Software Map

ffproxy is a filtering HTTP/HTTPS proxy server. It
is able to filter by host, URL, and header. Custom
header entries can be filtered and added. It can
even drop its privileges and optionally chroot()
to some directory. Logging to syslog() is
supported, as is using another auxiliary proxy
server. An HTTP accelerator feature (acting as a
front-end to an HTTP server) is included.
Contacting IPv6 servers as well as binding to IPv6
is supported and allows transparent IPv6 over IPv4
browsing (and vice versa).

Iptables-Control is a fast and easy iptables filter configurator It features a step-by-step interactive configurator script, a TCP/UDP ports configurator, LAN settings for routing and masquerading, and ICMP filtering.

SuperShaper-SOHO is a traffic shaping setup for DSL connections which prioritizes VoIP and interactive traffic and makes sure P2P traffic doesn't saturate your uplink.

ipset allows administration of sets of IP addresses/networks, ports, MAC addresses, and interfaces, which are stored in hash or bitmap data structures. These can then be used in conjunction with iptables to do fast presence lookups.

tsocks provides transparent network access through a SOCKS version 4 or 5 proxy (usually on a firewall). tsocks intercepts the calls applications make to create TCP connections and determines if they can be directly accessed or need the SOCKS server. If they need the SOCKS server they connection is negotiated with the server transparently to the application. This allows existing applications to use SOCKS without recompilation or modification. tsocks is a wrapper library for the libc connect() call.

With Snort2Pf, you can turn your local Snort
installation easily into an "intrusion detection
and prevention system", rather than simply using
it for post-mortem analysis. Such a system also
blocks the recognized violations.

Alfandega is a strong and modular iptables firewall. It provides NAT, port-forwarding, spoofing list, blacklist of crackers and spywares sites, protection for TCP/UDP scans, DOS/DDOS and Smurf attacks, TCP tuning, DHCP/PPP support, and much more.

filtergen takes a high-level language and compiles
it into packet filtering rules for a variety of
packet filters. Iptables, ipchains, and ipfilter
backends are available.

ike-scan discovers IPsec VPN servers, and can
fingerprint them using UDP backoff and Vendor ID
fingerprinting techniques. It supports IKE Main
Mode and Aggressive Mode. ike-scan allows flexible
specification of the outgoing IKE packet, and
decodes the response packets. It also supports
pre-shared key cracking for IKE aggressive mode
with pre-shared key authentication.

Fair NAT is a script for configuring NAT on
dedicated Linux routers. It's designed to be
highly customizable and therefore well documented.
A configuration file lets you specify which
clients on your LAN should be allowed to use the
router, which ports are to be forwarded to which
client, and much more. It uses the kernel's
Traffic Shaping capabilities to share bandwidth in
a fair manner among users. Some kernel patches are
recommended for better performance. Experimental
support for peer-to-peer traffic detection is
available.

flashboot for OpenBSD is a set of makefiles, scripts, and support tools to build an OpenBSD image suitable for booting from read-only media, such as flash memory. The default image (smaller than 5Mb) is an image for a firewall/router with support for IPsec, SSH, IPv4 and IPv6 packet filtering, DHCP (client and server), and PPPoE. This image may be further trimmed or extended by editing the packing list files included in the distribution.

Cutter allows network administrators to close
TCP/IP connections running over a Linux/iptables
firewall. It closes the connection in such a way
as to lead both ends (client and server) to
believe that it was aborted by the other.

Hardened Linux is a hardened and minimalized Linux distribution based on Slackware. It includes a grsecurity/PaX patched
kernel, stack smashing protected and hardened
packages, additional security scripts, and
automatically enabled host intrusion detection.

fk is an application proxy suite designed for building IP gateways. Ultimately, the intent is to provide a free software replacement for the TIS firewall toolkit.