List of Free Firewalls

@Kerodo &AJohn,

CHX runs as a kernel service (flthook.sys). The remote management service (in user mode) should be stopped by default and only plays a role in remote administration via the RMC. The resources consumed by the driver depend on the amount of rules/ stateful options and amount of traffic. The MMC snap-in was chosen to minimize the size of the package and offer a Windows friendly environment for the admins.

The UDP timeout value can be reduced from its initial value of 60 secs to let's say 3 secs (DWord value as explained in the manual). You can then use the CHXStateTables.exe application to poll the driver and observe state details. You may also use this little app to learn about chx TCP stateful implementation/performance etc.


For those who need an optimized driver (the current one is far from offering enhanced performance in heavy traffic environments) drop an email and I'll provide you with a new driver.


Best Regards,

Stefan

 

See.. this guys great

Thnx Stefan

 

Thanks Stefan.. Very nice..

I actually tried reducing the UPD Timeout value to 1 second (!) and everything seemed to work fine, and it cut out most of the late/dup DNS replies from my servers. Only an occasional one got thru. No problems...

 

An alternative would be to allow the ICMP unreachables to your DNS server(s) only.

Regards,

CrazyM

 

Hi Stefan

Thanks for stopping by and welcome to Wilders

Regards,

CrazyM

 

It's what the neighborhood bully sells at the corner for $10. It comes in a plastic bag.

 

"The administrator has specified that you can only edit messages for 7200 minutes after you have posted. This limit has expired, so you must contact the administrator to make alterations on your message."

Tried to add some more free firewalls...

 

Maybe the administrator can change your settings...

 

Thank you CrazyM for updating my list for me, much appreciated.

 

Updated list can be found at:

http://www.fluxgfx.com/ssc/showthread.php?p=492#post492​

I am not able to update this list myself, I will have no restrictions there so list will be up-to-date.

 

A few worth mentioning:

Smoothwall
http://www.smoothwall.org

IPCop
http://www.ipcop.org

Freesco
http://www.freesco.org

These are all dedicated PC firewalls meant as an inexpensive alternative to appliance firwealls (like Cisco)

 

Unless I am mistaken, Smoothwall, Freesco, and IPCop are not for Windows.

 

They have their own OS, they're based on Linux, but you don't need to know Linux at all. The idea is to turn a PC into a dedicated firewall, kind of like an external router, but with far more options.

edit: Ok, I had missed that these were just software firewalls for Windows, at least we gave your thread a bump

 

Here's an interesting one, Home version is free. It's something like WinProxy, it does proxying and SPI. Looks like it would be a good one for family setting. Home version is free.

NetVeta Safety.Net
http://www.download.com/NetVeda-Safety-Net/3000-10435_4-10351053.html?tag=lst-0-1

White paper:
http://www.netveda.com/downloads/PolicyNet_Whitepaper.pdf

 

Does the .Net in Safety.Net imply that I need the .Net stuff installed on my system for it to work? I have a fresh install of Win2k, but did not install the .Net stuff from Windows Update.. Just curious...

 

I doubt it

 

Ok, thanks.. I may try it out sometime and I guess I'll find out when I do..

 

If you guys are looking for just a simple Windows packet level firewall (IP to IP, or IP/port combos), just use the Windows IPSec filters. I just needed to allow/block specific IPs to an internal server network, and these policies work great. It's harder to configure, but when it is done, it works well.

For any of my Linux boxes, I just use iptables, which are my favorite.

 

IPSEC is great.. I've played with it some here and use it as a firewall for when I reinstall Windows while I'm doing the updates, before I install any regular firewall.

The only thing you need to watch out for is, when you allow traffic out to remote port 80 for browsing and so on, then you automatically have to allow it inbound as well, since IPSEC isn't stateful at all. So in doing so, someone could theoretically use a source port of 80 and come in with TCP and scan your ports or access certain ports thereafter and so on. What I did was also block any traffic from remote port 80 to any of my open ports TCP. That way if someone does scan me, all they'll see is closed ports and they can't do any harm.

Another limitation is that you can't specify what ICMP types to allow or block. It's an all or nothing thing. Either you allow all ICMP or block it all.

IPSEC is pretty cool though. It uses zero resources because it's part of Windows. It's nice if you just want a simple packet filter...

Here's a link for anyone interested in playing with it:

http://www.microsoft.com/serviceproviders/columns/using_ipsec.asp

 

Yes, I completely agree with you. IPSec is good for one thing...putting up an absolute block. We use it to protect our core server environment, but on the outside, of course, we use Cisco FWSM/PIX equipment on top of standard Cisco ACLs.

At home, I use a hardware firewall for protection of my home environment, and I use Kerio2.1.5, on any Windows boxes, that are directly on the Net. Although, it seems to have a problem with WinXP SP2, so I just started looking into CHI-X packet filter software. There is a lot of good stuff out there, just need more time to go through it all.

 

I like CHX-I a lot, it's one of my favorites, although if you want app control you'll then have to use something else. But it's really nice... Next to IPSec, it's probably the lightest thing you can get...

 

http://peerguardian.methlabs.org/pg2.html

Is anyone here familiar with Peer Guardian, a IP blocker, how good is it as an addenda to a good firewall.

 

review of the beta (final is available):

http://www.afterdawn.com/guides/archive/peerguardian_2_review.cfm

 

Thanks, so it looks like a good addition to the Sygate Free I am currently running.

 

http://www.software602.com/

Has anyone seen this, free for 5 users, whole suite contains Firewall, antivirus as well as Proxy server, looks like a good deal.