Initially, if a site wanted a firewall, they had
little choice but to design and build it themselves (perhaps with
their own staff, or perhaps by hiring a consultant or contractor).
Over the years, however, more and more commercial firewall offerings
have reached the market. These products continue to grow in number
and functionality at an astounding rate, and many sites may find
that one of these products suits their needs. Most sites find that
commercial products are at least a valuable component of their
firewall solution.
In deciding whether or not a particular commercial firewall
product will meet your needs, you have to understand what your needs
are. Even if you decide to buy a firewall, you still need to
understand a fair bit about how they're built and how they work in
order to make an informed purchasing decision. Many sites spend as
much or more effort evaluating commercial firewall products as they
would building their own firewall.
We're not saying that nobody should buy a firewall, or that
everybody should build their own. Our point is merely that it's not
necessarily any easier to buy than it is to build; it all depends on
your particular situation and what resources you have at your
disposal. Sites with money to spend but little staff time or
expertise available often find buying an attractive solution, while
sites with expertise and time but little money often find building
more attractive.
Just what expertise do you need to design and build your own
firewall? Like everything else, it depends; it depends on what
services you want to provide, what platforms you're using, what your
security concerns are, and so on. To install most of the tools
described in this book, you need basic Internet skills to obtain the
tools, and basic system administration skills to configure, compile,
and install them. If you don't know what those skills are, you
probably don't have them; you can obtain them, but that's beyond the
scope of this book.
Some people feel uncomfortable using software that's freely
available on the Internet, particularly for security-critical
applications. We feel that the advantages outweigh the
disadvantages. You may not have the "guarantees" offered by vendors,
but you have the ability to inspect the source code and to share
information with the large community that helps to maintain the
software. In practice, vendors come and go, but the community
endures. The packages we discuss in this book are widely used; many
of the largest sites on the Internet base their firewalls on them.
These packages reflect years of real-life experience with the
Internet and its risks.
Other people feel uncomfortable using commercial software for
security-critical applications, feeling that you can't trust
software unless you can read the code. While there are real
advantages to having code available, auditing code is difficult, and
few people can do an adequate job on a package of any significant
size. Commercial software has its own advantages; when you buy
software you have a legal contract with somebody, which may give you
some recourse if things go wrong.
Frequently, people argue that open source software is more
risky than commercial software because attackers have access to the
source code. In practice, the attackers have access to all the
source code they need, including commercial source code. If it's not
given to them, they steal or reverse-engineer it; they have the
motivation and time, and they don't have ethical constraints.
There's no distinction between programs on this point.
While it's perfectly possible to build a firewall consisting
solely of freely available software or solely of commercial
software, there's no reason to feel that it's all or nothing; freely
available tools provide a valuable complement to purchased
solutions. Buying a firewall shouldn't make you reluctant to
supplement with freely available tools, and building one shouldn't
make you reluctant to supplement with purchased tools. Don't rule
out a product just because it's commercial, or just because it's
freely available. Truly excellent products with great support appear
in both categories, as do poorly thought out products with no
support.