7 Linux/BSD firewalls reviewed (incl pfSense & m0n0wall)

Wayne Richardson reviewed in total 7 different Linux and BSD firewalls back in Nov 2007 (ClarckConnect, Endian, Gibraltar, IPCop, m0n0wall, pfSense, SmoothWall) and compared them on basis of the following categories: setup, web-gui, extensibility and speed.

Since this is a FreeBSD blog I’ll just quote (with his kind permission) what he wrote about pfSense and m0n0wall. If you’re interested in the whole article and want to see how the BSD firewalls compare to Linux firewall, please refer to Wayne’s article.

pfSense was named the best firewall with a 95% pass rate; m0nowall received a 77% mark and was the smallest of the bunch.
m0n0wall

M0n0wall logoM0n0wall is by far, the smallest of the bunch. The entire thing is contained in a measly 8 MB CD image! monowall is first and foremost, a routing platform. Nothing more, nothing less. The distribution comes in two flavors, either for embedded systems or for regular PCs. Installation the first time around may be difficult for a beginner, since it refers to network cards by their FreeBSD driver name, instead of something a human can easily interpret. Which is easier to understand: “fxp0? or “Intel Pro 10/100+”? Why not provide both peices of information to the user?

VPN is well supported with both IPSec and PPTP options. SSH access can be enabled by a 3rd party add-on. Print serving is unsupported. The configuration page for monowall uses K.I.S.S. (Keep It Simple Stupid) to great effect. It’s brain-dead simple to set things up. However, two things stand out as being somewhat awkward, those being static DHCP and advanced settings. Otherwise, it’s fantastic. Ever had P2P traffic slow down your internet surfing? Check one single box in the GUI, and instantly you have over 20 different protocols that are instantly filtered using QoS to make your internet surfing experience as pleasant as possible.

Add-ons are not easy to incorporate, and require modification of the ISO image, but monowall is not designed to be anything more than a router and firewall. Extra features like a wireless AP feature that can be used with the captive portal function, Wake on LAN interface, and probably the smallest feature I could point out – the uptime is printed on the console when rebooting. Small things like that show an extremely polished software platform that delivers.”

pfSense

pfSense logopfSense is a hybrid of all sorts that has multiple sources for it’s major components. It was originally derived from monowall, but uses OpenBSD’s ported Packet Filter, a package management system to provide an integrated extensibility to the platform and Alternate Queuing (ALTQ) from FreeBSD. This Frankenstein is no slouch when it comes to performance, features and usability.

Installation uses the same monowall device naming system which is clunky, and also does not provide the entire name of the device. Once installed, the console has several options, one of those which is a program called “pfTop”, if you’ve ever needed to be able to view where most of your network bandwidth is being used from a console, now you can very easily.

The web GUI is absolutely fantastic. It’s got initial setup & traffic shaping wizards, a captive portal, load balancer (nice!), OLSR (ad-hoc wireless AP mode), Wake on LAN wizard, different selectable themes for the GUI, OpenVPN, IPSec, and PPTP VPN are all included by default, failover, and packet capturing!

Wizards for traffic shaping and initial setup – not anything new, almost any router you can buy today has them, but when you see them for the first time included in a firewall distribution, it’s great to see changes that make a product easier to use. No other firewall we’ve looked at has three different VPN options.”

Conclusion

“The scoring system gives equal favor to the following categories: Setup, WebGui, Extensibility, and Speed Testing. Each of the distributions passed the speed test with flying colors, with less than 5% margin between highest and lowest scores. It’s difficult to assign arbitrary numbers to reach a score, and I’ve attempted to provide a good metric for which someone can go by to determine which is best for them.

In the end, pfSense is ultimately the best choice overall and provides the best value of all we have looked at today.

Copyright fsckin.com Republished with Permission

2 thoughts on “7 Linux/BSD firewalls reviewed (incl pfSense & m0n0wall)

  1. Eric says:

    Very nice

    and informative, I choose pfSense 3 years ago, and it’s still chugging along so well I don’t even notice it. SmoothWall was a good choice for my buddy in

    terms of aesthetics though.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>