Firewalls

[blaggard]

Pardon my ignorance and naivete, I recently found out that whenever I accessed sites
like yahoo, it also originated outgoing connections to sites like s0b.bluestreak.com.
I suspect (paranoia) some "data" is being sent to these sites from my PC.

I realize now that just having Firefox is not enough. You also need a firewall to
prevent these types of unsolicited connections.

So I played with firestarter. It seems to block sites that I tell it to but not always.
If I define a outgoing policy to allow only the whitelisted sites, it doesn't work.
The blacklisted sites seem to work but again - not always.

I also installed shorewall and fwbuilder. The latter seems to be a bit too complex
for me to setup. Couldn't find shorewall anywhere on my system - even though
synaptics package manager shows it installed.

I am looking for a firewall where I can import a list of blocked sites (a la hosts
file on 'doze).

Any suggestions or comments?

By the way, I am using BLAG29K, kernel 2.6.10-1.760_FC.

Thanks in advance.

Blaggard

[jebba]

Hmm, perhaps the best way is to write the firewall rules directly.

It can be harder to use GUI tools (I find) than just write what you want.

You can either write a simple shell script or play with /etc/sysconfig/iptables-config

Search for iptables--there is lots of docs on the 'net. You'll learn way more about how things are actually done too. :)

If you want, you can post your iptables config and i can peruse it too.

-Jeff

[blaggard]

Jeff/Jebba,

Thanks for your reply.

I did search the internet for linux firewalls that (starting to feel real stupid here)
left me even more confused :oops:

I am connected to the internet via a router and a cable modem. The external
intrusion is hopefuly taken care by the router.

However I am concerned about the internal extrusion (phrase borrowed
from www.grc.com). I think my predicament (I am assuming there is one) is that I
want to be able to control which external websites my machine can access and
which websites can talk to my machine from outside. (As I mentioned I do see
a brief connection getting setup to some sites that I didn't initiate whenever
I access sites like yahoo or my broker)

Firestarter seems to be the closest thing that seems to work - although it
also seems to be a bit fickle minded.

More posting to follow.

Thanks.

Blaggard