Installation Help
Please select 'No firewall' unless you know what you are doing.
A firewall sits between your computer and the network, and determines which resources on your computer remote users on the network are able to access. A properly configured firewall can greatly increase the out-of-the-box security of your system.
Choose the appropriate security level for your system.
No Firewall
No
firewall provides complete access to your system and does no
security checking. Security checking is the disabling of access to
certain services. This should only be selected if you are running on a
trusted network (not the Internet) or plan to do more firewall
configuration later.
Enable firewall
If you choose
Enable firewall, connections are not accepted by
your system (other than the default settings) that are not explicitly
defined by you. By default, only connections in response to outbound
requests, such as DNS replies or DHCP requests, are allowed. If access
to services running on this machine is needed, you can choose to allow
specific services through the firewall.
If you are connecting your system to the Internet, but do not plan to run a server, this is the safest choice.
Next, select which services, if any, should be allowed to pass through the firewall.
Enabling these options allow the specified services to pass through the firewall. Note, these services may not be installed on the system by default. Make sure you choose to enable any options that you may need.
WWW (HTTP)
The HTTP protocol is used
by Apache (and by other Web servers) to serve webpages. If you plan on
making your Web server publicly available, enable this option. This
option is not required for viewing pages locally or for developing
webpages. You must install the httpd package if you
want to serve webpages.
Enabling WWW (HTTP) does not open a port for HTTPS. To enable HTTPS, specify it in the Other ports field.
FTP
The FTP protocol is used to
transfer files between machines on a network. If you plan on making your
FTP server publicly available, enable this option. You must install the
vsftpd package for this option to be useful.
SSH
Secure
SHell (SSH) is a suite of tools for logging into
and executing commands on a remote machine. If you plan to use SSH tools
to access your machine through a firewall, enable this option. You need
to have the openssh-server package installed in
order to access your machine remotely, using SSH tools.
Telnet
Telnet is a protocol for logging
into remote machines. Telnet communications are unencrypted and
provide no security from network snooping. Allowing incoming Telnet
access is not recommended. If you do want to allow inbound Telnet
access, you must install the telnet-server
package.
Mail (SMTP)
If you want to allow
incoming mail delivery through your firewall, so that remote hosts can
connect directly to your machine to deliver mail, enable this option. You
do not need to enable this if you collect your mail from your ISP's server
using POP3 or IMAP, or if you use a tool such as
fetchmail. Note that an improperly configured SMTP
server can allow remote machines to use your server to send spam.
You can allow access to ports which are not listed here, by listing them in the Other ports field. Use the following format: port:protocol. For example, if you want to allow IMAP access through your firewall, you can specify imap:tcp. You can also explicitly specify numeric ports; to allow UDP packets on port 1234 through the firewall, enter 1234:udp. To specify multiple ports, separate them with commas.
Finally, select any devices should allow access to your system for all traffic from that device.
Selecting any of these trusted devices excludes them from the firewall rules. For example, if you are running a local network, but are connected to the Internet via a PPP dialup, you can check eth0 and any traffic coming from your local network is allowed. Selecting eth0 as trusted means all traffic over the Ethernet is allowed, but the ppp0 interface is still firewalled. If you want to restrict traffic on an interface, leave it unchecked.
It is not recommended that you make any device that is connected to public networks, such as the Internet, a trusted device.