You are here: ZDNet.co.uk > News > Communications

Green IT Toolkit

Linux firewalls from old PCs

Jason Hiner Tech Republic

Published: 02 Jul 2002 13:26 BST

However, before you ship those systems off to technology recycling centers or give them away to employees, you should consider one possible way to reuse them: Turn them into Linux firewalls.

Many of these old PCs can easily run Linux, which requires less system resources than Windows. With a few hardware modifications, they can be turned into solid, reliable firewalls. These firewalls can be used to segment certain departments (such as accounting) from the rest of the network, or they can be used in remote offices and/or for telecommuters. Small businesses may even find that a Linux firewall can serve them well as their primary means of sharing Internet access and staying protected from Internet attackers.

Hardware considerations
Although you can run a Linux firewall on an old 386-SX, I wouldn't recommend it if you're going to use the firewall in any kind of business-critical environment. Instead, I would suggest that you adhere to the hardware recommendations in Table A.

Table A
Processor	Pentium II (or compatible) 200 MHz
RAM	32 MB
Hard disk space	2 GB
Network interface cards	3Com or Intel
Floppy drive	Any type
CD drive	Any type

Linux firewall: Recommended hardware requirements

Many people will argue that you can get away with less than even these miniscule hardware requirements, but I think this is a good starting point to be able to load a recent Linux distribution, build a basic firewall, and have the firewall be able to handle a decent load of network traffic.

Remember that to build a firewall, you'll need two network cards. Since the network cards are probably the most important piece of hardware in a firewall and you need them to function reliably, I strongly recommend that you use 3Com or Intel PCI network cards and not any of the cheap substitutes. If the PC already has a cheap NIC, remove it and replace it with a 3Com or Intel NIC. If the PC has a NIC built into the motherboard, disable it and install a 3Com or Intel NIC. Also, if the PC has an ISA network card (of any brand), do yourself a favor and replace it with a 3Com or Intel PCI network card, because configuring ISA NICs in Linux can be a real pain and can occasionally lead to problems down the road.

When recommissioning a PC as a firewall, you should remove any extraneous hardware from the machine (CDRW drives, SoundBlaster cards, video capture cards, modems, etc.). This can save hardware conflicts and minimize power and processor cycles used by unnecessary devices.

Firewall decision: iptables or ipchains?

Once you have your hardware situation under control and you've installed your preferred Linux distribution (I recommend Red Hat or SuSE), you need to decide which firewall software package to use: iptables or ipchains.

While ipchains is standard in 2.2.x kernels,iptables is built into 2.4.x Linux kernels and represents later, more advanced firewall technology.. In almost all cases, you'll want to use iptables, especially if you are new to Linux firewalls and need to choose which of the two technologies to learn. This link provides a nice look at the advantages of iptables over ipchains. These two articles provide an overview of building a firewall with iptables: