Any recommendations for a Linux firewall

jasee · External Since: Jan 13, 2009 Posts: 7

I'm thinking of an independent box with two network cards. The primary
intention is to block skype.
The information to do it seems to be here:

http://www.lynanda.com/products/software-for-corporations/traffic-filtering

Any recommedations. I can't afford a cisco router. With video skype things
really get out of hand!
I'm suprised more people aren't trying to do this, and there isn't now a
relatively cheap router with it in.

--
Vista: the hd dvd player that thinks it's an operating system ©JC 2009
All men are islands

Darren Davison · External Since: Jan 12, 2006 Posts: 26

On 2009-05-09, jasee <jasee.TakeThisOut@btinternet.com> wrote:
> Any recommedations. I can't afford a cisco router. With video skype things
> really get out of hand!
> I'm suprised more people aren't trying to do this, and there isn't now a
> relatively cheap router with it in.

I run IPCop at home on a Dell machine I bought for 20ukp from ebay.
Never had a minute of unplanned downtime.

Also run IPCop at work for a small office with similar success.

Make sure you get at least 192Mb RAM, or a bit more if you want to
enable the snort or squid daemons.

In order to block application protocols that run on well known ports,
you probably want to look at L7-filter (for which IPCop has supprt, but
which I haven't personally tried or tested).
http://mh-lantech.css-hamburg.de/ipcop/download.php?view.177

hth,

--
darren@ public key
davisononline.org 0xE855B3EA

Bambleweeny57 · External Since: May 09, 2009 Posts: 1

jasee wrote:
> I'm thinking of an independent box with two network cards. The primary
> intention is to block skype.
> The information to do it seems to be here:
>
> http://www.lynanda.com/products/software-for-corporations/traffic-filtering
>
> Any recommedations. I can't afford a cisco router. With video skype things
> really get out of hand!
> I'm suprised more people aren't trying to do this, and there isn't now a
> relatively cheap router with it in.
>
>
>

I've used the Smoothwall/IPCop/Endian family over the years and they've
all done the job well.

I've also tried untangle but was put off by the machine resources it needs.

But AFAIK none of the above are able to block Skype directly.

I suspect the reason Skype blocking is not more readily available is
that its very difficult to do successfully. Skype was deliberately
written to make use of multiple different routes out of the network.
This explains, in part, why it has become so popular - ordinary users
could install & use it without worrying about how to configure their
firewall.

From what I have read the tools that are capable of blocking Skype are
based on traffic analysis and basically make an educated guess that
certain traffic is probably Skype and hence block it.

BW

--
Time is an illusion. Lunchtime doubly so.