Calling all Linux enthusiasts! Help us create a comprehensive guide to Linux firewalls and security!

The defaults are great.

Most firewalls are at their safest when you first get them i.e by default they block everything coming in. As you start doing port forwarding and the like you start making the network selectively less secure; that's when you have to pay attention.

I had an EdgeRouter X for years before I started my job. They are solid devices, and I'd definitely put them above most consumer routers.

Because they only charge for the hardware, they will eventually run into the same disincentive to provide consistent timely updates. If you do buy an Ubiquiti or similar enthusiast brand, do still keep an eye out for the CVEs that don't get patched.

Home networks are full of trash like iot devices, like smart speakers, tvs, plugs, etc. Average people should have firewalls. It’s free.

Yeah, because how many people take their laptops out of their home, amiright?

That's the kind of box I've been using. Just been running linux on it. It's been a few years, I'll look into opnsense, thx.

My issue is that the cheapo consumer hardware sucks. Using good software on bad hardware doesn't solve the issue. Unless I can use it on a normal computer... last I looked into it, I don't think you could.

You got a lot of good answers to this. I'll add mine:

A router is a device that bridges multiple physical networks (it will have at least two network interfaces) and directs traffic between them. It inspects every packet of data and decides which port to send it to.

In a typical home here in the US, one network is your ISP (connected to your cable modem, for example) and the other is your home computers, consoles and devices via wifi or direct connection (like a NAS drive, for example).

Generally you want a firewall to go along with your router. Instead of blindly passing all data to the correct network, it will decide whether it is allowed to pass or not based on a configured ruleset. Most consumer home wifi routers have a simple firewall built-in.

They also have other features like "load balancing" to prioritize certain data that is more sensitive to interruptions in the data flow (like gaming) over data that isn't (like video or audio), or "DHCP servers" to hand out IP addressed to devices on the network, or "VPN tunneling" to encrypt data, etc.

A linux-based computer is more than capable of performing all these tasks. If well-configured, it can do it much better than a consumer device, with better hardware and more reliability for less money over time (when taking reliability into account).

There is a thing called the OSI model, which is a useful tool for understanding what different components of a computer network do. I suggest looking up that term if you want to learn more about how networks work.

You might be familiar with the idea of IP addresses and MAC addresses. An IP address is routable, as in you can look at an IP address and tell where on the network (and broadly speaking, in the world) it is. A MAC address is assigned to the network adapter during its manufacture, it's kind of like the machine's name.

When you get out a sheet of parchment, a well of squid ink and a quill pen and write an old fashioned letter to an acquaintance (ask your parents, they probably used to actually do this), you write both the recipients street address and their name on the envelope. The postal service uses the street address to move the letter to the correct building, and then there's probably someone in your household who gets the mail out of the mailbox and then says "Jim, this letter is for you."

Think of a router as a post office; routers send each other data packets based on the recipient IP address. A switch works via MAC addresses and is more like your dad saying "Jim you got a letter." A hub, which is a technology we don't use anymore, would be more like your dad reading everyone's mail out loud for everyone to hear, and everyone else is just supposed to ignore what's not for them.

Now, let's talk about a more informal definition of the word "router": The box with a bunch of wires and probably a couple antennas on it that your Wi-Fi probably comes out of. We call that little box a "router," and that's one of the many jobs it does. You can think of networking components as little building blocks, and your home router has many building blocks in it. It's a little computer with some networking hardware attached, and it likely functions as a router, an Ethernet switch, a wireless access point or two, probably your DHCP server (assigns IP addresses to devices on the network automatically), it probably serves as a firewall, mine can be a print server or a file server.

A router routes traffic. It usually has dhcp and a firewall.

However, most devices for consumers are a router, switch and a wireless access point. What this means is that they have a router but also Ethernet plugs in the back and a WiFi antenna

That's understandable. However, pf (OpenBSD's firewall system) is incredibly logical and easy to use. I never expected to write a fully operational (bloody thing worked the first time I tried it!) firewall ruleset on a two hour flight from scratch.

There aren't many distro with a base system as tiny as Arch. It's not a bad choice at all. It's on my server since many years, working perfectly reliable. Everything except the base system is inside Podman containers. Why not?