I am trying to build an opensource firewall from scratch in linux environment using C and would like to have some help. Even though its called a firewall, its more of a Unified Threat Management containing features like antispam, content filtering, vulnerability analyzing,etc.

I need some suggestions about which features to include because I only have 1 year to complete this project.

I have started my preparations by learning UNIX Socket API and I have a pretty good knowledge of C. Can you please suggest me how should I start my work on this project?

[0strodamus]

I think an application based firewall is something that is sorely lacking in the Linux world.

I know the usually response from the Linux community is that an application firewall and antivirus aren't needed, but it is the lack of those two things that keep me in the Windows camp. I know that I could get an AV going using Dazuko, but it is a PITA. Anyway, sorry to digress. I think you should make an application filtering firewall.

[kaidranzer]

What I am planning to do is breaking a packet into headers and data. Header analysis will be the "packet-filtering firewall" kind of thing and analyzing the data would be an "application-layer firewall" kind of thing.

Actually I have broken the process of development in 4 stages namely :

1. Capture the packet (using libcap)
2. Break the packet into headers and data (using libpcap)
3. Analyze the headers and data and make a decision
4. ACCEPT or DROP the packet (using netfilter in linux)

Its the third step that will depend on the features which are included in the project. I plan to code using the UNIX Socket API.

I need to know whether I am on the right track

[1000db]

YOu might get a better response posting this to the All Things Unix section; just a thought.

[JRViejo]

Moved Thread to this Forum for More Exposure!

[J_L]

Is it an application for Linux machines, or a gateway? What are all the features you've already planned?

[mack_guy911]

inspiration form ipcop smoothwall endian or pfsense and make them

install local type with interface then it would be great

http://www.wilderssecurity.com/showt...hlight=clearos

http://www.wilderssecurity.com/showt...hlight=clearos


these are old threads of utm but hope give you help

http://doc.pfsense.org/index.php/2.0...es_and_Changes

[kaidranzer]

No it is not an application for linux machines. It will be a gateway between a network/LAN and the Internet.

Here are some of the features that look good enough :

http://www.endian.com/en/products/fe...-feature-list/

But I still cant decide which of these to choose because one year looks like a very short time to implement all of these.

[mack_guy911]

endian is fork for ipcop which is again fork of smoothwall

i guss you should look these

http://www.smoothwall.org/

http://pfsense.org/

http://m0n0.ch/wall/quickstart.php

are good to check the features to start on with

[J_L]

If you want other products to look at, I have plenty on my list.

[kaidranzer]

Yes please. I would like to have a look.

[kaidranzer]

Hi guys! I am attempting to build an open source firewall in linux and I need to know how to filter packets WITHOUT using iptables. Once a packet is inspected, a decision is made whether it should be dropped or not. Now to drop the packet I need to stop it from entering the kernel in the first place otherwise it would be forwarded automatically.

How do i do that? Is it possible using netfilter?

Reply will be highly appreciated.

Thanx in advance

[kaidranzer]

Hi guys! I have decided build an open source firewall in linux environment. I have exactly one year to complete this project. The firewall will be a stateful packet filtering firewall working at network, transport and application layers. I would also be provided log analysis features. What I want to know is whether this is a good enough project or put in other words, is it a worthwhile project to undertake?

Thanx in advance

[LowWaterMark]

Merged three separate threads together. There is no need to start a new thread every few days about this. Just use this existing thread if you have something else to add or ask.

[Spooony]

How about the AirGap Firewall. I.E pull the plug

Note: AirGap Firewall is a registered trademark of Paranoid Inc.

[Alphalutra1]

Remember, iptables is a front-end for netfilter. So you'd just have to implement a different front-end for netfilter. I know of one alternative already, nftables. So look into iptables and nftables source code to see how others have solved your project. Then, design your own.