[Superchi[c]ken]

Besides hardware solutions, what do you guys use? Currently I'm using Norton Firewall. It's pretty good but I was wondering if anyone could say what's better?

[besson3c]

Originally posted by Superchi[c]ken:
Besides hardware solutions, what do you guys use? Currently I'm using Norton Firewall. It's pretty good but I was wondering if anyone could say what's better?

What is good about Norton Firewall? What makes a firewall good? How do you know it's good?

Personally, a lot of Unix systems are based off of iptables, ipfw, ipchains, etc. I wouldn't spend any money on a third-party firewall tool when I can just leverage what already exists.

You could create your firewall rules by hand (there are plenty of places on the web where you can read about firewall rules), or else use something like Brickhouse to simplify the process.

Norton Antivirus sucks pretty badly. I'm not really big on Symantec's Mac offerings these days.

[Earth Mk. II]

ipfw, configured by my own two bloody hands. Or maybe just Brickhouse. Who knows?

But, why would I pay for a firewall, when there's a perfectly good one installed on the system already?

[nobitacu]

I'm using Norton Firewall, and it's working really well for me so far. No problems. I have version 3.0.1

Ming

[Don Pickett]

Use Brickhouse to do the initial set-up for ipfw, then finesse the rules with Terminal.

[justinkim]

Manually configured ipfw. If you're at all technically inclined, why spend money on something to configure functionality that's already there?

[CatOne]

Originally posted by Superchi[c]ken:
Besides hardware solutions, what do you guys use? Currently I'm using Norton Firewall. It's pretty good but I was wondering if anyone could say what's better?

The hell with that. I use a Linksys router, with a built in firewall.

Nothin's touching me unless I enable port forwarding.

[ph0ust]

Originally posted by CatOne:
The hell with that. I use a Linksys router, with a built in firewall.

Nothin's touching me unless I enable port forwarding.

that is really NOT true... there are lots of zero day vulns in cheap soho product like linksys, dlink, etc. they do a decent job of keeping people out (especially if they don't know what they are doing), but you should still run a real firewall (i.e. stateful) on each machine behind your gateway. besides, those devices are not actually firewalls.

[CatOne]

Originally posted by ph0ust:
that is really NOT true... there are lots of zero day vulns in cheap soho product like linksys, dlink, etc. they do a decent job of keeping people out (especially if they don't know what they are doing), but you should still run a real firewall (i.e. stateful) on each machine behind your gateway. besides, those devices are not actually firewalls.

First, it does a pretty damn good job for me (the Linksys). And, how is a request from the internet going to get to my (non routable) address behind it? I go to grc.com and every port is listed as "stealth."

Plus you know with OS X, every port is closed by default. That's the way it ships -- Apple ensures this. So why run a stateful packet filtering firewall to monitor all ports when they're all already closed? It's overkill, and I don't want the overhead. Plus the router gives me DCHP and auto-maintains my PPPoE DSL connection so I don't need to force the OS to auto log-in every time, and I can use multiple machines from the same DSL connection, and the router takes care of it all for me (I don't have to set up some software connection sharing crap).

[GENERAL_SMILEY]

Defeat NAT = specify packet route

[CatOne]

Originally posted by GENERAL_SMILEY:
Defeat NAT = specify packet route

The chances of that are so slim it's ridiculous, compared to finding an open port in your software firewall on the box that's direct connected.