LAN security

[ixion]

I have a couple questions about Security:

First off, I am currently using Freesco as a firewall to protect my LAN. In case you didn't know, it uses a Linux 2.0.x kernel with IPFWADM. As I've been reading more and more about IPTABLES, I'm really starting to like it's 'stateful packet filtering' options (mainly to protect against SYN attacks). Now on Freesco's (IPFWADM) defense, it is such old software that most hackers don't bother with it, or care to waste their time trying to hack it (as I've heard). What do you security guru's think (in your most paranoid opinions)? Should I stay with the light and easy configurable IPFWADM-based Freesco, or should I update my firewall box (have to buy a new box, Gentoo doesn't like P133's ) and throw a IPTABLES firewall out there to be hit?

My second question is, should I setup IPTABLES on all my internal boxes? This is yet one more layer of security, but I'm afraid my gaming rig may have network performance issues (I do a lot of online gaming). Should I just enable IPTABLES on my File Server? I know there's virtually no change in bandwidth/throughput with/without Freesco. Is IPTABLES just as efficient? Is it worth the added layer of security to configure it?
_________________
only the paranoid survive

[rojaro]

i usually use shorewall, as it's very easy to setup and also a very well thought system. it's in the portage tree, so give it a try :)

iptables is also a nice toy to play with. i usually use it on my webservers to redirect port 80 internally to port 8080, so i can run the webserver as a normal user at port 8080 and i don't have to run it as root. i also use this for some smtp and pop3 servers. i am currently experimenting to have the apache running in a chrooted sandbox which should give some additional security, but i also have two servers running this way in usermode linux which is also a good option.
_________________
A mathematician is a machine for turning coffee into theorems. ~ Alfred Renyi (*1921 - †1970)

[ixion]

very interesting.. well my overall scheme is to DMZ my internet servers (Web server, game server) and install IPTABLES on those... I also might install IPTABLES on all internal boxes, but have Freesco as my LAN firewall... does that sound like a good plan?
_________________
only the paranoid survive