FREEBSD PF

Packet filtering is the selective passing or blocking of data packets as they pass through a network interface. The criteria that pf(4) uses when inspecting packets are based on the Layer 3 (IPv4 and IPv6) and Layer 4 (TCP, UDP, ICMP, and ICMPv6) headers. The most often used criteria are source and destination address, source and destination port, and protocol.

Filter rules specify the criteria that a packet must match and the resulting action, either block or pass, that is taken when a match is found. Filter rules are evaluated in sequential order, first to last. Unless the packet matches a rule containing the quick keyword, the packet will be evaluated against all filter rules before the final action is taken. The last rule to match is the "winner" and will dictate what action to take on the packet. There is an implicit pass all at the beginning of a filtering ruleset meaning that if a packet does not match any filter rule the resulting action will be pass.

Features:

PF has since evolved quickly and now has several advantages over other available firewalls. The filtering syntax is similar to IPFilter, with some modifications to make it clearer. Network Address Translation (NAT) and Quality of Service (QoS) have been integrated into PF, QoS by importing the ALTQ queuing software and linking it with PF's configuration. Features such as pfsync and CARP for failover and redundancy, authpf for session authentication, and ftp-proxy to ease firewalling the difficult FTP protocol, have also extended PF.

One innovative feature is PF's logging. Logging is configurable per rule within the pf.conf and logs are provided from PF by a pseudo-network interface called pflog. Logs may be monitored using standard utilities such as tcpdump, which in OpenBSD has been extended especially for the purpose, or saved to disk in a modified tcpdump/pcap binary format using the pflogd daemon.

MICROSOFT ISA SERVER

Microsoft's ISA Server contains a full featured, application-layer aware firewall that can protect your business network from attack by external and internal threats. ISA Server performs deep inspection of Internet protocols such as Hypertext Transfer Protocol (HTTP), which enables it to detect many threats that can elude traditional firewalls. The integrated firewall and VPN architecture of ISA Server support stateful filtering and inspection of all VPN traffic. ISA Servers are the centerpiece of Microsoft's network security strategy, and Techweavr Microsoft Certified Systems Engineers and security consultants can help you bolster your network security through expert deployment of ISA Servers.

Features

Secure remote access to internal Microsoft servers Outlook Web Access Publishing Wizard
SharePoint Server Publishing Wizard
Integrated support for Exchange 2007


Virtual private networking
Branch Office VPN Connectivity Wizard
Management Easy-to-use wizards
Certificate Management
Hardware-based ISA Server appliances
Propagation of enterprise-wide policy


Advanced firewall protection
Firewall Rule wizards
Flood Resiliency
Enhanced remediation during attack


Authentication Authentication
Single sign on
Forms-based authentication
Session management Support for LDAP authentication


Server publishing Link translation
Cross-Array Link Translation


Performance BITS caching
Web Publishing Load Balancing
HTTP compression
Diffserv (Quality of Service)

MONOWALL

m0n0wall is a project aimed at creating a complete, embedded firewall software package that, when used together with an embedded PC, provides all the important features of commercial firewall boxes (including ease of use) at a fraction of the price (free software). m0n0wall is based on a bare-bones version of FreeBSD, along with a web server, PHP and a few other utilities. The entire system configuration is stored in one single XML text file to keep things transparent.

m0n0wall is probably the first UNIX system that has its boot-time configuration done with PHP, rather than the usual shell scripts, and that has the entire system configuration stored in XML format.
Features

Web interface (supports SSL)
Serial console interface for recovery
Wireless support (access point with PRISM-II/2.5/3 cards, BSS/IBSS with other cards including Cisco)
Captive portal
802.1Q VLAN support
Stateful packet filtering
NAT/PAT (including 1:1)
DHCP client, PPPoE, PPTP and Telstra BigPond Cable support on the WAN interface
IPsec VPN tunnels (IKE; with support for hardware crypto cards, mobile clients and certificates)
PPTP VPN (with RADIUS server support)
Static routes
DHCP server and relay
Caching DNS forwarder
DynDNS client and RFC 2136 DNS updater
SNMP agent
Traffic shaper
SVG-based traffic grapher
Firmware upgrade through the web browser
Wake on LAN client
Configuration backup/restore
Host/network aliases