m0n0wall

m0n0wall is a project aimed at creating a complete, embedded firewall software package that, when used together with an embedded PC, provides all the important features of commercial firewall boxes (including ease of use) at a fraction of the price (free software).m0n0wall is based on a bare-bones version of FreeBSD, along with a web server, PHP and a few other utilities. The entire system configuration is stored in one single XML text file to keep things transparent.m0n0wall is probably the first UNIX system that has its boot-time configuration done with PHP, rather than the usual shell scripts, and that has the entire system configuration stored in XML format.


Facts
The m0n0wall system currently takes up less than 6 MB on the Compact Flash card (or CD-ROM), and contains
all the required FreeBSD components (kernel, user programs)
ipfilter
PHP (CGI version)
mini_httpd
MPD
ISC DHCP server
ez-ipupdate (for DynDNS updates)
Dnsmasq (for the caching DNS forwarder)
racoon (for IPsec IKE)
UCD-SNMP
choparp
BPALogin
On a net4501, m0n0wall provides a WAN <-> LAN TCP throughput of about 17 Mbps, including NAT, when run with the default configuration. On faster platforms (like net4801 or WRAP), throughput in excess of 50 Mbps is possible (and > 100 Mbps with newer standard PCs).
On a net4501, m0n0wall boots to a fully working state in less than 40 seconds after power-up, including POST (with a properly configured BIOS)


Features
At this time, m0n0wall can be used as-is with the Wireless Router Application Platform from PC Engines (www.pcengines.ch), the net45xx/net48xx embedded PCs from Soekris Engineering (www.soekris.com) or most standard PCs (with a BIOS that supports booting from CD-ROM (El Torito standard) for the CD-ROM version).m0n0wall already provides many of the features of expensive commercial firewalls, including:
web interface (supports SSL)
serial console interface for recovery
set LAN IP address
reset password
restore factory defaults
reboot system
wireless support (access point with PRISM-II/2.5/3 cards, BSS/IBSS with other cards including Cisco)
captive portal
802.1Q VLAN support
stateful packet filtering
block/pass rules
logging
NAT/PAT (including 1:1)
DHCP client, PPPoE, PPTP and Telstra BigPond Cable support on the WAN interface
IPsec VPN tunnels (IKE; with support for hardware crypto cards, mobile clients and certificates)
PPTP VPN (with RADIUS server support)
static routes
DHCP server and relay
caching DNS forwarder
DynDNS client and RFC 2136 DNS updater
SNMP agent
traffic shaper
SVG-based traffic grapher
firmware upgrade through the web browser
Wake on LAN client
configuration backup/restore
host/network aliases