About IPFire Because IPFire is more t han just a firewall IPFire An Open Source Firewall Distribution IPFire was designed with both modularity and a high-level of flexibility in mind. You can easily deploy many variations of it, such as a firewall, a proxy server or a VPN gateway. The modular design ensures that it runs exactly what you've configured it for and nothing more. Everything is simple to manage and update through the package manager, making maintenance a breeze. The IPFire development team understands that security means different things to different people and certainly can change over time. The fact that IPFire is modular and flexible make it perfect for integrating into any existing security architecture. Don't forget that ease-of-use is a key principle. If all this sounds a little too much for you, IPFire comes with great default settings out-of-the-box, meaning it's a snap to get going quickly! Above are some links that we encourage you to click through. Please take a look at all of the features and possibilities which IPFire offers for your network. Security The primary objective of IPFire is security. As there is of course no one, single way to achieve network security, it is important for a network administrator to understand their environment and what the term security means in the context of their own network. IPFire forms the base of a secure network. It has the power to segment networks based on their respective security levels and makes it easy to create custom policies that manage each segment (see the Firewall page for more information). Security of the modular components is a top priority. Updates are digitally signed and encrypted, as well as can be automatically installed by Pakfire (the IPFire package management system). Since IPFire is typically directly connected to the Internet, it is going to be a primary target for hackers and other threats. The simple Pakfire package manager helps administrators feel confident that they are running the latest security updates and bug fixes for all of the components they utilize. IPFire 2.15 - Core Updat e 77 Since IPFire 2.15 (http://planet.ipfire.org/post/feature- highlights-ipfire-2-15-1-hardening-the-system), the IPFire Linux kernel is patched with the grsecurity (http://grsecurity.net) patchset, which pro-actively hardens the kernel against various forms of attacks. Most importantly, it protects from zero-day exploits by eliminating entire bug classes and exploit vectors. It makes stack buffer overflows almost impossible to exploit and comes with strict access controls, that make it harder for attackers to cause harm to the system. Ñ About IPFire FirewallÑ Security Ñ Firewall IPFireÑ Pakfire employs a Stateful Packet Inspection (SPI) firewall, which is built on top of netfilter (the Linux packet filtering framework). Ñ Updates During the installation of IPFire, the network is configured into different, separate segments. This segmented security scheme means that there is a perfect place for each machine in the Ñ Dialup network. These different segments may be enabled separately, depending on your requirements.Ñ Web Proxy Each segment represents a group of computers who share a common security level: Ñ Cryptography Green Green represents a "safe" area. This is where all regular clients will reside. It is Ñ VPN usually comprised of a wired, local network. Clients on Green can access all other network segments without restriction. Ñ Intrusion Detection Red Red indicates "danger" or the connection to the Internet. Nothing from Red is Ñ Quality permittedof Service to pass through the firewall unless specifically configured by the administrator. Ñ Hardware Blue Blue represents the "wireless" part of the local network (chosen because it's Ñ Virtualizationthe color of the sky). Since the wireless network has the potential for abuse, it is uniquely identified and specific rules govern clients on it. Clients on this Ñ Wirelessnetwork Access segmentPoint must be explicitly allowed before they may access the network. Orange Orange is referred to as the "demilitarized zone" (DMZ). Any servers which are publicly accessible are separated from the rest of the network here to limit security breaches. IPFire 2.15 - Core Updat e 77 With IPFire 2.15, the graphical user interface has been completely rewritten and massively extended with new functionality. It is now possible to manage groups of hosts or services. That makes it simpler to create many similar rules for a great number of hosts, networks or services. Managing firewall rules has never been easier before. Because even with a big number of rules, the configuration remains easily manageable and that makes it possible to build more restrictive configurations without losing control. Additionally, the firewall can be used to control outbound Internet access from any segment. This feature gives the network administrator complete control over how their network is configured and secured. Firewall Documentation (http://wiki.ipfire.org/en/configuration/firewall/start) (http://static.ipfire.org/static/images/screenshots/en/firewall/rules.png?v=e8c6d) (http://static.ipfire.org/static/images/screenshots/en/firewall/new-rule.png?v=8db69) (http://static.ipfire.org/static/images/screenshots/en/firewall/service-groups.png?v=4534e) (http://static.ipfire.org/static/images/screenshots/en/firewall/host-groups.png?v=005e6) (http://static.ipfire.org/static/images/screenshots/en/firewall/connections-1.png?v=6707c) Pakfire The IPFire package management system From a technical point of view, IPFire is a minimalistic, hardened firewall system which comes with an integrated package manager called Pakfire. The primary task of Pakfire is to update the system with only a single click. It is very easy to install security patches, bugfixes and feature enhancements (/features/updates), which make IPFire safer and faster - or simply: better. Another task of Pakfire is to install additional software that adds new functionality to the IPFire system. Some useful of them are: File sharing services such as Samba and vsftpd Communications server using Asterisk Various command-line tools as tcpdump, nmap, traceroute and many more. (http://static.ipfire.org/static/images/screenshots/en/pakfire/pakfire-overview-1.png? v=bed95) (http://static.ipfire.org/static/images/screenshots/en/pakfire/addon-services-1.png? v=14eb2) Pakfire as a build syst em The next major release of IPFire will also ship a new generation of the Pakfire packagement system. This new generation has been made faster, more secure, more easy to handle and adds a whole bunch of new features. One of this features is that pakfire is now the buildsystem as well. Having a customized build system for the needs of IPFire and the IPFire developers improved the development process very much. Building new packages became a lot more easy and less time-consuming. Quality assurance became more social right now. Check it out at pakfire.ipfire.org (http://pakfire.ipfire.org/). Updates IPFire is based on Linux, which is the best Open Source kernel around. Additionally, IPFire is not based on any other distribution like Knoppix is on Debian. It is compiled from the sources of every single package. This comsumes a lot of work, but finally gives the opportunity to not rely on the update cycles of others. The advantages we gain is that we are able to select very stable versions of software and build the distribution from them. For example is the most part of the distribution quite well tested and long maintained - in contrast to the kernel which is very recent and regularly updated with patches to support as much hardware as possible and more importantly fix security errors. This is what makes IPFire a very strong and hardened system. To keep up that strength and be prepared for new hardware (/features/hardware), we give out the so called Core Updates which are issued in about every four weeks and updating collected fixes. If there is a security emergency, we provide updates in less than a day to overcome zero-day holes in the system. All of the updates can be installed by the package management system (/features/pakfire) and users are notified by mail. So in all cases, the update is just a simple click and your system is running safe again. Dialup IPFire as an Internet Gateway is able to dialup through various techniques to connect to the Internet. It supports all popular types of broadband access, as well as mobile access: VDSL VDSL is short for Very High Data Rate Digital Subscriber Line and it currently offers bandwidth up to 50 Mbit/s downstream and 10 Mbit/s upstream. VDSL brings the possibility of using new technologies such as IPTV. With IPFire, a conventional router can be replaced by a full-fledged system that brings the IPTV stream into your own home network. ADSL/ SDSL Conventional DSL is also supported, although it is technically called also PPPoE or PPPoA. In some countries, the PPTP protocol is also widely used and it is also fully supported by IPFire. Ethernet Over Ethernet, IPFire can also be connected to the Internet and obtain an IP address either via DHCP or static configuration. 4G/ 3G Mobile broadband connections over USB modems, which are also known by the names UMTS, 3G, CDMA, HSDPA or LTE are also supported by IPFire. Web proxy IPFire includes a full-fledged web proxy, which is the well-known, open-source software Squid. It is used by ISPs, universities, schools and large companies use because of its diversity, stability and mature development. Even for small home networks, it is a useful feature. In addition to the stateful paket inspection (SPI) filtering by the firewall on the TCP/IP layer, the web content which is transmitted over HTTP, HTTPS or FTP can be analyzed and filtered as well.