do I need a firewall?

[Old Jimma]

Hi Ubuntu Community:

I hope this is the place to ask stupid questions!

Since it seems that everybody is hacking everybody else these days, I wondered whether I need a firewall.

The purpose of this email is to find out whether I do, and to learn about what I should take into consideration when setting up Firestarter or gufw.



I'm just an old geezer, so I'm asking the community of smart young folks who know the answers. However, I definately want the "old Ubuntu" guns to weigh in, if they want!



Currently, I've got only 2 machines on my home network, both connected to my home's router.

The first is an "Ubuntu Machine" that does many tasks, including sending receiving email thru T-bird, and also as a MythTV frontend and backend. This machine holds the "family jewels," like

• documentation of scraps of communication with the ubuntu forums that I couldn't live without, and
• letters from Aunt Harriet. I'd just die if I lost those.

All of those treasures are backed up every week to 2 other hard drives.

The second machine is a 6 year old iBook (ugh!), that occasionally connects with the "ubuntu machine" to access recorded music, and other stuff.

In 2 months, I will add a third machine to my network. It will be a Mythbuntu HTPC that will serve almost exclusively as a frontend to play TV programs stored on the first "ubuntu machine" described here. My guess is that there will be some sort of "port usage" on the Ubuntu machine when I do that. The third Mythbuntu HTPC will not have a hard drive, just a mobo with processor and memory, mythbuntu loaded on an adequately sized SSD, and a wired connection to our home's router.

I think that there could be some "port usage" from the 2nd and third machine on my "ubuntu machine." For example, the Myth backend on my "Ubuntu machine" has 2 ports that are specified in its MythTV backend configuration.

However, that's just a guess, because when people from my generation think about "ports," they think about

• Barcelona,
• Murmansk,
• the famous port of Savanah, GA; and
• a sweet desert wine that people from my generation drink right after dinner.

So, my questions to the forum are:

1. "Do I need a firewall to protect the family jewels?", and
2. "How should I take into account the various ways my iBook and third computer (Mythbunt frontend) in setting up Firestarter or fugw?"

Sorry about my ignorance. I'm just an old man with not very much hair left.



Thank you!
Old Jimma from the Old Country

[Frogs Hair]

See the security sub forum and read the stickies. http://ubuntuforums.org/forumdisplay.php?f=338

[Sef]

I hope this is the place to ask stupid questions!

The only stupid question is the one that is not asked; therefore, since you asked, your question is not stupid. Questioning is learning, and learning is always smart.

[3rdalbum]

Your router already contains a NAT firewall that will protect the whole network from incoming connections, without making your home network more difficult to manage.

You don't need an additional firewall. It would just make things more difficult without adding any security benefits.

[sudodus]

So, my questions to the forum are:
1. "Do I need a firewall to protect the family jewels?", and
2. "How should I take into account the various ways my iBook and third computer (Mythbunt frontend) in setting up Firestarter or fugw?"

1. Not necessarily (in the computer), because your LAN is behind a router, and it probably has a firewall. Check that there is a firewall in the router, and that it is properly set to deny everything, that is not necessary for you. I guess you need to browse the internet, email and some chat or voip program, but nothing fancy like connecting to your computer from the outside. For more details and security, read this link

https://wiki.ubuntu.com/BasicSecurity

I would add that today you should be aware of 'new' threats via normal browsing, so I recommend that you use the add-on NoScript in Firefox. You should also be careful using java runtime (not only java-script).

2. It depends. Without firewall in the ubuntu computer, no problems ...

[JKyleOKC]

Currently, I've got only 2 machines on my home network, both connected to my home's router.

--snip--

So, my questions to the forum are:

1. "Do I need a firewall to protect the family jewels?", and
2. "How should I take into account the various ways my iBook and third computer (Mythbunt frontend) in setting up Firestarter or fugw?"

Sorry about my ignorance. I'm just an old man with not very much hair left.

Since you're running behind a router, you don't really need any firewall at all on the computer side since the router itself will reject any unsolicited connection attempts unless you take pains to let it do so.

However a firewall to prevent anything from "calling home" is always nice to have; the one time (years ago on Win95) that I got an actual virus infection, the outgoing firewall was what alerted me to the situation. I'd recommend "gufw" for this; it's already installed but not enabled. A single command, one time, to enable it is all you need to do. Avoid FireStarter; it hasn't been maintained for years. None of these need to be started every time you power up; they remember the settings and restore them automagically...

And I'll bet that you're at least 10 years younger than me...

[Paqman]

a sweet desert wine that people from my generation drink right after dinner.

Also quaffed heartily by gunners and armourers of all generations, generally in lieu of food. Which is why you often get pictures of artillery on the bottle.

How should I take into account the various ways my iBook and third computer (Mythbunt frontend) in setting up Firestarter or fugw?"

I agree with the advice above, you don't need a software firewall on your individual machines. However, if you were to use one Firestarter is no longer maintained and I wouldn't use it. If you've been reading advice that suggests Firestarter as a firewall it's probably years out of date and should be treated with suspicion.

[Bucky Ball]

Thread moved to Security Discussions.

[Old Jimma]

JKyleOKC:

If you are not older than rocks, then you are not older than I am.

Old, old Jimma, the Elder

[samiux]

Hi Ubuntu Community:

I hope this is the place to ask stupid questions!

Since it seems that everybody is hacking everybody else these days, I wondered whether I need a firewall.

The purpose of this email is to find out whether I do, and to learn about what I should take into consideration when setting up Firestarter or gufw.



I'm just an old geezer, so I'm asking the community of smart young folks who know the answers. However, I definately want the "old Ubuntu" guns to weigh in, if they want!



Currently, I've got only 2 machines on my home network, both connected to my home's router.

The first is an "Ubuntu Machine" that does many tasks, including sending receiving email thru T-bird, and also as a MythTV frontend and backend. This machine holds the "family jewels," like

• documentation of scraps of communication with the ubuntu forums that I couldn't live without, and
• letters from Aunt Harriet. I'd just die if I lost those.

All of those treasures are backed up every week to 2 other hard drives.

The second machine is a 6 year old iBook (ugh!), that occasionally connects with the "ubuntu machine" to access recorded music, and other stuff.

In 2 months, I will add a third machine to my network. It will be a Mythbuntu HTPC that will serve almost exclusively as a frontend to play TV programs stored on the first "ubuntu machine" described here. My guess is that there will be some sort of "port usage" on the Ubuntu machine when I do that. The third Mythbuntu HTPC will not have a hard drive, just a mobo with processor and memory, mythbuntu loaded on an adequately sized SSD, and a wired connection to our home's router.

I think that there could be some "port usage" from the 2nd and third machine on my "ubuntu machine." For example, the Myth backend on my "Ubuntu machine" has 2 ports that are specified in its MythTV backend configuration.

However, that's just a guess, because when people from my generation think about "ports," they think about

• Barcelona,
• Murmansk,
• the famous port of Savanah, GA; and
• a sweet desert wine that people from my generation drink right after dinner.

So, my questions to the forum are:

1. "Do I need a firewall to protect the family jewels?", and
2. "How should I take into account the various ways my iBook and third computer (Mythbunt frontend) in setting up Firestarter or fugw?"

Sorry about my ignorance. I'm just an old man with not very much hair left.



Thank you!
Old Jimma from the Old Country

To protect your network from attacks, only firewall is not enough. You need an Intrusion Prevention System (IPS) which can block/prevent the attacks (based on rules/signatures) from the real time.

In the old days, IPS is very expensive and the performance is not good. However, nowadays IPS can be setup by yourself free of charge, which is an Open Source software, namely Suricata.

Suricata can be act as gateway (you need 3 network interfaces, 2 are bridged and one for management purpose) which is also known as network-based. It can be also installed to the servers, desktops and laptops which is known as host-based.

I have two articles for setting up Suricata in host-based for servers and desktops.

The performance of the Suricata is quiet good on an Intel Atom D510 ITX machine which is hosting a web server.

Samiux