FireHOL, Tools to audit your security and test your firewall.
Author: Costa Tsaousis
Description: Home for FireHOL, an iptables stateful packet filtering firewall builder for Linux (kernel 2.4), supporting NAT, SNAT, DNAT, REDIRECT, MASQUERADE, DMZ, dual-homed, multi-homed and router setups, protecting and securing hosts and LANs in all kinds of topologies. Configuration is done using simple client and server statements while it can detect (and produce) its configuration automatically. FireHOL is extremely easy to understand, configure and audit.
Keywords: iptables, netfilter, filter, firewall, stateful, port, secure, security, NAT, DMZ, DNAT, DSL, SNAT, redirect, router, rule, rules, automated, bash, block, builder, cable, complex, configuration, dual-homed, easy, easy configuration, example, fast, features, flexible, forward, free, gpl, helpme mode, human, intuitive, language, linux, masquerade, modem, multi-homed, open source, packet, panic mode, protect, script, service, system administration, wizard

To test your firewall there are a few software tools and a few online services to help you.

I suggest the following tools (of course you need two computers to run the test):

- Nessus is probably the best open source security scanner available.
  Nessus not only checks the firewall of a host, but also scans for known application vulnerabilities.
  I highly recommend Nessus for periodic (weekly, monthly, etc) scans.
  For RedHat systems you can find pre-build RPMs at FreshRPMs.
- Nmap ("Network Mapper") is an open source utility for network exploration or security auditing.
  RedHat (and possibly other) systems have Nmap pre-installed.

There are a number of sites that offer firewall testing services to everyone:

- AuditMyPC
- BroadBand Reports port scanner.
- Security Space, a commercial service with a free scan.
  These people are using something like Nessus (if not Nessus itself).
- Shields UP!! NanoProbe Technology Internet Security Testing for... Windows Users. (note: well, it says for Windows, but it is a port scanner with a limited range of ports to be scanned...)
- SyGate Online Services (S.O.S.) Very nice site to quickly check the security of your system. They have a stealth scanner that tries to break the firewall with a few nice ways (this can show you the difference between FireHOL and a hand made stateless firewall).

Other testers on the net:

- Smurf Amplifier Registry (SAR) The SAR is a tool for Internet administrators being attacked by or implicated in smurf attacks, or those who wish to take precautions.

Other useful links:

- Top 50 Security Tools for UNIX

| $Id: fwtest.html,v 1.10 2004/10/31 23:43:25 ktsaou Exp $ FireHOL, a firewall for humans... © Copyright 2004 Costa Tsaousis <costa@tsaousis.gr>