Installation

2.1. Dependencies

Firewall Builder needs several packages to be installed on the system because they provide various software libraries used by the code. On FreeBSD and OpenBSD these prerequisite packages will be installed automatically as a part of the port build process. The same happens on Mac OS X, where fink package manager automatically downloads, compiles and installs dependency packages. On Linux systems that use RPM package manager (RedHat, Mandrake and SuSE) dependency packages should be installed manually. The list of RPMs for these packages is provided below, separately for each supported Linux distribution. Most of these RPMs come with the OS and can be found on the distribution CD. Some of them are not part of the OS distribution and need to be downloaded. Sites such as http://rpmfind.net/, http://freshrpms.net/ and http://rpm.pbone.net/ serve either as repository of RPMs or specialized search engines. Of these, http://freshrpms.net/ is very complete repository of up-to-date RPMs specifically for RedHat 8 and RedHat 9, while http://rpm.pbone.net/ runs very powerful search engine that indexes lots of web and ftp sites that provide access to tons of RPMs.

2.2. RedHat 7.x

If your system is configured as "Gnome Workstation" or Ximian Gnome is installed, then you already have proper gtk+, gtkmm and libsigc++ packages. If you are using KDE, then you may need to add these packages.

libxml2, libxslt, libsigc++ and gtkmm come as part of RedHat 7.3 or can be downloaded from http://xmlsoft.org and ftp://ftp.ximian.com/

Firewall Builder implements number of features which make use of SNMP, therefore you will need ucd-snmp RPM installed, too. RPMs we distribute are built using ucd-snmp v4.2.3 (as of Feb 2002)

2.3. RedHat 8.0

Requirements are pretty much the same as for RH 7.x. Here is the list of packages that need to be installed:

Unfortunately RedHat 8.0 does not come with libgtkmm and libsigc++ which are needed for fwbuilder. There are different ways you can get around this problem. You can recompile these two libraries yourself, using source rpm packages from earlier RedHat distribution. This can be done, but some tweaking of the source code is required. It is simpler to download pre-built RPMs from http://freshrpms.net/ . Look there under Custom packages : RedHat 8.0 (Psyche), then browse down to gtkmm and libsigc++

We provide links to these RPMs on http://freshrpms.net/ site from the Downloads page on http://www.fwbuilder.org/. Section for each Linux distribution has links to gtkmm and libsigc++ RPMs right after links to fwbuilder RPMs.

Another great place to download these RPMs from is http://rpm.pbone.net/, just use their search function by entering libsigc++-1.0.4 and gtkmm-1.2 in it.

2.4. RedHat 9.0

Requirements for RedHat 9.0 are just like those for RedHat 8.0. Here is the list of RPMs you need:

gtkmm and libsigc++ RPMs can be downloaded from http://freshrpms.net/ . Look there under Custom packages : RedHat 9.0 (Shrike), then browse down to gtkmm and libsigc++10. Note that there are packages with similar but different names "gtkmm2" and "libsigc++". You really need to install "gtkmm" and "libsigc++10", it is important.

We provide links to these RPMs on http://freshrpms.net/ site from the Downloads page on http://www.fwbuilder.org/. Section for each Linux distribution has links to gtkmm and libsigc++ RPMs right after links to fwbuilder RPMs.

Another great place to download these RPMs from is http://rpm.pbone.net/, just use their search function by entering libsigc++-1.0.4 and gtkmm-1.2 in it.

2.5. Fedora Core 1

Requirements for Fedora Core 1 are just like those for RedHat 9.0. Here is the list of RPMs you need:

Packages "libxml2", "libxslt", "openssl", "net-snmp" and "bind" come with Fedora, just install the latest available versions.

gtkmm and libsigc++ RPMs can be downloaded from http://freshrpms.net/ . Look there under Custom packages : RedHat 9.0 (Shrike), then browse down to gtkmm and libsigc++10. Note that there are packages with similar but different names "gtkmm2" and "libsigc++". You really need to install "gtkmm" and "libsigc++10", it is important.

We provide links to these RPMs on http://freshrpms.net/ site from the Downloads page on http://www.fwbuilder.org/. Section for each Linux distribution has links to gtkmm and libsigc++ RPMs right after links to fwbuilder RPMs.

Another great place to download these RPMs from is http://rpm.pbone.net/, just use their search function by entering libsigc++-1.0.4 and gtkmm-1.2 in it.

2.6. SuSE 9.0

Using our binary RPMs on SuSE 9.0 is easy and requirements are just like for RedHat. Basically, all packages that you need to run Firewall Builder come with SuSE distribution and get installed automatically if you chose to install Gnome workstation. Use Yast to install packages, it automatically resolves dependencies and helps to get it done quickly.

SuSE 9.0 Professional Edition comes with RPMs for gtkmm and libsigc++ libraries (gtkmm-1.2.10-143.i586.rpm and libsigc++-1.0.4-265.i586.rpm). The Personal Edition does not include these packages, but you can download them from ftp://ftp.suse.com/.

Here is the list of other packages you would need to install fwbuilder on SuSE 9.0:

2.7. Mandrake 9.1 and 9.2

Here is the list of RPMs you need to have on your system. All these packages are part of Mandrake distribution.

3.1. Build Environment and Procedure

First of all, you need to establish build environment. You will need to install the same libraries you would need to run our binary distribution, plus development packages of all the same libraries. That is, if you use RedHat or Mandrake, then you would need to install gtkmm-devel in addition to gtkmm RPM, libxml2-devel in addition to libxml2 and so on. See below for the list of packages for other OS and distributions.

We tested with different versions of libxml2 and libxstl starting from libxml2-2.4.0 and libxslt-1.0.0, although we recommend using the latest which at the moment of writing this document are libxml2 2.4.19 and libxslt 1.0.15. Gnome ships with libxml-1.8 but you do not need to remove this one, just install libxml2 in addition, they do not conflict.

You will also need relatively new resolver library (libresolv). I do not know how to determine version of libresolv itself since RedHat now ships it as part of glibc and glibc-devel package. You should be fine if you use any fresh distribution. If your glibc is 2.2 then your copy of libresolv is fine. RedHat 6.2 ships old resolver though, so unfortunately you can not build Firewall Builder with support for advanced DNS features on RedHat 6.2.

Make sure you have both bind and bind-devel packages installed and it should be bind 8 or 9

If you want to be able to use SNMP to collect some information about hosts/firewalls, you need to have ucd-snmp package installed. We tested with version 4.1.3 and newer. Home page: http://net-snmp.sourceforge.net/. If snmp library is not installed on your system, then support for features requiring SNMP will be automatically disabled by configure script.

If you would like to build online class reference for the API, then you need to install DOC++ package. Home page: http://docpp.sourceforge.net/. If it is not present no error message will be shown, but class reference won't be generated.

Firewall Builder has been translated into several languages and uses GNU gettext to support internationalization. This means you will need this package on your system to build Firewall Builder. Some OS and distributions come with it by default, while others do not. See below for details.

To build from source, download and unpack two tar.gz archives: libfwbuilder-N.N.N.tar.gz and fwbuilder-M.M.M.tar.gz. First you need to build and install libfwbuilder because fwbuilder depends on it. The build procedure is the same for both modules, so I'll describe it only once using libfwbuilder as an example.

In order to build, you basically need to do the following:

$ zcat libfwbuilder-0.10.8.tar.gz | tar xvf -
$ cd libfwbuilder
$ ./autogen.sh --prefix=/usr/local
$ make
$ su
# make install

Note that you should run script autogen.sh instead of configure, this script regenrates configure and number of other autoconf scripts using templates specific your OS and distribution.

This installs the following files on your system (actual directory paths may differ on different OS and distributions and also depend on the value of parameter --prefix given to autogen.sh ):

• libraries libfwbd, libfwbuilder, libfwcompiler in ${prefix}/lib

• few documentation files in /usr/share/doc/libfwbuilder-${VERSION}

• XML DTD file fwbuilder.dtd /usr/share/libfwbuilder/

• autoupgrade scripts in /usr/share/libfwbuilder/migration

Once you installed libfwbuilder, you can execute the same sequence of commands for fwbuilder. Module fwbuilder builds and installs the following:

• GUI - executable file "fwbuilder", installed in ${prefix}/bin

• few documentation files in /usr/share/doc/fwbuilder-${VERSION}

• examples in /usr/share/doc/fwbuilder-${VERSION}/examples

• various auxiliary files and scripts in /usr/share/fwbuilder

• locale files in /usr/share/locale/

• man pages in /usr/share/man/

• icons in /usr/share/pixmaps/fwbuilder/

• Policy compiler for iptables - file "fwb_ipt", installed in ${prefix}/bin

• Policy compiler for pf - file "fwb_pf", installed in ${prefix}/bin

• Policy compiler for ipfilter - file "fwb_ipf", installed in ${prefix}/bin

See Section 2.1 for the URLs of online repositories of RPMs and specialized search engines where these RPMs can be downloaded from..

3.2. Special Build Instructions for different OS

# rpm --nosignature -ivh gtkmm-1.2.10-fr3.i386.rpm 
Preparing... ###################################### [100%]
1:gtkmm ###################################### [100%]
# rpm --nosignature -ivh gtkmm-devel-1.2.10-fr3.i386.rpm 
error: Failed dependencies:
gtkmm = 1.2.10 is needed by gtkmm-devel-1.2.10-fr3

3.3. Notes on using gcc 3.2

As of October 2002 (version 1.0.7) both libfwbuilder and fwbuilder compile and run just fine on systems based on gcc 3.2 (RedHat 8.0 and Mandrake 9.0). Please note that the whole system, including all the libraries, must be compiled with the same compiler. This happens because gcc 3.x uses different name mangling algorithm for C++ code than previous versions of gcc; therefore it produces code that is incompatible with code compiled with previous versions of the compiler. For example, RedHat 8.0 does not ship libraries libsigc++ and libgtkmm which we use for the GUI. You either need to compile these libraries yourself, or use pre-built packages from Mandrake 9.0. Binary packages of these libraries built for RedHat 7.3 won't work!

4.1. Build Procedure

You can always compile Firewall Builder locally without building proper packages. For example, when I need to test new version I compile and install it in my own home directory, this way I can have two different versions installed on the same machine. You could do the same just to be able to use it until proper packages for your system are built or when you do not have root access to install it system-wide.

First, create directory $HOME/fwbuilder and add the following to your environment:

  PATH=$HOME/fwbuilder/bin:$PATH
  LD_LIBRARY_PATH=$HOME/fwbuilder/lib:$LD_LIBRARY_PATH
  export LD_LIBRARY_PATH

I am using bash so I just put these commands in a script and execute it using operator "." (dot), or you could use aliases.

Next unpack both libfwbuilder and fwbuilder somewhere, e.g. in $HOME/src/. Then follow the standard build procedure, except add a parameter to calls to autogen.sh to specify new install prefix:

$ cd $HOME/src/libfwbuilder
$ ./autogen.sh --prefix=$HOME/fwbuilder/
$ make
$ make install
$ cd ../fwbuilder
$ ./autogen.sh --prefix=$HOME/fwbuilder/
$ make
$ make install

this is it. Since you already have $HOME/fwbuilder/bin in your path, you should be able to just start it from command line:

$ fwbuilder