GUI Based cPanel Firewall

[temi]

Hello all,
I am sort of new to server admin, I have just inherited a cPanel powered server, the first thing I want to do is secure the server, does any one know the best (but cheap) firewall I can use to secure the server?

I am not very comfortable with IP chains etc I just want a firewall I can install and configure preferably from a GUI based tool.

Thanks
Temi

[sawbuck]

You might want to check APF as it is very commonly used on cPanel boxes.
http://www.rfxnetworks.com/apf.php

[SarcNBit]

I am not very comfortable with IP chains etc I just want a firewall I can install and configure preferably from a GUI based tool.

You should have a basic understanding of the way your firewall works before configuring it. If you have that understanding, then you are pretty much half the way there with iptables (if you are running ipchains, it is time to upgrade your kernel ).

How come APF comes up everytime someone asks about a GUI based firewall? Yes it is a good tool and I would recommend it, but no it does not meet the criteria.

APF or pretty much any tool you run is simply going to handle the grunt work of configuring the netfilter firewall you are most likely already running. Most of the GUI iptables frontends are designed to work under X. Since you should not (could not?) run X on a cPanel server this limits your options. You may want to look into a webmin based iptable interface. I have never tried running it on a cPanel server (I would use APF), so you may want to try it in a test environment and/or wait for additional comments.

[sawbuck]

How come APF comes up everytime someone asks about a GUI based firewall?

Because it does meet the criteria of price and webmin is not the most secure product around.

[SarcNBit]

webmin is not the most secure product around.

I do not know of any software that would dare stake claim to that title.

I do not know if you have something particular in mind when saying that, but a quick securityfocus check does not show anything (even historically) that would make me say it is insecure (beyond what I would say about any software). All listed exploits seem to have been patched rather quickly and there was not an obscene number of exploits listed.

The only reason I mentioned APF not fitting the criteria (besides that fact that it doesn't ) is because it keeps popping up as the defacto answer to every question with the word firewall in it. There was a question a few weeks ago about a WHM integrated firewall product and someone said 'APF' and now this question about a GUI based firewall (read the title ) and 'APF' came up again. What is the answer for *BSD? What is the answer to support for APF is pretty thin can you recommend a similar product with better support?

Here let me try to offer answers I would not be surprised to see:

Convert to CentOS and run APF/BFD!
Who needs support for APF? It works just fine if you configure it right. If you can't figure it out then hire someone to install it for you or fix the problems with your server that are preventing it from running.