A regular 1080p movie on HTTPS from Netflix will take about 6GB, that’s a lot of bandwidth which a malware can use for anything. Again, we work on layer 3/4 here, where we don’t have any idea which application is emitting certain traffic, we only see IP addresses and port numbers.Īnd a malware can also use any port for any thing, even HTTP and HTTPS. This is impossible as a firewall do not have that information. Think about connections happening at night or outside business hours - those will go unnoticed unless they were blocked by a generic firewall rule configured before.Īnd allow creating rules based on application as well. Nobody will have a look at that table unless it is too late.

I think a good firewall distro will allow a user to block and allow incoming and outgoing connections as when they are happening at the connections view. A “firewall” is actually a packet filter in most cases, which means it works on OSI layers 3 and 4, so if your malware is encapsulated at layer 7, it won’t detect it by design. Malware protection is a broad and complex topic indeed, and there is no technical solution providing total security. Well, if this is your opinion, you are free to stop using IPFire (or any other firewall distribution) altogether. So why should anyone use a firewall distro? Almost all the latest operating systems block uninitiated incoming connections by default and the same function is performed by routers, firewall distros just seem to be adding overhead over these. For less sophisticated users, this would probably a step too far in first place.įirewall distros give an illusion of mitigating this risk by IPS and IDS but they are based on community rules, which may themselves be compromised and more importantly are not broad enough to cover all the possible malware behaviour. You are absolutely free to configure IPFire not to allow any connections at all, except for those you have explicitly allowed.

However, there might be scenarios where you need to allow outgoing traffic at first (think about users trying to read the documentation without having internet access after they installed IPFire), and besides of that, we cannot release users from the burden of thinking themselves. Personally, I am not happy with that default setting, either. This is a major security risk which makes firewall distros a scam. As it is, at default settings, a firewall will allow outbound connection from the LAN and allow incoming traffic on that connection. To me, all the firewall distros are selling a scam by providing a false sense of security.

Firewall definition