The 5 minutes introduction to Firewall Builder

If this is the first time you try Firewall Builder, we recommend you start with
Getting started guide on our project web site. The same Guide is also available inside the program, you can launch it using main menu "Help/Tutorials".

Information about new features and changes in this version of the program is available in Release Notes v4.0

Summary

Firewall Builder helps you write and manage configuration for your firewalls. It writes iptables shell script, pf.conf file, Cisco router access lists or PIX configuration for you. You can then copy and paste configuration generated by Firewall Builder, copy the file manually or using your own scripts, or use built-in function to configure the firewall. Firewall Builder provides change control and search functions. It allows you to reuse the same address and service objects in rules of many firewalls. It simplifies coordinated changes of the rules in multi-vendor environments and helps avoid errors in generated configurations.

Firewall Builder can generate complex iptables, PF, Cisco IOS extended access lists, Cisco ASA (PIX) configurations. You do not have to remember all the details of their syntax and internal operation. This saves time and helps avoid errors.

Rules built in the GUI look exactly the same and use the same set of objects that describe your network regardless of the actual firewall platform you use. You only need to learn the program once to be able to build or modify basic configuration for iptables, PF, or Cisco routers or firewalls. Already an expert in one or several firewall platforms? Firewall Builder can help you utilize advanced features too.

Configuration files for the target firewall are auto-generated so they don't have syntax errors and typos. Firewall Builder has information about features and limitations of supported firewall platforms. Avoid detecting errors when you actually enter commands on the firewall, when it is already too late. Fwbuilder helps you avoid many types of errors in the first place, for example it can detect rule shadowing, one of the signs of errors in the policy structure.

Create an object to represent your network, a server or service once and use it many times. Port number or an address changes ? No need to scan all rules of all routers and firewalls to find it. Just change it in the object, recompile and push updated configuration and you are done. At the same time, the GUI provides powerful search functions that help you find all rules of all firewalls that use some object and perform search and replace operations.

If you work for a large distributed organization with many administrators, you can assemble address and service objects that describe your network in a library and save it to a data file, then distribute it for other administrators to use. You can create your own templates for the firewall objects and rules and use them to quickly create new configurations.

Firewall Builder helps perform transitions between different versions of the same firewall (iptables, PF, PIX); from one platform to another; from IPv4 to IPv6.

You work with an abstract policy that operates with objects. We spend time studying differences between iptables and PIX or between different versions of each so that you don't have to.

Firewall Builder makes it easy to add IPv6 rules to the existing firewall policy. Create objects describing your IPv6 network, add them to the same rule set that defines your security policy for IPv4 and configure it as "mixed IPv4+IPv6 rule set". The program will generate two configurations from it, one for IPv4 and another for IPv6, using correct objects for each. There is no need to maintain two policies in parallel for the whole time of transition from IPv4 to IPv6.

You can generate configuration for a range of devices starting from small Linksys, D-Link and other routers running DD-WRT or OpenWRT, to firewalls running Linux, FreeBSD or OpenBSD on a regular or purpose-built PC, to Cisco routers and Cisco ASA (PIX) firewalls.

Firewall Builder has been designed to manage both dedicated remote firewalls and local firewall configurations for servers, workstations and laptops.

Firewall Builder can generate scripts that set up interfaces, IP addresses, SNMP, NTP and logging parameters and other aspects of the general configuration of the firewall machine.

Make coordinated changes in multi-vendor environments: Do you have Cisco routers with extended ACLs, dedicated Cisco ASA (PIX) firewalls, Linux or BSD firewalls and servers and need to make changes in configurations of all these devices to enable new service ? Firewall Builder helps you make coordinated changes in an environment like this.

Have all the advantages of the GUI and object-oriented policy design with your existing firewalls and routers, be it Linux, BSD or Cisco devices. Protect your investment, there is no need to throw them away if you are happy with their performance. You can import existing configuration into Firewall Builder (currently only iptables and Cisco routers configurations).

Built-in policy installer is flexible, uses ssh for secure communication channel to the firewall and has many safeguards to make sure you never cut yourself off the firewall in case of a mistake in the policy. It can deploy to one firewall or to many firewalls and routers in a batch job.

Is this new stuff? Not at all. The project has been registered on SourceForge in 2000 and on Freshmeat in 2001. Since then it went through several major releases. Open Source version is distributed under GPL and is included in major Linux distributions and is part of FreeBSD and OpenBSD ports system. Firewall Builder is dual licensed, packages for Windows and Mac OS X are distributed under traditional EULA for reasonable fee. More...

We have lots of documentation online. Start with Firewall Builder Users Guide (available in pdf and html formats). Users Guide explains the program in details and includes large "CookBook" section that presents typical problems of firewall rules design and demonstrates how they can be solved with Firewall Builder. There is also FAQ, Installation Guide and Release Notes for each version.

We provide support via email, we also have active mailing list and online forum. Follow Firewall Builder blog to get the latest project news.